For Cybersecurity Awareness Month, https://defaults.exposed, the independent domain security census, is making its A-Grade Playbook free.
For Cybersecurity Awareness Month, https://defaults.exposed, the independent domain security census, is making its A-Grade Playbook free until the 31 October 2026, one per domain. The playbook tells a domain owner what is broken, why it matters, what to fix first, and the exact records to paste, with the click-path for their own DNS host and mail console. The scan that produces it is free, takes about a second, and needs no signup.
The census grades all available domains across all available top-level domains each month.
The most recent census, from September 2026, shows 74.2% score an F on the census’s published checks covering SPF, DKIM, DMARC, DNSSEC, TLS and web security headers, and 0.2% score an A. Only 24.8% publish a DMARC record, the record that tells receiving mail servers what to do with forged mail. More than half of those (53.3%) say p=none: deliver it as normal. Taken together, 88.4% of domains do nothing to stop an email that claims to come from their domain.
Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight
What owners fixed since July
Since the single domain scanner launched in July, thousands of domains have been scanned by their owners and operators, and hundreds of those have been scanned more than once. Roughly one in six of the rescanned domains moved from a failing grade to a passing one between scans.
The fastest confirmed repair took 14 minutes: an operator turned on DKIM signing and three security headers in one sitting, then rescanned. Another domain scored an F (58%) at three in the morning and an A (90%) twelve hours later. On the census scale, F is below 60% and A is 90% or above.
HTTP security headers, were the most common fix. DNSSEC came next, then SPF. DMARC, the record that stops forged mail, was the least applied fix, though several domains moved their policy from p=none to quarantine or reject.
The playbook is for the domains that stop short of that step. Every fix is documented free on the site, one check at a time. The playbook sequences all of them for one domain in the safe order, lowest-risk changes first and mail delivery last, names the tripwires, and re-checks the domain up to ten times as the changes go in.
Catch more CIO Insights: How Are CIOs Aligning Technology with Workforce Agility?
[To share your insights with us, please write to psen@itechseries.com ]
