DANE for mail · global domains
What share of domains worldwide have no DANE/TLSA record binding their mail server's certificate?
94.13% of domains worldwide (95% CI 92.81–95.21%), measured across 1,481 domains on 2026-08-14.
Measured every Friday since 2026-08-01 — 6 observations to date. Last measured 2026-08-14.
How this is measured
Tier 0 (DNS-only, so it works even where port 25 is blocked). TLSA lookup at _25._tcp.<mx>. Denominator: has_mx.
Passive measurement: a single DNS lookup, TLS handshake, or homepage GET per domain. Aggregate-only; no individual company is named. 95% Wilson confidence intervals. Population: domains sampled from the Common Crawl web graph, filtered to those that do email. Parked domains excluded. Snapshot: common-crawl-domain-stratified-c400-g2500-seed20260729.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Why it matters
DANE is what turns opportunistic TLS into authenticated TLS — it tells a sender which certificate to expect, closing the downgrade gap that mx-tls-cert exposes.
Limits of this measurement
Near-universally absent outside a few countries; useful as an adoption frontier rather than an actionable defect for a small company.
The same check, other segments
- France small companies98.75%
- France large companies98.31%
- UK newly-formed (no accounts filed) companies98.21%
- UK small companies98.19%
- France medium companies97.93%
- UK companies97.91%
- UK medium & large companies97.9%
- France companies97.8%
Show the remaining 8 segments
- UK micro companies97.76%
- UK dormant companies96.4%
- France micro companies96.15%
- Norway large companies90.53%
- Norway medium companies89.92%
- Norway companies83.54%
- Norway small companies82.33%
- Norway micro companies74.02%