Domain Armor

Domain Armor · Research · English

What 200 public DNS snapshots show

A small sample of Majestic-listed hostnames shows varied email-record publication, not whether websites or email are safe. This study was conducted by Domain Armor with AI assistance.

SPF

Denominator: 200 exact hostnames.

ObservationCountPercent
One record observed, not fully validated10552.5%
No exact-hostname record observed9045%
Multiple records21%
DNS query inconclusive31.5%

Limitations: Sample units are exact hostnames, including subdomains, not inferred organizational domains. No exact record does not prove absence of inherited policy or email protection. No recursive SPF or sender-IP authorization was tested.

DMARC

Denominator: 200 exact hostnames.

ObservationCountPercent
Single record with published p=none3316.5%
Single record with published p=quarantine2211%
Single record with published p=reject147%
No exact-hostname record observed12763.5%
Multiple records10.5%
DNS query inconclusive31.5%

Limitations: These are exact-hostname observations, not inferred organizational domains. No exact record does not prove absence of inherited policy or email protection. No DMARC tree walk or receiver enforcement was tested.

MX

Denominator: 200 exact hostnames.

ObservationCountPercent
Exchanger observed12160.5%
No MX observed7437%
Null MX21%
Inconclusive31.5%

Limitations: Observations apply to exact hostnames, including subdomains. No MX does not prove a hostname sends no email. These counts do not establish deliverability.

Limited DKIM discovery

Denominator: 200 exact hostnames.

ObservationCountPercent
Key-like record under tested selectors2814%
Only revoked-key records10.5%
Not found under tested selectors16884%
Inconclusive31.5%

Limitations: Only "default" and "selector1" were queried. This is not DKIM adoption, absence, validity or message-signing rate. No actual email signing or verification was tested.

Scope and limitations

No website safety, application security, deliverability or population-wide prevalence claim is made. No domain names, rankings, grades, raw DNS records, recipient addresses or downloadable raw files are published. This is not a certification or independent audit.

Method

The frozen Majestic Million CSV was downloaded on 6 November 2026 and contained 1,000,000 ranked hostnames. Ranking reflects referring subnets, not traffic or security.

CSV SHA256: 6c06eb69a4a5cf9bc4330e2b497880d34a274bbdf3f0411013f51a1bf70477ff

Normalize lowercase, trailing dot and IDNA; sort by SHA256(seed + "|" + exact hostname), then take the first 200. Seed: Domain Armor private pilot 2026-11-06 v1.

This fresh study is separate from the earlier 50-hostname method pilot, not pooled with it.

Collection

Public DNS only: no target websites, SMTP or application scans, and no Domain Armor API calls. Collection used 1,000 Google Public DNS wire-format queries, five per hostname, at 1 request/second with one in flight and a 5-second timeout.

Collection window: 06:45:17–07:03:01 UTC on 6 November 2026. There were 610 NOERROR, 375 NXDOMAIN and 15 SERVFAIL responses across three hostnames, with no HTTP/parser errors. Unknowns were not counted as missing.

Verification

60 Cloudflare wire-format queries covered the first 20 deterministic sample hostnames, plus 18 queries for six unusual cases; all 78 agreed. Total: 1,078 queries, against a cap of 1,100.

Twelve local parser fixtures passed. 20 classifications and all six unusual cases were manually reviewed; independent SPF/DMARC counts agreed; each section sums to 200.

DNS requests disclose names to resolvers and may trigger upstream DNS queries; this was not zero third-party traffic.

Pilot lesson: measurement limits

JSON quote presentation caused a false multiple-SPF finding in the earlier pilot. Current analysis uses dnspython 2.8.0 wire decoding and joins TXT chunks without stripping literal quotes.

Fixtures cover split TXT, literal quotes, multiple records, Null MX, NXDOMAIN, SERVFAIL, NODATA, CNAME, truncated and malformed packets, question mismatch and IDNA. This is a measurement-limits explanation, not an app-security claim.

Sources and attribution

Sample source: Majestic Million by Majestic, licensed under Creative Commons Attribution 3.0. Sampling and DNS analysis are our changes; no endorsement implied.