Where the scanned internet stands

Buckets are mutually exclusive. A score of exactly 100 is counted separately from the 90 to 100 band, which covers 90 up to but not including 100.

Detailed breakdowns for five of the fourteen standards now tracked. The other nine appear as headline numbers in Standard adoption, just below.

Compliant share among domains where each standard was actually checked, grouped by category. RPKI and DANE span DNS and Email, so they appear under both.

Every tracked check, ordered by the share of applicable domains that fail it. Each bar breaks down by the rolled-up per-domain outcome.

The same outcomes rolled up to the control each check maps to.

Left: every open finding by its own severity. Right: each domain placed in the band of its single worst open finding.

Each domain's open-finding risk summed into one score, then bucketed. Domains with no open findings sit at zero.

Buckets are mutually exclusive and ordered by summed risk. The worst-case strip bins each domain by its single highest-risk open finding.

Checks ranked by failing domains weighted by severity. Fixing the top of this list clears the most exposure across the scanned population.

not tested means the probe mode was insufficient. unknown means a dependency was unavailable or the result was inconclusive.

Directional: the share compliant on the second category, among domains already compliant on the first.

Top TLDs by domain count. Rare suffixes fold into "other" to preserve anonymity.

Percentiles are computed over every scored domain in the cohort, recomputed under the current scoring policy.