Quick answer
How well do the top crypto projects secure their domains in 2026?
Of the official domains of the 50 largest crypto projects on 12 November 2026, 20 were signed with DNSSEC (40%), 15 published CAA records (30%) and 5 showed the server locks of a registry lock (10%). Only 3 combined all of that with a DMARC policy that blocks spoofing. Wardmint read public DNS and RDAP.
Results for the 50 official domains
| Protection | Domains | Share | What it stops |
|---|---|---|---|
| Registrar lock (clientTransferProhibited) | 47 of 50 | 94% | A transfer started without the holder |
| DMARC p=reject | 28 of 50 | 56% | Spoofed mail from the domain is refused |
| DMARC p=quarantine | 16 of 50 | 32% | Spoofed mail goes to spam |
| No DMARC record or p=none | 6 of 50 | 12% | Nothing: spoofed mail is delivered |
| SPF ending in -all | 29 of 50 | 58% | Mail from unlisted servers should be rejected |
| DNSSEC (DS record at the parent) | 20 of 50 | 40% | Forged DNS answers, as in cache-poisoning attacks |
| CAA records | 15 of 50 | 30% | Certificates issued by an unlisted authority |
| Registry lock signs (three server locks) | 5 of 50 | 10% | Changes made through a compromised registrar account |
| All four: DNSSEC, CAA, registry lock signs, enforced DMARC | 3 of 50 | 6% |
Last checked on ; older figures carry their own date
What did the study find?
The basic lock is almost universal; the protections that stop a hijack are not. 47 of the 50 domains carry a registrar transfer lock, the setting most registrars switch on by default. It stops a transfer, but it does not stop someone who logs into the registrar account and changes the nameservers, which is how most documented attacks on crypto frontends worked.
The defences for that case are rarer. Registry lock, which makes the registry itself refuse changes until a person confirms them out of band, shows on 5 domains. DNSSEC, which lets resolvers reject forged answers, is on 20. CAA, which limits who may issue a certificate for the name, is on 15. The comparison of registry lock and registrar lock explains the difference, and the DNSSEC guide the steps.
Email fares better: 44 of the 50 refuse or quarantine spoofed mail with DMARC. The 6 others publish no DMARC record or stay at p=none, so anyone can still send mail that appears to come from the project.
How was the study done?
We used the 50 official domains of our look-alike audit, taken from the largest crypto projects by market capitalisation on 12 November 2026. For each domain we asked Cloudflare's public DNS-over-HTTPS resolver for its DS record (DNSSEC is counted when the parent zone holds one), its CAA records, its TXT records (SPF) and the TXT record at _dmarc (DMARC policy from the p tag).
We then read the domain's RDAP record at its registry. A registrar lock counts when the status list holds clientTransferProhibited. Registry lock signs count when it holds serverTransferProhibited, serverUpdateProhibited and serverDeleteProhibited together: those are the locks a registry lock service sets, though a registry can also set them for other reasons, so we call them signs, not proof.
All 250 DNS lookups and 50 RDAP lookups answered. The script and the per-domain answers are kept with the study; we publish totals only.
What the figures do not say
A missing record is not a breach, and a present one is not a guarantee. Some projects serve their app from another domain or protect it at their CDN; DNSSEC also needs a registrar and DNS host that support it. Registry lock is not offered for every ending, and a registry can apply server locks for reasons other than a paid lock. The study is a snapshot of one day and of one domain per project.
What a project can do with these results
Start with the four settings that most projects in the top 50 still lack: registry lock where the ending offers it, DNSSEC, CAA, and DMARC at p=reject on every domain, including the unused ones. According to Wardmint's survey of 12 November 2026, only 3 of the 50 largest crypto projects combined all four on their main domain.
Our domain security checklist for crypto projects puts them in order with the account settings around them. The same day, our look-alike domain audit found 29.6% of the obvious variants of these projects' names free to register. At Wardmint, DNSSEC and CAA are managed for each domain and a .com costs $12.49/year.
Questions about the study
How many top crypto projects use DNSSEC?
20 of the 50 largest projects' official domains had a DS record at the parent on 12 November 2026, so 40% were signed with DNSSEC.
How many use registry lock?
5 of 50 showed the three server locks a registry lock sets. We call them signs: a registry can set those locks for other reasons too.
Is a registrar lock enough?
No. It blocks transfers, but not a change of nameservers by someone who controls the registrar account, which is how most crypto frontend hijacks happened.
Why are project names not listed?
A list of which project lacks which protection would help an attacker choose a target. Each project can check its own domain with the same public lookups.
Will the study be repeated?
Yes, each quarter with the same script, so the figures form a dated series; each update is logged on our updates page.
In summary
- Official domains of the 50 largest crypto projects, public DNS and RDAP read on 12 November 2026.
- Registrar lock 94%, DMARC enforced 88% (p=reject 56%), SPF hard fail 58%.
- DNSSEC 40%, CAA 30%, registry lock signs 10%.
- Only 3 of 50 combine DNSSEC, CAA, registry lock signs and an enforced DMARC policy.
- Totals only; no per-project list is published.
Sources and method (5)
- Coins list by market capitalisation (API /coins/markets) — CoinGecko (read 2026-11-12)
- DNS over HTTPS, JSON API — Cloudflare (used 2026-11-12)
- Bootstrap service registry for domain name space (RDAP) — IANA (read 2026-11-12)
- EPP status codes: what do they mean — ICANN (read 2026-11-12)
- RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record — IETF (read 2026-11-12)