State of email & domain security in the top 10,000 sites

Method

Sample. The top 10,000 entries of the Tranco list Y895G (downloaded 2026-11-11), a research-oriented ranking of popular domains that is hardened against manipulation. 9,971 of them answered in DNS and are counted here; the rest did not resolve or timed out.

When. Between 2026-11-11 and 2026-11-11, from a single vantage point, at no more than a few domains per second.

What we measured, per domain:

• NS and MX records, matched to providers by host name (self-hosted and unrecognised hosts are not attributed).
• SPF: the TXT record starting v=spf1 at the domain, and its final all qualifier.
• DMARC: the TXT record at _dmarc.<domain>, its p= policy, pct= and whether rua= is set.
• DNSSEC: whether the parent zone publishes a DS record for the domain.
• CAA records at the domain and the CAs they allow; the MTA-STS TXT record at _mta-sts.<domain>.
• TLS: a handshake on port 443 (the domain, or its www. name if the domain has no address) with the domain as SNI: negotiated version, certificate issuer and validity dates.
• HTTPS: one GET of https://<domain>/ following redirects, recording the Strict-Transport-Security header.

All DNS queries go to public resolvers (Cloudflare, Google, Quad9) with a 4-second timeout, and only public IP addresses are contacted. A lookup that timed out or failed is counted as unknown and left out of that metric's denominator, so each percentage states its own base.

Limitations

• Popularity lists favour large, often infrastructure-heavy domains (CDNs, APIs, trackers) that may never send or receive mail; their missing SPF or DMARC does not always mean a misconfiguration.
• We check the registrable name only, not subdomains, and only one address per name.
• Domains behind a mail-filtering gateway are counted for the gateway, not for the mailbox provider behind it.
• DKIM cannot be measured without knowing each sender's selector, so it is not included.
• A DNSSEC DS record shows the zone is meant to be signed; we do not validate the full chain here.

Data and licence

Download CSV

The CSV contains our aggregated measurements for this month (overall, by provider, by certificate authority and by TLD). It is published under CC BY 4.0: cite "HTTPfy, State of email & domain security in the top 10,000 sites (November 2026)" with a link to this page. It does not contain the Tranco ranking; get that from tranco-list.eu using list ID Y895G.

Explore by email and DNS provider, top-level domain or certificate authority.