For Cybersecurity Awareness Month, the independent domain security census, is making its A-Grade Playbook free

For Cybersecurity Awareness Month, https://defaults.exposed, the independent domain security census, is making its A-Grade Playbook free.

RAS AL-KHAIMAH, UNITED ARAB EMIRATES, September 26, 2026 /EINPresswire.com/ -- For Cybersecurity Awareness Month, https://defaults.exposed, the independent domain security census, is making its A-Grade Playbook free until the 31 October 2026, one per domain. The playbook tells a domain owner what is broken, why it matters, what to fix first, and the exact records to paste, with the click-path for their own DNS host and mail console. The scan that produces it is free, takes about a second, and needs no signup.

The census grades all available domains across all available top-level domains each month.

The most recent census, from September 2026, shows 74.2% score an F on the census's published checks covering SPF, DKIM, DMARC, DNSSEC, TLS and web security headers, and 0.2% score an A. Only 24.8% publish a DMARC record, the record that tells receiving mail servers what to do with forged mail. More than half of those (53.3%) say p=none: deliver it as normal. Taken together, 88.4% of domains do nothing to stop an email that claims to come from their domain.

What owners fixed since July
Since the single domain scanner launched in July, thousands of domains have been scanned by their owners and operators, and hundreds of those have been scanned more than once. Roughly one in six of the rescanned domains moved from a failing grade to a passing one between scans.

The fastest confirmed repair took 14 minutes: an operator turned on DKIM signing and three security headers in one sitting, then rescanned. Another domain scored an F (58%) at three in the morning and an A (90%) twelve hours later. On the census scale, F is below 60% and A is 90% or above.

HTTP security headers, were the most common fix. DNSSEC came next, then SPF. DMARC, the record that stops forged mail, was the least applied fix, though several domains moved their policy from p=none to quarantine or reject.

The playbook is for the domains that stop short of that step. Every fix is documented free on the site, one check at a time. The playbook sequences all of them for one domain in the safe order, lowest-risk changes first and mail delivery last, names the tripwires, and re-checks the domain up to ten times as the changes go in.

What it costs
The FBI logged 24,768 business email compromise complaints in 2025, with reported losses of $3.05 billion, up from $2.77 billion in 2024. Averaging about $123,000 per complaint, the typical case is an email that looked like it came from a real supplier, asking for payment to a different account.

Google, Yahoo and Microsoft now require SPF, DKIM and DMARC from anyone sending mail in volume, and legitimate mail from domains that fail those checks is increasingly junked or rejected.

How to claim the free playbook
Claim it at https://defaults.exposed/free-playbook by 31 October 2026. Enter the domain and an email address at that domain, confirm from the email that arrives, and the playbook follows within seconds. There is one playbook per domain, with no account and no card.

October is Cybersecurity Awareness Month in the United States and European Cybersecurity Month in the EU.

Notes to editors
1. Census methodology, grade bands and the full list of checks: https://defaults.exposed/methodology.
2. Summary data: https://defaults.exposed/explore and https://defaults.exposed/stats.
3. Repair figures come from user-initiated scans between July and September 2026.
4. Business email compromise figures: FBI IC3 2025 Internet Crime Report, https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf.

About Defaults Exposed
Defaults Exposed is an independent domain security census. Each month it grades the published DNS, email authentication and web transport security of all the domains it can source (317 million in September 2026), and lets anyone check a single domain free, without signing up. It measures every domain the same way, has no relationship with the domains it grades, and is not affiliated with any security vendor.
Its aim is to make domain security visible and fixable for every business.

Contact
press@defaults.exposed
https://defaults.exposed

DefaultsExposed
Defaults Exposed FZ-LLC
+971 58 551 5776
press@defaults.exposed
Visit us on social media:
LinkedIn
Instagram
Facebook
YouTube
TikTok
X