DNS & Email Security Scan Data 2026: 95% Score D or F

Why we are publishing this

Most writing about DNS and email security repeats the same advice without ever showing what real domains actually look like. We can show it. IntoDNS.ai stores an anonymised summary of every public scan, so we can report the real distribution of scores across the domains people have chosen to scan on intodns.ai.

Every number in this article was pulled from that database on 21 August 2026 via a single public endpoint, /api/stats/aggregate. It counts the most recent scan per domain (so a domain checked ten times still counts once) and never exposes any individual domain. These are a snapshot, not a live figure: the dataset keeps growing as more domains get scanned, so querying the endpoint yourself today will already show different numbers. We refresh this article periodically — it does not update itself.

The headline: most domains fail

Across this 6,302-domain sample (21 August 2026), the overall grade distribution is stark:

A+: 0%
A: 1%
B: 1%
C: 3%
D: 10%
F: 85%

That means 95% of domains in this sample score D or F on the combined DNS, email, DNSSEC, IPv6 and security-header assessment. About 2% reach a B or better. The average score across the sample is 41 out of 100.

This is a self-selected sample, not a random one. People scan domains they own, manage, or already suspect have a problem — that skews the numbers toward domains with issues. Read every figure in this article as "what domains people chose to scan on intodns.ai look like," not as a claim about DNS security in general.

Where domains lose points

Breaking the average score down by category, this is what the 6,302-domain sample shows as of 21 August 2026:

Email authentication: 65 / 100
Web & security headers: 44 / 100
DNSSEC: 39 / 100
DNS configuration: 27 / 100
IPv6 readiness: 12 / 100

In this sample, IPv6 readiness is the weakest category by a wide margin, and DNS configuration and DNSSEC also sit below halfway. Email authentication is the strongest category at 65, which is still a mediocre score — it is simply the least weak of the five. Category rankings like this reflect the current sample, not a trend: the sample has grown more than fivefold since we first published this article, and rankings have shifted along with it.

The aggregate can only tell you where this sample is weak, not what your own domain is missing. Run your own scan to get the specific finding for your setup.

The clearest pattern: .nl is ahead of .com

The most interesting split in this sample is by top-level domain.

.com — 4,954 domains, average score 39
.nl — 171 domains, average score 68
.org — 76 domains, average score 59
.net — 50 domains, average score 50

In this sample, .nl domains score 29 points higher on average than .com. That is a large gap, and it lines up with how the Dutch registry operates: SIDN has actively pushed DNSSEC adoption through registrar incentives for years, so a Dutch-registered domain is far more likely to arrive with DNSSEC already enabled. DNSSEC is a heavily weighted category, so that head start lifts the whole .nl average.

The practical takeaway depends on your registry. If you are on .nl, you are probably already benefiting from the registry's defaults — verify it rather than assume it. If you are on .com, DNSSEC is usually the single biggest one-record improvement available to you, because the registrar default is off and nobody ever turned it on.

What this means for a NIS2 readiness check

For organisations working toward NIS2, two of the Article 21.2 measures — (g) basic cyber hygiene and (h) cryptography — map directly onto what this data measures: email authentication and DNSSEC. In this sample, both sit below where an auditor would want them. If your own domain scores D or F, DNS configuration, DNSSEC, and IPv6 readiness — the weakest categories in this sample — are good places to start checking.

What a D or F actually costs you

These grades are not academic. A weak email-authentication score means anyone can send mail that looks like it comes from your domain, so your invoices and password-reset emails are easier to spoof and more likely to land in spam. A weak DNSSEC or security-header score means a visitor can, in the wrong circumstances, be quietly sent to a fake copy of your site. None of this requires the owner to do anything wrong — it is simply what an unhardened domain leaves open. The reassuring part is that a DNSSEC or security-header fix is usually a one-time DNS record or HTTP header, not a project. A domain can move from F to a solid B in an afternoon.

Scan your own domain against this baseline

The scanner is free, with no signup and no API key. The same engine that produced the numbers above returns a grade and an issue list for any domain in a few seconds.

Quick scan: visit intodns.ai and type a domain.
API: curl https://intodns.ai/api/scan/quick?domain=example.com
NIS2 quickscan: curl https://intodns.ai/api/scan/nis2?domain=example.com

If your domain lands on D or F — the outcome for most domains in this sample — the issue list tells you which records and headers to change first, and each finding links to a plain-language explanation of what it means.

Methodology and honesty note

Sample: 6,302 distinct domains, taking the most recent scan of each, as measured on 21 August 2026 from the /api/stats/aggregate endpoint.
Selection bias: this is not a random sample of the internet. People scan domains they own, manage, or already suspect have a problem, which skews the sample toward domains with issues. Read every figure here as "domains people chose to scan on intodns.ai," not as a general claim about DNS security.
Scoring: produced by the IntoDNS scoring engine; each finding cites the raw DNS record or header it was derived from. The full methodology lists every check and its weight.
This is a dated snapshot, not a live figure. The numbers above are frozen at 21 August 2026. The underlying dataset keeps growing — it has grown more than fivefold since this article was first published — so querying /api/stats/aggregate yourself today will show different numbers, and category rankings can shift as the sample changes. We refresh this article periodically; it does not update itself automatically.
We deliberately do not publish breakdowns we cannot compute from this dataset (for example exact SPF-qualifier or DMARC-policy ratios). When we can compute them, we will add them here with the real figures.

Frequently asked questions

What percentage of scanned domains fail DNS and email security?

As of 21 August 2026, across a 6,302-domain sample scanned with IntoDNS.ai, 95% score D or F, and the average score is 41 out of 100. About 2% reach a B or better. This is a self-selected sample — domains people chose to scan — not a random sample of the internet.

Why do .nl domains score higher than .com domains?

In this 6,302-domain sample (21 August 2026), .nl domains average 68 versus 39 for .com — a 29-point gap. The Dutch registry SIDN has pushed DNSSEC adoption through registrar incentives for years, so a .nl domain is more likely to arrive with DNSSEC already enabled, and DNSSEC is a heavily weighted category.

What is the weakest area of domain security?

In this 6,302-domain sample (21 August 2026), IPv6 readiness is the weakest category, averaging 12 out of 100. DNS configuration (27) and DNSSEC (39) are also below average, while email authentication is the strongest category at 65. These rankings describe this specific sample, not a general trend.

How is this domain security data measured?

Every figure in this article is a snapshot pulled from the public /api/stats/aggregate endpoint on 21 August 2026, counting the most recent scan per domain and never exposing any individual domain. It is a self-selected sample of domains people chose to scan — often because they already suspected a problem — not a random survey of the internet, and the live endpoint will show different numbers if you query it today.

Related IntoDNS audit paths

Use these companion guides to turn this check into a broader, repeatable domain-security workflow.

AI assistant and API workflow

This article is part of the IntoDNS.ai LLM and citation workflow. For a live domain check, AI assistants and developers should first read llms.txt or llms.json, then call /api/scan/quick?domain=example.com for the current DNS and email security score.

For this topic, use /api/dns/dnssec?domain=example.com when you need focused data instead of the full quick scan.

Use /citations/what-is-dnssec as the canonical citation for this topic. For implementation, use the DNSSEC guide and cite the scoring methodology when explaining grades or recommendations.