The previous guide in this series looked at what your domain tells a stranger. This one looks at the opposite: three records a domain can publish to protect people who will never know they exist, and how many major institutions actually publish them.
We checked eighteen — the largest retail bank, the primary government portal and the largest mobile operator in each of Singapore, Malaysia, Indonesia, Thailand, the Philippines and Vietnam. The same institutions this site has measured before, because three questions of one honest sample is worth more than three samples each chosen to suit its answer.
The three records
| Record | What it does | Published by |
|---|---|---|
| DNSSEC | Lets a resolver detect a forged DNS answer instead of believing it | 38.9% |
| CAA | Names which certificate authorities may issue for the domain | 16.7% |
| MTA-STS | Tells sending mail servers to refuse delivery unless TLS succeeds | 0 of 18 |
Nine of the eighteen publish none of the three. None publishes all three.
Why each one matters
DNSSEC addresses a structural weakness: ordinary DNS answers are unauthenticated, so a resolver cannot distinguish a real answer from an injected one. DNSSEC has the parent zone cryptographically vouch for the child, which turns a forged answer into a detectable failure rather than a successful redirect. Seven of eighteen publish it.
CAA is the cheapest of the three and the least deployed at 16.7%. It is a single DNS record naming which certificate authorities are permitted to issue certificates for your domain. Without it, any of the many publicly-trusted CAs can issue for you, and a mis-issuance is a valid certificate. With it, issuance by anyone else is a violation the CA is obliged to refuse. One record.
MTA-STS closes a gap most people assume is already closed. Mail between servers negotiates TLS opportunistically through STARTTLS — and because it is opportunistic, an attacker positioned in the path can strip the negotiation and the sending server will deliver in clear text rather than fail. MTA-STS lets a domain say: do not do that. If TLS fails, do not deliver.
Not one of the eighteen publishes it. Not one bank, not one government portal, not one telecoms operator.
The number we did not trust at first
A zero across the entire sample usually means the measurement is broken, so we checked our work.
Our harness runs controls on every execution: hosts whose answers we already know. The MTA-STS control initially failed — a domain we expected to publish a policy reported none. That could have meant the check was broken, which would have made the zero meaningless.
It turned out our expectation was wrong, not the check. The control domain publishes SPF and DMARC records at the location we were reading and no MTA-STS policy at all. We replaced it with a domain verified to publish one, the control passed, and the zero survived.
This is why controls are essential. A failing control forces you to investigate, which is how we distinguished a real finding from a broken query. A zero without a passing control isn't a finding; it's an assumption.
Announced is not enforced
One detail matters if you go on to deploy MTA-STS yourself, because it is where deployments quietly achieve nothing.
MTA-STS is two things. A DNS TXT record announces that a policy exists. The policy itself is a file served over HTTPS, and it carries a mode — and mode: testing enforces nothing at all. It only sends reports, which is useful for debugging, but it won't stop a sending server from delivering in clear text if TLS fails.
Our harness counts announcement and enforcement separately. To do otherwise—counting just the TXT record—would be to report a switched-off policy as a protection. It's the same error as checking for a security header without reading the permissive policy inside it.
Who is doing better
By sector, government portals lead on DNSSEC (three of six) and trail on CAA (none of six). Banks are the only sector with more than one CAA record, at two of six, and account for two of the seven DNSSEC deployments.
The pattern across sectors is that the record requiring coordination with a registrar and parent zone — DNSSEC — is deployed more often than the record requiring one line in a zone file. That is not what cost would predict, and the most plausible reading is that DNSSEC has been the subject of national policy pushes in several of these markets while CAA has not been the subject of anything.
Check your own
dig +short DS yourdomain.com
dig +short CAA yourdomain.com
dig +short TXT _mta-sts.yourdomain.comOutput on the first means DNSSEC is in play; on the second, that issuance is restricted; on the third, that a policy is announced — and if it is, fetch https://mta-sts.yourdomain.com/.well-known/mta-sts.txt and read the mode line, because that is the one that decides whether anything is enforced.
Our DNS lookup tool runs these from a browser. The companion guide, what your own domain tells a stranger, covers the same file from the attacker's side of the table.
Limits
Eighteen institutions is a sample, not a survey. The sites were chosen by fixed criteria (the same three slots in six countries) before we saw any results, which prevents cherry-picking but doesn't make the sample comprehensive. The per-sector splits rest on six sites each and should be read as indication, not ranking.
Publishing a record is also not the same as configuring it well. A DNSSEC deployment can be present and poorly maintained; a CAA record can name a CA you no longer use. We measured presence, which is the floor, and the floor is where two-thirds of this sample has not yet arrived.
Measured 19 August 2026; the script is in our repository and runs its controls on every execution.
View author profile → · Editorial policy
