October 2026 Domain Security Census Finds 18.6 Million Domains Reject Forged Email

Defaults Exposed published the October 2026 edition of its census of 332 million domains and released the aggregate data on Zenodo, Kaggle and Hugging Face.

UNITED ARAB EMIRATES, October 15, 2026 /EINPresswire.com/ — Defaults Exposed today published the October 2026 edition of its Domain Security Census, which graded 332,492,319 domains on the email authentication, DNS and web security settings they publish. The census found that 18,601,119 domains publish a DMARC policy of p=reject, which instructs receiving mail servers to refuse email that falsely claims to come from the domain. The aggregate data behind the census has been released under a Creative Commons Attribution 4.0 licence.

The census, published during Cybersecurity Awareness Month, scanned 632,901,201 names drawn from ICANN zone files obtained through CZDS, from OpenINTEL and from CommonCrawl on 11 and 12 October 2026. Of those names, 361,301,790 exist and 332,492,319 are graded.

Key findings

– DMARC: 83,466,694 domains publish a DMARC record, 25.1% of graded domains. 39,758,587 enforce it with p=quarantine or p=reject, 47.6% of domains that publish a record. Across the census’s cohort of 1,243 top-level domains measured monthly since July, nearly half of DMARC records have asked receivers to quarantine or reject forged mail in every edition.
– SPF, DKIM and reporting: 157,065,571 domains publish an SPF record, and 61,408,709 end it with the strict -all. Where the census could check for DKIM, 50.5% of domains publish a signing key. 32,980,787 domains request DMARC aggregate reports.
– Encryption: 220,264,382 graded domains offer HTTPS. 94.5% of them negotiate TLS 1.3, and the census found none limited to TLS 1.0 or 1.1. 89.2% present a valid certificate, and Let’s Encrypt issued 56.7% of the certificates. 47,116,222 domains send an HSTS header.
– DNS resilience: 326,097,543 domains run more than one name server, 98.9% of those checked. 23,390,098 domains are signed with DNSSEC and validate, and 72,634,768 are reachable over IPv6.
– Full protection: 1,325,934 domains publish SPF, an enforcing DMARC policy, DNSSEC, HTTPS and HSTS together. 87,562 domains earn an A+ on the census checks and 613,481 an A.
– Top-level domains: among top-level domains with at least 500,000 graded domains, .nl has the highest share scoring above F, 58.6% of 4,055,303, followed by .ch at 58.2% of 1,849,400. .dk has the highest share of A and A+ grades, 15,999 of 1,104,513.
– Most visited sites: of the 10,000 most visited domains on the Tranco list, the 9,840 the census could grade average a score of 66, against 47 for all graded domains.

Context

Email authentication has become a requirement for large senders. Since 1 February 2024, Gmail has required SPF and DKIM from anyone sending more than 5,000 messages a day to its users, and since 5 May 2025 Outlook.com has required a passing DKIM signature from senders at that volume. Forged sender addresses remain a common route into phishing and invoice fraud.

“Every one of these records is a decision somebody made, usually without anyone noticing,” said a Defaults Exposed spokesperson. “The census counts them, and the data is open so that researchers, journalists and site owners can check every figure.”

Availability

The aggregate data is published on Zenodo at https://doi.org/10.5281/zenodo.22690388, and as tables on Kaggle (https://www.kaggle.com/datasets/defaultsexposed/domain-security-census) and Hugging Face (https://huggingface.co/datasets/defaultsexposed/domain-security-census). The grading method is published at https://defaults.exposed/methodology. Any single domain can be checked free at https://defaults.exposed, which shows its grade and which of these protections it publishes.

Notes to editors

Figures are from the October 2026 edition, data as of 12 October 2026; the month-by-month line comes from the census’s July to October cohort. Cite the dataset as: Defaults Exposed, Domain Security Census, Zenodo, https://doi.org/10.5281/zenodo.22690388.

About Defaults Exposed

Defaults Exposed (https://defaults.exposed) is an independent census of domain security. It grades the published DNS, email and web security settings of every domain it can find, publishes its aggregate data openly, and runs a free check for any single domain.

Press Office
Defaults Exposed
press@defaults.exposed

Media gallery