What is the most abused TLD (Top-Level Domain) for spam?
Updated on 3 Oct 2026: We updated the TLD rankings with clearer report boundaries, rate calculations, and email review guidance.
There is no single universal winner. In public domain reputation data covering October 2025 through March 2026, .com ranks first by raw malicious or suspicious domain count, with 506,482 listings. In the same report, .cfd ranks highest among the reported generic TLDs by concentration: 93,940 listed domains compared with a zone size of 535,716, or 17.54%. Other high-rate generic TLDs include .qpon, .icu, .bid, .xin, and .bond.
That distinction matters for email. A receiver does not usually reject mail because a domain ends in a specific TLD. It scores the message using domain age, sender reputation, authentication, URLs in the body, complaint history, and blocklist or blacklist signals. The TLD is a context clue, not a verdict.
- .com leads this six-month mixed-abuse report by raw listed-domain count, partly because its domain base is large.
- .cfd leads the report's gTLD rate table when six-month listings are compared with zone size.
- The malicious or suspicious domain data includes more than unsolicited email.
- Use TLD reputation to guide scrutiny alongside authentication and sender behavior.
The direct answer
Start with the metric. In the October 2025 through March 2026 snapshot, .com ranks first by number of malicious or suspicious domains, followed by .top. The report detected 2.15 million listed domains across all TLDs during the six-month period. It includes associations with spam, phishing, malware, ransomware, and other fraudulent activity, so it does not establish a spam-only winner.
By rate, the reported generic TLD leader is .cfd in that snapshot. Its 93,940 listed domains compared with a zone size of 535,716 produce the reported 17.54% rate. .com has far more listed domains, but its roughly 168 million-domain zone makes its rate much lower. Raw count measures total exposure, while the rate compares detections with zone size. The report's discussion of .cfd includes SMS phishing, so this rate does not measure email spam alone.
|
|
|
|---|---|---|
Raw listed-domain count | .com | Total exposure |
Reported gTLD zone share | .cfd | Abuse concentration |
Malicious email rate | Not measured here | Mail filtering |
Phishing URLs or pages | Not measured here | Web threat review |
Different ways to answer "most abused TLD"
Phishing rankings can still name a different TLD. One report can count unique registered domains, while another counts every URL, hosted subdomain, landing page, or email message. A TLD that leads one unit of measurement does not automatically lead the others.
What abuse datasets actually count
The unit of measurement can change the ranking before any security judgment is made. Check what the report counts, which abuse categories it includes, what time period it covers, and whether its sensors see email traffic, DNS activity, web pages, or several of these sources. Its totals cover observed and listed domains, not every abusive domain on the internet.
- A registered-domain count records each second-level domain once, even if it hosts many abusive URLs.
- A hostname count can include many subdomains under one registration.
- A URL or page count can include many phishing pages or redirect URLs under one domain.
- A message count can be dominated by a high-volume campaign using few domains.
Mail-focused URL abuse lists often rank unique domains found in message links. Those rankings answer a narrower question than a mixed-abuse report. Also check the denominator: a percentage of phishing domains judged malicious is different from the percentage of all registered domains in a TLD that were listed.
The cause matters too. A maliciously registered domain was acquired for abuse, while a compromised domain belongs to a legitimate owner whose site or account was taken over. Compromised sites and hosted subdomains can raise a TLD's count without showing that the namespace itself attracts disposable registrations. This is why a defensible filter keeps TLD reputation separate from domain reputation and URL reputation.
Why rankings disagree
Most disagreements come down to denominator choice. Counting bad domains answers one operational question: "Where is the most abuse appearing?" Dividing by the total number of registered domains answers another: "Which namespace has the highest concentration of abuse?" Both are useful, but they lead to different filtering and review decisions.
Raw count
- Use it to estimate total volume hitting filters, traps, and URL feeds.
- .com often leads because it has the largest installed base.
- Large TLDs can have many listed domains even when abuse is a small share of their zones.
Abuse rate
- Use it to find TLDs where listed domains are dense compared with zone size.
- Low-cost, high-churn TLDs can rank highly by this measure.
- Small zones can produce a high rate from a comparatively small number of listed domains.
For email filtering, concentration deserves more weight when a domain is new and sending unsolicited mail. For abuse response, raw volume matters because it shows where the greatest filter pressure originates.
Infographic comparing raw TLD abuse count with abuse rate, domain age, authentication, and blocklist hits.
TLDs that deserve extra scrutiny
No TLD is automatically bad, but some TLDs need extra evidence of legitimacy. That includes TLDs that repeatedly appear in abuse reports and TLDs with heavy new-domain churn. The specific list changes over time, so the right workflow is monitoring, not a static wall chart.
Listed-domain volume by TLD
Malicious or suspicious domain counts detected from October 2025 through March 2026.
