Four of the 103 domains in this sample resolved to incorrect or defunct URLs at time of scoring — two due to typos in the source list (vandagogh.nl → vangoghmuseum.nl, tokyonationalmuseum.jp → tnm.jp), one due to a ministry rebrand (gnam.beniculturali.it → gnamc.cultura.gov.it), and one to a retired Smithsonian subdomain (nmnh.si.edu → naturalhistory.si.edu). These produced artificial "domain does not resolve" findings — Health scores near the methodology's floor — that were not real DNS results. All four have been re-scored against the correct domains; the figures below reflect the correction. The original Health range (36–100) and "widest score spread" characterization have been retracted — see the numbers table below.
We scored 103 major museums worldwide — from the Met, MoMA, and the British Museum to the Rijksmuseum, the Hermitage, and the National Palace Museum — using NODA's dual-axis methodology: a Health score measuring whether DNS actually works, and a Best Practice score measuring whether it's configured the way current standards recommend, across 41 checks in five categories.
Museums track the pattern seen elsewhere in this research: sites work fine, security hygiene is inconsistent. Health holds up consistently across the sample — this is not the most variable sector we've scored. Best Practice is where the real spread shows up, same as universities and sports brands.
A note on scope: this list was compiled from established institutional-recognition sources, not one canonical index — treat it as a representative sample rather than an exhaustive census. All 103 domains were checked live on August 7, 2026; DNS configurations drift, so exact numbers will shift over time.
The numbers
| Metric | Value |
|---|---|
| Domains scored | 103 |
| Average Health score | 93.9 / 100 |
| Health standard deviation | 4.71 |
| Health range | 75 – 100 |
| Average Best Practice score | 78.7 / 100 |
| Best Practice range | 50 – 97 |
Health is tightly clustered across this sample — a 75–100 range with a standard deviation under 5 is consistent, not fragile. The variation that matters here is on the Best Practice axis, the same pattern seen in every other sector this research has scored.
Single-AS exposure is the norm, not the exception
75.7% of museums run every nameserver from a single Autonomous System. That's the highest concentration risk of any sector we've scored so far — three out of four major museums have no independent-network redundancy at all. A museum's website is rarely mission-critical infrastructure in the way a university's or a bank's is, and that may explain why: DNS resilience simply hasn't been treated as a budget priority. But for institutions that increasingly run ticketing, membership, and donation systems through the same domain, that calculus is shifting.
An Autonomous System (AS) is an independently-operated network — effectively, which provider actually owns the IP block your nameservers live in. All nameservers in one AS means one outage, misconfiguration, or provider incident takes the domain fully offline — including any ticketing or donation flow riding on it. Caveat: this is less concerning if that single AS is a large anycast network like Cloudflare, which is resilient by design; the real risk is a single small, non-anycast provider with no fallback.
DNSSEC: worst adoption of any sector scored
Only 15.5% of museums have DNSSEC enabled — the lowest adoption rate we've measured across university, museum, and sports-brand cohorts. Combined with the single-AS finding above, the picture is consistent: museum DNS infrastructure tends to be set up once, by whoever built the original site, and rarely revisited.
DNSSEC cryptographically signs DNS responses so a resolver can verify they haven't been tampered with in transit. Without it, an attacker on the network path can forge DNS answers — for example, quietly redirecting a museum's donation or ticketing subdomain to a convincing fake, with no way for a visitor's browser to detect the substitution.
Mail authentication: the same story, worse
CAT-MAIL is the weakest-performing category here too, and by a wider margin than in higher education:
- DKIM Record: missing on 35.5% of applicable domains
- DMARC Record: missing entirely — no record at all — on 12.6%, the highest "not even trying" rate of any group scored
- SPF Lookup Limit: flagged on 20.4% of domains, roughly double the rate seen among sports brands and twenty times the rate seen among universities — a sign of accumulated technical debt from years of bolted-on third-party mail services (ticketing platforms, newsletter tools, membership CRMs) each adding their own SPF
include
SPF, DKIM, and DMARC together let a receiving server verify a message really came from the domain it claims. A missing DMARC record means nothing stops someone from sending "invoice attached" or "renew your membership" emails that appear to come from the museum directly — a real-world phishing vector, not a hypothetical one. Gmail and Yahoo's 2024 bulk-sender rules also mean unsigned mail increasingly lands in spam, hurting whether membership renewals and event announcements even arrive.
Best and worst performers
Top 5 (Best Practice score):
| Domain | Best Practice | Health |
|---|---|---|
| rijksmuseum.nl | 97 | 100 |
| stedelijk.nl | 97 | 100 |
| musee-orsay.fr | 97 | 97 |
| nationalmuseum.se | 97 | 97 |
| nga.gov | 97 | 97 |
Bottom 5:
| Domain | Best Practice | Health |
|---|---|---|
| airandspace.si.edu | 50 | 84 |
| naturalhistory.si.edu | 50 | 77 |
| ngi.ie | 64 | 91 |
| metmuseum.org | 67 | 99 |
| guggenheim.org | 67 | 96 |
All five of these are confirmed genuine findings — real, resolving domains with specific, verifiable Best Practice gaps (missing DNSSEC, missing DKIM, or nameserver-configuration issues), not domain-resolution artifacts. No domain in this corrected sample shows the kind of Health degradation the original version of this piece described.
The takeaway
Sites work fine, hygiene is inconsistent describes this sector well — the same pattern seen across every group this research has scored. Museums do carry the highest single-AS exposure (75.7%) and the lowest DNSSEC adoption (15.5%) of any sector measured so far, and those two findings are real and substantiated. What isn't supported is a claim of unusual operational fragility beyond that — this sector's Health profile is consistent, not degraded. Museums hold some of the most protected physical objects on the planet; their DNS hygiene gap is real, but it's a configuration story, not a reliability one.
What to do about it
The museums in this dataset share one dominant problem, not two:
- Add DNSSEC and diversify nameserver AS exposure — especially if ticketing, membership, or donation flows run through the domain. A single-AS setup on a donation subdomain is a worse bet than on a static "about us" page.
- Publish a DMARC record if you don't have one, even at
p=noneto start — 14.6% of museums in this sample have none at all, which is the easiest and cheapest gap to close here. - Audit third-party mail integrations (ticketing platforms, newsletter tools, CRMs) for SPF bloat — the elevated SPF lookup-limit warnings here point to accumulated `include` sprawl that's worth cleaning up in one pass rather than leaving to grow.
Curious where your own domain lands? Run it through NODA and see the same 41 checks scored live.