Executive summary
The 2026 Healthcare DNS Security and Compliance Benchmark Report is Authentic Web’s second benchmark of external DNS security in healthcare, following the 2024 study. It audited 25 medium to large healthcare providers in the United States: 9,337 domains and 32,543 DNS resource records, scanned with DNS Inspector.
DNS hygiene and governance remain a significant challenge. Infrastructure teams have reduced their exposed A record share, but insecure redirects and lame delegations have worsened, and email-domain protection (SPF and DMARC) and DNSSEC coverage remain low.
Key findings
- 62% of A records showed exposure in the HTTP/HTTPS scan, down from 89% in 2024.
- 38% of redirects were insecure, up from 17% in 2024. The share more than doubled.
- 33% of CNAMEs were dangling, in line with 35% in 2024.
- 20% of lame delegations were found, up from 17% in 2024.
- 46% of domains have no SPF record and 48% have no DMARC record.
- 96% of domains are not signed with DNSSEC (337 of 9,337 are signed).
Bottom line: infrastructure, compliance and infosec teams cannot address DNS governance and security manually. Managing and securing DNS networks requires continuous security monitoring and DNS control systems.
About this report
The purpose of this report is to draw attention to enterprise security risks associated with external DNS networks. DNS is the publicly available network that makes the internet work, and malicious actors also use it to identify endpoints and related vulnerabilities on the network. Failure to maintain good DNS hygiene, enforce DNS security policies and govern change management leaves enterprises out of compliance with security frameworks such as HIPAA, SOC 2 and ISO, and exposes them to network and data vulnerabilities.
Frameworks referenced: HIPAA, NIST, ISO, CIS Controls, HITRUST, COBIT 5 and PCI DSS. Author: Authentic Web Inc. Powered by DNS Inspector. Published: September 21, 2026. DNS Inspector data from the health check dated 2026-08-11 (UTC).
Methodology
Authentic Web Inc. selected a representative sample of 25 medium to large healthcare providers across the United States. Using DNS Inspector domain and DNS discovery, cross-referenced with WHOIS and IT infrastructure data, it identified 9,337 domains used by the sample organizations. It then catalogued the zone files for each domain, capturing about 32,500 resource records (32,543) that make up these companies’ digital footprint, and scanned them for DNS network vulnerabilities.
- Domain discovery: start from each brand target and use WHOIS and infrastructure data to build the domain list.
- Zone discovery: collect A records, CNAMEs and related records for each domain.
- DNS audit: run the infrastructure and vulnerability audit in DNS Inspector.
Sample and limitations
The 25 organizations have average revenue of $93B, ranging from $240M to $400B, and average employees of 81,000, ranging from 2,000 to a high of 440,000. The sample includes 14 hospitals, five insurance companies, four pharmaceutical companies and two technology providers. The sample is 25 organizations, so results describe this group and are not a statistical estimate for all healthcare. Some connection responses flagged in the HTTP/HTTPS scan may be acceptable, for example internal access only by design, so teams need to classify each record as material or acceptable. HTTP/HTTPS totals exclude certain A records.
Benchmark study scope
| Item | Number | Ratio | Meaning |
|---|---|---|---|
| Total domains | 9,337 | 373 | Domains per entity |
| Records analyzed | 32,543 | 3.49 | Records analyzed per domain |
| Total A records | 8,213 | 0.88 | A records per domain |
| Total CNAMEs | 2,716 | 0.29 | CNAMEs per domain |
| Total redirects | 2,081 | 0.22 | Redirects per domain |
| SPF | 5,030 | 0.54 | SPF records per domain |
| DMARC | 4,829 | 0.52 | DMARC records per domain |
| DNSSEC | 337 | 0.04 | DNSSEC records per domain |
Domain registrars. The domains are with 85 registrars, five of which hold 95% of all domains audited. Top five: MarkMonitor Inc., Corporation Service Company, Network Solutions LLC, GoDaddy Inc. and Corsearch Domains LLC.
DNS providers. The domains use 132 distinct DNS service providers, with ten of them representing 58% of all domains audited. Top ten: Aetna, Cloudflare, CIGNA, GoDaddy.com LLC, Google, McKesson, NSONE Inc, MarkMonitor, Worldnic and Ultradns.