.com
506,482 domains.top
270,121 domains.cn
252,852 domains.cc
94,415 domains.cfd
93,940 domains.bond
59,271 domains.xyz
47,547 domains.sbs
42,115 domainsCountry-code TLDs are not automatic trust signals. .us ranked 15th among country-code TLDs in the same snapshot, with 2,981 listed domains. That volume is far below .cn and .cc, but it still shows why a country label should not replace sender-level checks.
If you are choosing a domain for email, use a TLD that fits the brand and audience, and give the domain time to build reputation. The practical tradeoffs are covered in TLD choices and deliverability.
How to use TLD data without overblocking
Blocking a whole TLD from mail or web access can hide legitimate messages. Some TLDs deserve more scrutiny in consumer inbox filtering, but enterprise mail, support desks, and security teams still need a way to review messages from real customers, partners, and abuse reporters.
Do not block on TLD alone
A TLD should increase scrutiny when it appears with other signals. It should not be the only reason a legitimate message disappears.
- A new domain with failed authentication, suspicious URLs, and prior blocklist or blacklist hits warrants closer review.
- An established sender with aligned authentication and normal engagement has stronger evidence of legitimacy.
- A new sender on a high-risk TLD that links to other new domains warrants URL review.
A useful review flow checks the visible From domain, return-path domain, DKIM signing domain, and every linked domain in the message. Suped's blocklist monitoring supports that workflow by tracking domain and IP listings alongside the identities found in authenticated mail.
Blocklist checker
Check your domain or IP against 144 blocklists.
When a domain appears in mail you did not expect, check whether the exact domain or IP is on known blocklists (blacklists). If you control the sending domain, run a broader domain health check as well, because TLD reputation is only one part of the sender identity.
What this means for email senders
If you send legitimate email, do not pick a sending domain only because the TLD is cheap or available. Pick a domain that fits the brand, authenticate it properly, increase volume gradually, and avoid sending patterns that look disposable. A familiar TLD still has to earn reputation.
Suped's product supports this workflow by showing which services send for your domain, whether SPF and DKIM align for DMARC, and whether a sending domain or IP develops a blocklist or blacklist problem. TLD reputation can set the level of scrutiny, while the authentication and monitoring data shows what needs fixing.
Blocklist monitoring page showing domain and IP checks across blocklists with importance and status
For a real sending test, send a message through your normal mail path and inspect the headers, authentication alignment, URLs, and content signals. A quick email tester run tells you more than judging the domain by its final label.
TLD risk scoring exampleYAML
domain: brand-example.top sender_tld: .top domain_age_days: 3 spf_alignment: fail dkim_alignment: fail dmarc_result: fail dmarc_policy: none url_tld: .cfd url_domain_blocklist_hit: true action: quarantine and review
A risky TLD alone does not force rejection. In this example, the newly registered sender fails DMARC alignment and links to a listed URL domain, so quarantine and review is reasonable under a receiver's local policy. The sender's DMARC policy of p=none does not itself mean the message fails authentication.
Views from the trenches
Best practices
Separate raw volume rankings from abuse-rate rankings before choosing a blocking rule.
Treat TLD reputation as one signal beside age, authentication, traffic, and complaints.
Monitor domains and URLs in mail content, not only the visible sending domain and From.
Common pitfalls
Blocking a whole TLD catches some spam but also creates false positives for support.
Assuming .com is low risk ignores its large raw share of reported abusive domains.
Buying a cheap TLD for outbound mail saves little when reputation problems follow fast.
Expert tips
Use short-lived domain age and failed authentication to raise the score before filtering.
Review URL blocklist hits separately because spam often points away from the sender.
Keep abuse and postmaster inboxes monitored so complaints reach someone accountable.
Marketer view
Marketer from Email Geeks says .com often leads raw abuse rankings because its installed base is so large, even when its abuse rate is small.
2023-09-16 - Email Geeks
Marketer view
Marketer from Email Geeks says .us surprised people in cold email contexts because a country-code domain can still carry abuse signals.
2023-09-16 - Email Geeks
The practical answer
The most abused TLD is .com when the metric is raw malicious or suspicious domain count in the October 2025 through March 2026 report. The highest reported concentration among generic TLDs is .cfd, while smaller TLDs such as .qpon, .icu, .bid, and .xin also have high listed shares. None of these figures alone identifies a spam-only leader.
- For filtering, use TLD reputation with domain age, authentication, URLs, and complaint data.
- For sending, use a domain that fits the brand, authenticate it, and build reputation before volume.
- For monitoring, track DMARC, SPF, DKIM, blocklist or blacklist status, and URL reputation together.
A TLD can tell you where to look harder, but the domain's behavior tells you what to do.
