{
 "metric": "mx-tls-cert",
 "segment": "global",
 "anchor": "domain",
 "label": "global domains",
 "population": "domains worldwide",
 "states": [
  "valid",
  "hostname_mismatch",
  "self_signed",
  "expired"
 ],
 "quiet_failure_states": [
  "self_signed",
  "expired"
 ],
 "measurement": "Complete STARTTLS, inspect the leaf certificate. Denominator: MXs offering STARTTLS.",
 "why_it_matters": "SMTP TLS is *opportunistic* (RFC 7435) — senders accept any certificate — so an invalid certificate still encrypts but authenticates nothing, leaving the connection open to interception. It only becomes a hard failure under DANE or MTA-STS `enforce`.",
 "limits": "Honesty demands the split. Because opportunistic TLS tolerates mismatches, only `self_signed` and `expired` are counted as the quiet failure; `hostname_mismatch` is reported but **not** counted.",
 "data_tier": "smtp",
 "population_predicate": "has_mx",
 "entity_type": "domain",
 "kind": "failure",
 "latest": {
  "day": "2026-08-14",
  "n": 1101,
  "qf_pct": 4.81,
  "ci": [
   3.7,
   6.24
  ],
  "dist": {
   "valid": 80.74,
   "hostname_mismatch": 14.44,
   "self_signed": 1.82,
   "expired": 3
  },
  "snapshot": "common-crawl-domain-stratified-c400-g2500-seed20260729"
 },
 "series": [
  {
   "day": "2026-08-02",
   "n": 1123,
   "qf_pct": 3.65,
   "ci": [
    2.7,
    4.92
   ],
   "dist": {
    "valid": 85.66,
    "hostname_mismatch": 10.69,
    "self_signed": 1.87,
    "expired": 1.78
   },
   "snapshot": "common-crawl-domain-stratified-c150-g2500-seed20260729"
  },
  {
   "day": "2026-08-04",
   "n": 1112,
   "qf_pct": 4.59,
   "ci": [
    3.51,
    5.98
   ],
   "dist": {
    "valid": 81.03,
    "hostname_mismatch": 14.39,
    "self_signed": 1.8,
    "expired": 2.79
   },
   "snapshot": "common-crawl-domain-stratified-c400-g2500-seed20260729"
  },
  {
   "day": "2026-08-05",
   "n": 1116,
   "qf_pct": 4.48,
   "ci": [
    3.41,
    5.86
   ],
   "dist": {
    "valid": 81.36,
    "hostname_mismatch": 14.16,
    "self_signed": 1.61,
    "expired": 2.87
   },
   "snapshot": "common-crawl-domain-stratified-c400-g2500-seed20260729"
  },
  {
   "day": "2026-08-07",
   "n": 1101,
   "qf_pct": 4.63,
   "ci": [
    3.54,
    6.04
   ],
   "dist": {
    "valid": 81.38,
    "hostname_mismatch": 13.99,
    "self_signed": 1.73,
    "expired": 2.91
   },
   "snapshot": "common-crawl-domain-stratified-c400-g2500-seed20260729"
  },
  {
   "day": "2026-08-14",
   "n": 1101,
   "qf_pct": 4.81,
   "ci": [
    3.7,
    6.24
   ],
   "dist": {
    "valid": 80.74,
    "hostname_mismatch": 14.44,
    "self_signed": 1.82,
    "expired": 3
   },
   "snapshot": "common-crawl-domain-stratified-c400-g2500-seed20260729"
  }
 ],
 "license": "CC BY 4.0",
 "source": "https://quietfailures.com/datasets/mx-tls-cert/global"
}