Perimetry Research · November 2026 edition
How well are .fr domains protected?
We drew 20,000 domains at random from the 4,633,263 .fr domains in the open data of Afnic, the .fr registry, and measured each one with the same passive checks as our studies of public bodies and as Perimetry Cloud: 17,820 are active, with a site or a mail server. Companies, associations, professionals, private persons: the registry does not say who holds most of them, so this is a picture of the .fr as it is used, and no domain is named.
Download the full report (PDF) Findings, charts, every table, the comparison with public bodies, recommendations and the methodology.
- 17,820
- active domains measured
- 32
- average score out of 100
- 11.7%
- enforce DMARC (quarantine or reject)
- 3%
- get an A or a B
What stands out
71.6% of the graded domains have a strict SPF record and 38.6% publish a DMARC policy, but only 11.7% enforce it. For the others, an e-mail forged in their name (a fake invoice, a change of bank details) is generally delivered.
Websites: 59.1% of the domains with a site of their own have a valid certificate and 53.4% send visitors from HTTP to HTTPS; 17.3% use HSTS for six months or more and 14.1% send the basic protective headers.
25.9% of the domains are signed with DNSSEC, about as many as the communes (22.1%); 1.2% publish a CAA record.
Younger domains do better: 37 out of 100 on average for those registered less than two years ago, 27 for those registered more than ten years ago.
The mail provider matters: the domains whose mail is at Google Workspace average 39, at Microsoft 365 37, at OVHcloud 29.
Overall, 32 out of 100 on nine checks; the French communes average 47 on ten, higher education 64 on nine.
Grades
Each active domain gets a score: the share of the nine checks below that it passes, among those that apply to it (the score of our studies of public bodies, without the check on the contact address, which a domain alone does not give). 17,820 domains are graded; the average is 32 out of 100, the median 33.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
2,180 of the 20,000 domains drawn are inactive (not in DNS, or with neither a site in use nor a mail server: parked pages, a host’s placeholder page) and left out.
Check by check
Share of the graded domains that pass each check, among those it applies to. The website checks apply only to a domain with a site of its own.
Website
- Valid HTTPS certificate59.1%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 8,626 of 14,602.
- HTTP sends visitors to HTTPS53.4%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 7,793 of 14,602.
- HSTS for six months or more17.3%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 2,496 of 14,399.
- Basic protective headers14.1%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 2,025 of 14,399.
DNS
- DNSSEC25.9%
Answers about the domain are signed, so a resolver cannot be fed false addresses for its site or mail. 4,615 of 17,820.
- CAA record1.2%
The domain names the certificate authorities allowed to issue certificates for it. 221 of 17,819.
- Strict SPF71.6%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 12,762 of 17,819.
- DMARC record38.6%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 6,884 of 17,819.
- DMARC enforced11.7%
The policy is quarantine or reject: messages forged in the domain’s name, a fake invoice to a customer for example, go to spam or are refused, not delivered. 2,077 of 17,819.
By age of the domain
From the creation date in the registry’s file.
| Group | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|
| Registered less than 2 years ago | 5,705 | 37 | 4.3% | 12.9% | 33 |
| Registered 2 to 10 years ago | 7,704 | 32 | 2.5% | 11% | 33 |
| Registered more than 10 years ago | 4,411 | 27 | 2.2% | 11.1% | 22 |
By mail provider
From the names of the domain’s mail servers (MX). OVHcloud sets up its mail servers by default on many of the domains registered there: its group mixes mailboxes in use and settings left as they came.
| Group | Share of active domains | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|---|
| Microsoft 365 | 5.1% | 903 | 37 | 4.9% | 18.6% | 33 |
| Google Workspace | 3.8% | 679 | 39 | 4.3% | 10.6% | 40 |
| OVHcloud | 32% | 5,696 | 29 | 1.2% | 1.8% | 22 |
| Another mail provider | 45.5% | 8,108 | 35 | 3.5% | 17.2% | 33 |
| No mail server (no MX) | 13.7% | 2,434 | 26 | 4.4% | 13.9% | 22 |
By kind of site
From the home page. A domain with no site of its own (mail only, or a site that sends visitors to another domain) is judged on its DNS and mail only.
| Group | Share of active domains | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|---|
| WordPress | 17% | 3,030 | 42 | 2.6% | 7.9% | 44 |
| A site builder (Wix, Shopify, Squarespace, Webflow, Jimdo) | 4.4% | 782 | 45 | 4.3% | 6.1% | 44 |
| Another kind of site | 60.5% | 10,790 | 29 | 2.1% | 10.2% | 22 |
| No site of its own (mail only, or redirects to another domain) | 18.1% | 3,218 | 31 | 5.9% | 21.5% | 20 |
Compared with public bodies
The same checks as our studies of the French communes, local authorities and higher education establishments (latest editions): share of the graded bodies that pass each one. Their averages count ten checks for the communes and local authorities, nine for higher education and the .fr domains.
| Communes (on ten checks) | Local authorities (on ten checks) | Higher education (on nine checks) | .fr domains (on nine checks) | |
|---|---|---|---|---|
| Average score | 47 | 60 | 64 | 32 |
| Valid HTTPS certificate | 93.4% | 98.7% | 100% | 59.1% |
| HTTP sends visitors to HTTPS | 86.4% | 90.9% | 95.2% | 53.4% |
| HSTS for six months or more | 28.3% | 38.8% | 46.1% | 17.3% |
| Basic protective headers | 26.1% | 40.7% | 57.5% | 14.1% |
| DNSSEC | 22.1% | 25.9% | 12.7% | 25.9% |
| CAA record | 2.8% | 2.6% | 41% | 1.2% |
| Strict SPF | 85.9% | 97.1% | 93% | 71.6% |
| DMARC record | 45.2% | 77.8% | 86.9% | 38.6% |
| DMARC enforced | 19.2% | 32.8% | 45.4% | 11.7% |
Why no domain is named
In our studies of public bodies we name the good performers. Here we cannot: the registry does not say who holds most .fr domains, and many belong to private persons. Every figure on this page is an aggregate of at least ten domains.
How we measured
Passive checks only: the home page of each site over HTTP and HTTPS and nothing else on it, public DNS records, a robot that says who it is. Source: the open data of Afnic (file A of the .fr domains, Licence Ouverte), a random sample drawn again identically from the edition’s seed.
Read the methodology Download the figures (JSON) Download the full report (PDF)
You may reuse these figures with a link to this page.