This page documents all metrics used in the Domain Trust dashboards. Each metric is shown with its formal code, a plain-language description of what it measures, and the formula used to calculate it.
Every domain in the dataset is assigned one of four statuses based on its blocking flag and DNS resolution result. This classification drives all downstream metrics.
| Status | Condition | Description |
|---|---|---|
| Blocked | is_blocked = true | Domain was proactively blocked before or during the measurement period |
| Taken Down | DNS status is nxdomain or sinkholed | Domain no longer resolves — removed from DNS or redirected to a sinkhole |
| Active | DNS status is active | Domain still resolves and is reachable |
| Unknown | All other cases (timeout, noanswer, etc.) | DNS check did not return a definitive result |
is_blocked is checked first. A domain flagged as blocked will be classified as Blocked regardless of its DNS status.
Measures how long an abusive domain remained active from the date it was first identified until it was taken down. Reported as both median and average across all taken-down domains.
This is an upper-bound estimate. The actual takedown may have happened before the DNS check date, but the single-snapshot methodology can only confirm the domain was down by the check date. Calculated only for domains classified as “Taken Down”.
The proportion of abusive domains within a TLD relative to the total number of domains registered under that TLD. A higher value indicates a greater concentration of abuse relative to the TLD’s size.
Only calculated for TLDs where total registration counts are available from external reference data (e.g., DomainNameStat). TLDs without known totals are excluded from this metric.
The ratio of taken-down abusive domains to the total number of registered domains in a TLD. Indicates the scale of successful abuse remediation relative to the TLD’s overall size.
Only calculated for TLDs with known total registration counts.
The percentage of identified abusive domains that have been successfully taken down. This is the primary measure of takedown effectiveness — a higher value means a greater share of abusive domains were removed from the DNS.
Calculated at the overall, per-TLD, per-registrar, and daily levels. The cumulative taken-down rate tracks this metric across all domains over time.
The proportion of abusive domains sponsored by a registrar relative to the registrar’s total domain portfolio. A higher value suggests a greater concentration of abuse within the registrar’s customer base.
Only calculated for registrars whose total portfolio size is available from external reference data. Registrars without portfolio data are excluded from this metric.
The number of days between a domain’s creation (registration) date and its takedown, as observed at the DNS check date. Provides insight into whether abusive domains are short-lived (newly registered for abuse) or long-standing domains that were compromised.
Requires RDAP data with a valid creation date. Only calculated for domains classified as “Taken Down” that have RDAP registrar information. Reported as daily median and average in the time-series dashboard.