Compliance Benchmark

Buckets are mutually exclusive. 100 is separate from the 90-100 band (90 to <100).

Detailed breakdowns for five of the fourteen standards now tracked. The other nine appear as headline numbers in Standard adoption below.

Every tracked check, ordered by the share of applicable domains that fail it. Each bar segments by the rolled-up per-domain outcome.

The same outcomes rolled up to the control each check maps to.

Left: every open finding by its own severity. Right: each domain placed in the band of its single worst open finding.

Each domain's open-finding risk summed into one score, then bucketed. Domains with no open findings sit at zero.

Buckets are mutually exclusive and ordered by summed risk. The worst-case strip bins each domain by its single highest-risk open finding.

Checks ranked by failing domains weighted by severity. Fixing the top of this list clears the most exposure across the scanned population.

not tested means the probe mode was insufficient. unknown means a dependency was unavailable or the result was inconclusive.

Compliant share among domains where each standard was actually checked, grouped by category. RPKI and DANE span DNS and Email, so they appear under both.

Directional: the share compliant on the second category, among domains already compliant on the first.

Top TLDs by domain count. Rare suffixes are folded into "other" to preserve anonymity.

Percentiles are computed over every scored domain in the cohort, recomputed under the current scoring policy.