The catalog holds 38,134 security artifacts, of which 22,629 are domain-security probes — a live read of TLS, HSTS, DNSSEC, SPF, and DMARC across every host and registrable domain a provider publishes. That is 26,073 domains and 35,457 hosts actually fetched, not asserted.
Here is what the whole catalog looks like when you probe it.
The numbers
| Control | Present | Of | Rate |
|---|---|---|---|
| TLS 1.3 | 32,784 | 35,328 hosts | 92.8% |
| SPF | 23,493 | 26,056 domains | 90.2% |
| DMARC | 22,033 | 26,050 domains | 84.6% |
| HSTS | 20,441 | 28,526 hosts | 71.7% |
| DNSSEC | 4,627 | 26,059 domains | 17.8% |
Transport is solved. Naming is not.
Everyone fixed the thing with a deadline
TLS 1.3 at 92.8% and SPF at 90.2% are the two controls with external forcing functions — browsers deprecating old TLS, mailbox providers rejecting unauthenticated mail. Give the industry a hard cutoff and a broken user experience on the far side of it, and the industry complies.
DNSSEC at 17.8% has neither. Nothing visibly breaks without it. No browser warns. No mailbox provider bounces. So five out of six API providers do not sign their zone, and an attacker who can poison a resolver can point api.example.com anywhere they like — with a valid certificate, if they can also pass domain validation. CAA records would constrain that, and the probe finds those largely absent too.
The DMARC number is softer than it looks
22,033 domains publish DMARC, which reads like an 84.6% success. Break it down by policy:
p=reject— 8,614p=quarantine— 7,150p=none— 6,231
p=none is monitoring. It publishes a record, collects reports, and instructs receiving mail servers to do nothing at all about mail that fails authentication. 28.3% of every provider that “has DMARC” is at p=none — a policy that stops no phishing whatsoever.
This is the general shape of security posture measurement, and it is why the artifact records the policy value rather than a boolean. A checkbox that says “DMARC: yes” is true for all 22,033 and useful for 15,802.
Why this is scored
An API provider’s domain is the trust anchor for every integration. If the zone can be hijacked, the OAuth redirect can be hijacked. If the mail domain can be spoofed, the password reset can be spoofed. These are not adjacent concerns to API security — they are underneath it.
The probe is mechanical and repeatable, which is why it can run across 26,073 domains. It records observations, not verdicts: a host without HSTS is a fact, and whether it matters depends on what that host serves.
Takeaway
92.8% on TLS 1.3, 17.8% on DNSSEC, and 28.3% of DMARC publishers set to do nothing. API providers fix the controls that break something visible and skip the ones that only matter after an attack. The catalog now records both, per host, with a status code behind every row.
Browse provider security posture from any profile on apis.io.