average across all 32 countries (5 of 699 domains)
Source: kommunermedipv6.se, latest scan per country (Sept 2026). Hardening = SPF -all (or ~all with DMARC p=reject), DMARC p=reject, a CAA record, HSTS max-age ≥ 1 year and MTA-STS in enforce mode – informational, not part of the grade. Counted per regional domain – regions without a known website are not included. Countries with few regions vary more.