Top-level domains. The domains are concentrated in legacy top-level domains, with 59.5% of all domains using .com (5,551 of 9,337).
| Type | Domains | TLDs |
|---|---|---|
| Legacy generic | 8,973 | 7 |
| Country codes | 215 | 25 |
| New generics | 149 | 56 |
| Total | 9,337 | 88 |
DNS vulnerabilities explained
These vulnerabilities represent the biggest risks to enterprise security. DNS is used in almost every cyberattack, and because DNS is a global public network, it exposes enterprise vulnerabilities to any party motivated to look at and execute an attack.
| Vulnerability | What it is | How it is used in an attack |
|---|---|---|
| Orphaned IPs | A records pointing to IPs that are not under the control of enterprise infrastructure and monitored by end-point vulnerability systems. | Loss of control of an IP on a shared web service such as AWS creates a vector where a third party can take over the IP. |
| Dangling CNAMEs | CNAMEs pointing to a web resource or host that is not under the control of enterprise infrastructure and monitored by end-point vulnerability systems. | A third party can create the host name the CNAME points to, enabling any type of attack. |
| Insecure redirects | A redirect chain where one or more hops to the destination is an unencrypted (HTTP only) hop. | Encryption gaps allow a man-in-the-middle exploit that compromises audiences navigating from origin to destination. |
| Lame delegations | A domain does not have a Start of Authority (SOA) record set up on the DNS service that governs create and edit control on the domain. | Allows an SOA record to be created on the DNS service to assume full control over the DNS for that domain. |
| SPF and DMARC coverage and errors | Two gaps: the records do not conform to RFCs, or the records are missing. | Non-conforming or missing SPF or DMARC records enable phishing attacks. |
| DNSSEC coverage gaps | DNSSEC is either not present or not configured correctly on domains. Some organizations resist DNSSEC because of the perceived risk of key rolls. | DNSSEC addresses a recursive server being compromised by DNS cache poisoning, which can expose users to man-in-the-middle attacks. |
The benchmark vulnerability metrics
Results of the DNS Inspector audit for each examination. The pie charts in the PDF split each result into pass and exposure; the same figures are given below.
62% of A records exposed
Pass 38%, exposure 62%. The HTTP/HTTPS scan exposes potential vulnerabilities, including orphaned IPs, insecure connections and allowable use of deprecated TLS versions. Some responses may reflect legacy settings that need to be deprovisioned, while others may be acceptable as internal access only by design. Infrastructure and infosec teams should investigate each record to classify the risk as material or acceptable.
38% of redirects exposed
Pass 62%, exposure 38%. The redirect scan identifies unsecured redirects. All redirects must use certificates from the origin domain through to the destination URL, which gives end-to-end encryption to protect users from man-in-the-middle attacks. Other exposures include an excessive number of hops, or orphaned records pointing to resources the company no longer controls.
33% of CNAMEs exposed
Pass 67%, exposure 33%. The CNAME scan identifies dangling CNAMEs. Like orphaned IPs, they can be compromised with minimal effort. Over time IT teams configure CNAMEs for specific purposes; when the purpose ends, the destination is deprovisioned but teams neglect to remove the CNAME, leaving it open to takeover.
20% lame delegations
Pass 80%, exposure 20%. Failure to ensure a valid SOA record opens an attack vector that lets parties create an illegitimate SOA record on the DNS network where the domain is hosted, which enables hijacking of the domain’s DNS zone file. The report calls 20% a very high number and says it shows legacy registrars and domain owners are failing to keep their domains secure.
46% of domains not covered by SPF
Of 9,337 domains: 5,030 pass (54%), 4,299 are unprotected (46%) and 8 SPF records are non-compliant with the standards-based RFC. SPF records define which mail servers are authorized to send mail using the domain. Without one, the domain owner is exposed to phishing emails sent from their own domain, so every owned domain needs a valid SPF record.
48% of domains not covered by DMARC
Of 9,337 domains: 4,829 pass (52%), 4,506 are unprotected (48%) and 2 DMARC records are non-compliant with the RFC. DMARC works with SPF to help secure email communications. Without DMARC across the whole domain portfolio, phishing emails can be sent from your own domain.
