Method and data

What is measured

Every registrable domain under the government, education, health, business, non-profit and network suffixes of the six Arabian Gulf states is measured, each counted once as an organisation rather than every host beneath it. The military, embassy and personal suffixes are left out.

Suffixes in this issue

DNSSEC possible DNSSEC not possible yet

• Kuwait
  • gov.kwGovernmentDNSSEC possible
  • edu.kwEducationDNSSEC possible
  • com.kwBusinessDNSSEC possible
  • org.kwNon-profitDNSSEC possible
  • net.kwNetworkDNSSEC possible
• Saudi Arabia
  • gov.saGovernmentDNSSEC possible
  • edu.saEducationDNSSEC possible
  • sch.saEducationDNSSEC possible
  • med.saHealthDNSSEC possible
  • com.saBusinessDNSSEC possible
  • org.saNon-profitDNSSEC possible
  • net.saNetworkDNSSEC possible
• UAE
  • gov.aeGovernmentDNSSEC not possible yet
  • ac.aeEducationDNSSEC not possible yet
  • sch.aeEducationDNSSEC not possible yet
  • co.aeBusinessDNSSEC not possible yet
  • org.aeNon-profitDNSSEC not possible yet
  • net.aeNetworkDNSSEC not possible yet
• Qatar
  • gov.qaGovernmentDNSSEC not possible yet
  • edu.qaEducationDNSSEC not possible yet
  • sch.qaEducationDNSSEC not possible yet
  • com.qaBusinessDNSSEC not possible yet
  • org.qaNon-profitDNSSEC not possible yet
  • net.qaNetworkDNSSEC not possible yet
• Bahrain
  • gov.bhGovernmentDNSSEC not possible yet
  • edu.bhEducationDNSSEC possible
  • com.bhBusinessDNSSEC possible
  • org.bhNon-profitDNSSEC possible
  • net.bhNetworkDNSSEC possible
• Oman
  • gov.omGovernmentDNSSEC not possible yet
  • edu.omEducationDNSSEC not possible yet
  • med.omHealthDNSSEC not possible yet
  • com.omBusinessDNSSEC not possible yet
  • co.omBusinessDNSSEC not possible yet
  • org.omNon-profitDNSSEC not possible yet
  • net.omNetworkDNSSEC not possible yet

Where the names come from

Names come from public Certificate Transparency logs, read through crt.sh, and from the Tranco list of popular sites. A name stays in the inventory once seen, and each issue counts only the names that still exist in DNS.

How the measurement runs

DNS is read over HTTPS through two public validating resolvers, Cloudflare and Google, and a DMARC answer counts only when both agree. Websites and TLS are probed with ordinary single requests from a runner hosted by GitHub, with a user agent that links back to this page. Anything inconclusive is then measured again later in the same run, and a broken DNSSEC result stands only when it is seen twice.

What is published and what is not

Each issue publishes totals by country, sector and check, the weekly series and the open data. No domain is named, and no list or ranking of organisations is published, while anyone can check a single domain live.

Limits

The weekly scan runs outside the Arabian Gulf, so a site that blocks foreign traffic is counted as unreachable and left out of the web checks, never counted as failing. DKIM is not measured, because its selectors cannot be listed from outside. Domains registered directly under a country code, or under global extensions such as .com, are not included yet.

A share is the passing domains divided by the domains where the check applies and could be measured.

Data quality in this issue

The two resolvers gave the same DMARC answer for 99.9% of the domains where both answered.

901 websites could not be reached from the scanner.

The scan took 47 minutes and made 179,315 DNS queries.

Open data

Every issue is published as CSV and JSON under the MIT licence, alongside the full weekly series.

• This issue, CSV
• Every issue, CSV
• This issue with every detail, JSON
• Weekly series, JSON

How to cite the figures

Give the issue number and its date, so readers can find the exact figures you used.

Every figure has a citation in Arabic and English whose link opens the issue it comes from, and every issue has a reference and a BibTeX entry, given below for the latest one.

@misc{gbaseline-issue-1,
  author = {AlEnezi, Ali},
  title = {Gulf Cybersecurity Baseline, issue 1},
  year = {2026},
  date = {2026-10-16},
  url = {https://gbaseline.3li.info/en/issues/1/},
  note = {An open weekly measurement of how well the public domains of the six Arabian Gulf states protect email, DNS and the web, published as totals anyone can quote with a live check for any single domain}
}

Command line and MCP server

The same engine runs the full check of any domain from your own machine and answers AI assistants through MCP.

npx -y github:SiteQ8/gbaseline check example.com
npx -y github:SiteQ8/gbaseline check example.com --lang ar --json

{
  "mcpServers": {
    "gbaseline": {
      "command": "npx",
      "args": [
        "-y",
        "github:SiteQ8/gbaseline",
        "mcp"
      ]
    }
  }
}

Source code and contact

The scanner, this site and the MCP server are open source. Report a mistake, or ask for a domain to be added or left out, by opening an issue on GitHub.

github.com/SiteQ8/gbaseline

Photographs and type

The photographs are six night views of the Arabian Gulf's cities that NASA crews took from the International Space Station, one for each state and all in the public domain, while the Alexandria typeface draws both Arabic and Latin and is used under the SIL Open Font License.

• Kuwait City at night, ISS Expedition 64, 9 January 2021, NASA, public domain Source page
• Riyadh at night, ISS Expedition 72, 28 December 2024, NASA, public domain Source page
• Dubai at night, ISS Expedition 47, 11 March 2016, NASA, public domain Source page
• Doha at night, ISS Expedition 26, 9 December 2010, NASA, public domain Source page
• Bahrain at night, ISS Expedition 26, 9 December 2010, NASA, public domain Source page
• Muscat at night, ISS Expedition 69, 18 July 2023, NASA, public domain Source page