Open data
Aggregate security measurements of public domains, made with the same checks the XGM tools run. Only counts are published: no result is attributed to a domain.
Email and TLS security of the 100 most visited .ro domains
Input: the Tranco list N2PYW of September 15, 2026, the first 100 domains ending in .ro. Download the summary (JSON)
Email authentication
| Measure | Count | Share |
|---|---|---|
| SPF record published | 98 / 100 | 98% |
| SPF ends in -all (fail) | 59 / 98 | 60% of SPF records |
| SPF ends in ~all (softfail) | 36 / 98 | 37% of SPF records |
| SPF over the 10-lookup limit | 3 / 98 | 3% of SPF records |
| DMARC record published | 78 / 100 | 78% |
| DMARC enforced (quarantine or reject) | 51 / 100 | 51% |
| DMARC p=reject | 26 / 100 | 26% |
| DMARC p=none (monitoring only) | 27 / 78 | 35% of DMARC records |
| DMARC aggregate reports requested (rua) | 63 / 78 | 81% of DMARC records |
| Receives mail (MX records) | 97 / 100 | 97% |
| MTA-STS record | 1 / 100 | 1% |
| MTA-STS in enforce mode | 0 / 100 | 0% |
| TLS-RPT record | 1 / 100 | 1% |
Most of these domains send mail and publish SPF, but only about half tell receivers to act on a DMARC failure. A p=none record only collects reports, and a spoofed message from the domain is still delivered.
HTTPS
| Measure | Count | Share |
|---|---|---|
| Grade A+ | 21 / 96 | 22% |
| Grade A or A- | 39 / 96 | 41% |
| Grade B | 33 / 96 | 34% |
| Grade C or F | 3 / 96 | 3% |
| Certificate trusted | 93 / 96 | 97% |
| TLS 1.3 supported | 85 / 96 | 89% |
| TLS 1.0 or 1.1 still accepted | 34 / 96 | 35% |
| HSTS header sent | 32 / 96 | 33% |
| Certificate expires within 30 days | 4 / 96 | 4% |
4 of 100 domains did not answer HTTPS on the domain or on www and are left out of these shares.
Method
Each domain was checked once, from one server, with the code behind the XGM tools: the SPF include tree and its DNS lookup count, the DMARC record of the domain or its organisational parent, MX, MTA-STS (record and policy file), TLS-RPT, and the TLS scan with its A+ to F grade on the domain, falling back to www. DNS questions went to public resolvers.
A lookup that failed counts as unknown and leaves that share's denominator; it is never counted as missing. A site that blocks automated connections can look unreachable, and a single measurement can catch a temporary fault.
Using the figures
The figures may be quoted with a link to this page. The results per domain are not published, and XGM does not answer questions about how a particular domain scored: run the tools on a domain you manage instead.