96% of domains not signed with DNSSEC
Pass 4% (337 domains), unprotected 96%, 0 failed. DNSSEC uses cryptographic signatures to sign a domain’s zone file and defends against recursive server cache poisoning, which prevents DNS-based man-in-the-middle attacks. Automated signature key rolling, now used by modern registrars and DNS provider systems, should increase adoption over time.
What changed: 2024 vs. 2026
| Item | 2024 | 2026 | Learnings |
|---|---|---|---|
| Domains | 9,269 | 9,337 | Domains under management are essentially unchanged (up 68, or 0.7%). |
| Records | 40,789 | 32,543 | In 2026, infrastructure teams have purged many orphaned A records. A positive finding showing teams recognize the need to address these exposure risks. |
| Registrars | 91 total, top 5 = 93% | 85 total, top 5 = 95% | No material change. |
| DNS providers | 81 total, top 5 = 72% | 132 total, top 10 = 58% | Significant change in number and concentration, due to high M&A activity without DNS consolidations and infrastructure teams exploring new DNS providers. |
| Top-level domains | 60% .com | 59.5% .com | No change in the makeup of top-level domains in use. |
| Orphaned IPs, insecure connections | 89% exposed | 62% exposed | Companies have reduced the number of orphaned A records overall. |
| Insecure redirects | 17% exposed | 38% exposed | A material risk that has worsened. Companies are failing to ensure end-to-end encryption on redirects to destinations. |
| Dangling CNAMEs | 35% exposed | 33% exposed | Consistent with 2024. CNAMEs are left as legacy configurations; some are validation records that require DNS hygiene to identify and remove. |
| Lame delegations | 17% exposed | 20% exposed | Worsened, likely due to DNS provider migrations that did not fully reset delegations and the adopted risk in M&A. |
| SPF coverage | 50% exposed, 1% error rate | 46% exposed, <1% error rate | Marginal improvement, but still high and exposes companies to phishing. |
| DMARC coverage | 52% exposed, <1% error rate | 48% exposed, <1% error rate | Marginal improvement, but still high and exposes companies to phishing. |
| DNSSEC | 99% exposed, 0% error rate | 96% exposed, 0% error rate | Marginal improvement. Some teams are working on DNSSEC, but the risk of DNS cache poisoning remains elevated. |
Takeaways
Over the past two years there is clear evidence that infrastructure teams recognize the need and have reduced their A record exposure. Other DNS risk exposures and DNS hygiene remain a significant challenge. Insecure redirects as a percentage of the whole have more than doubled, which the report calls a big red flag.
Lame delegations have also increased, likely due to a lack of post-M&A DNS consolidation. Modest improvements in SPF, DMARC and DNSSEC coverage are a positive indicator of intent, but infrastructure teams still struggle to make material risk-reduction improvements, likely because of manual processes and a lack of formal DNS governance, risk and compliance programs.
Summary: best practices and benefits of action
- Healthcare is the most cyber-attacked sector in North America (source: CircleID).
- Healthcare is subject to several information security frameworks.
- Current DNS practices fall short of compliance requirements in SOC 2, CIS, NIST and ISO (source: BankInfoSecurity).
- This benchmark provides evidence of the DNS security risks and compliance gaps healthcare operators must address.
Best practices
- Conduct a DNS security assessment to gain visibility and establish your company’s security posture.
- Consolidate domains to a single registrar and DNS provider with change control automation.
- Implement ongoing DNS configuration, security inspections and monitoring systems.
Benefits of action
- Keeps your company and customers safe in your branded spaces.
- Complies with relevant security framework requirements on infrastructure controls.
- Automates the practice and makes it easy for teams to get and keep control.
- Reduces total cost of ownership through consolidation and automation.
How does your healthcare company compare?
Authentic Web offers to conduct a DNS Inspector security assessment and review at no cost to qualified healthcare providers. To schedule, email info@authenticweb.com with the subject “DNS Assessment” or visit dnsinspector.io.
Powered by DNS Inspector, Authentic Web will publish follow-up healthcare and other industry sector benchmarks, chosen from its assessment of industries at risk and report subscriber requests. Subscribe for new benchmark studies.