Original research
The digital estate of the United Nations system
What the UN system runs on the public web, measured the same way every week. Every figure below is our own observation, not a republished one.
How this is measured. Host names come from Certificate Transparency, which is a public log that exists to be read. Posture comes from ordinary DNS resolution and one HTTP GET per host per cycle, at the rate each publisher’s robots.txt asks for. Nothing here probes, scans, or tests for a vulnerability. See our crawler.
Mail and DNS posture, by organisation
Measured at the registrable domain, which is where SPF and DMARC live. A host with no MX record has no mail policy to get wrong, so it is not counted here.
Reading the SPF column. SPF ends in a rule for
everything the record did not list, and its strictest form is
-all — reject. That qualifier is literally named
“fail” in the specification, so a table printing it raw says
“fail” against the organisations that have got it right.
Shown here in words instead: strict is the strong setting,
soft fail and neutral are weaker, and permissive
accepts anything.
| Domain | IPv6 | DNSSEC | SPF | DMARC | |
|---|---|---|---|---|---|
| fao.org | no | unsigned | yes | strict (-all) | none |
| iaea.org | yes | unsigned | yes | strict (-all) | reject |
| icao.int | no | unsigned | yes | strict (-all) | quarantine |
| ilo.org | yes | unsigned | yes | strict (-all) | reject |
| imo.org | no | unsigned | yes | strict (-all) | none |
| itu.int | yes | unsigned | yes | strict (-all) | reject |
| ohchr.org | no | unsigned | yes | strict (-all) | none |
| un.org | no | unsigned | yes | strict (-all) | quarantine |
| unaids.org | yes | unsigned | yes | strict (-all) | reject |
| unctad.org | yes | unsigned | yes | strict (-all) | none |
| undp.org | yes | signed | yes | none | quarantine |
| unep.org | no | unsigned | yes | strict (-all) | reject |
| unesco.org | no | unsigned | yes | strict (-all) | reject |
| unfpa.org | yes | unsigned | yes | soft fail (~all) | quarantine |
| unhabitat.org | no | unsigned | yes | strict (-all) | reject |
| unhcr.org | no | unsigned | yes | strict (-all) | none |
| unicef.org | no | unsigned | yes | strict (-all) | reject |
| unido.org | yes | signed | yes | strict (-all) | reject |
| unodc.org | no | unsigned | yes | strict (-all) | quarantine |
| unops.org | no | signed | yes | strict (-all) | reject |
| unrwa.org | no | unsigned | yes | strict (-all) | quarantine |
| unwomen.org | yes | unsigned | yes | strict (-all) | quarantine |
| upu.int | no | unsigned | yes | strict (-all) | none |
| wfp.org | no | unsigned | yes | soft fail (~all) | reject |
| who.int | no | unsigned | yes | strict (-all) | reject |
| wipo.int | no | unsigned | yes | strict (-all) | reject |
| wmo.int | yes | unsigned | yes | strict (-all) | none |
Hosts by zone
| Zone | Host names seen |
|---|---|
| undp.org | 1031 |
| icao.int | 194 |
| unwomen.org | 185 |
| unhcr.org | 130 |
| un.org | 128 |
| unops.org | 118 |
| who.int | 117 |
| wfp.org | 110 |
| wipo.int | 106 |
| unicef.org | 96 |
| unesco.org | 94 |
| iaea.org | 93 |
| wmo.int | 79 |
| unfpa.org | 69 |
| unctad.org | 66 |
| itu.int | 65 |
| unep.org | 58 |
| ilo.org | 56 |
| imo.org | 50 |
| fao.org | 39 |
| ohchr.org | 38 |
| unrwa.org | 37 |
| unido.org | 36 |
| unhabitat.org | 25 |
| unodc.org | 14 |
| unaids.org | 12 |
| upu.int | 5 |
What a first-seen date means. Certificate Transparency tells us when we first saw a name, not when it was created and not when its certificate was first issued. We say “first seen by us” because that is the only claim the data supports.