One of the 102 domains in this sample, vista-outdoor.com, returned an artificial "domain does not resolve" finding because Vista Outdoor Inc. no longer exists in that corporate form — it split in 2024–2025 into Revelyst and The Kinetic Group. The domain has been replaced with revelyst.com, the legitimate successor entity, and re-scored. This affects only the bottom-performers table and the Health range below; the sector's core findings (DNSSEC, DKIM, and DMARC figures) are unaffected.
We ran 102 global sports and outdoor brands — Nike, Adidas, Puma, Hoka, Salomon, Wilson, Callaway, and a long tail of running, cycling, ski, and team-sport labels — through NODA's dual-axis methodology: 41 checks across infrastructure, security, mail authentication, reliability, and operations, rolled up into a Health score and a Best Practice score.
Sports brands are consumer-commerce companies first and infrastructure operators second, and it shows in a specific, structural way: they under-invest in DNS-layer cryptography almost entirely, while over-indexing — relative to the other sectors we've scored — on the one mail-security control that actually stops phishing in a customer's inbox. That split is the story of this dataset.
A note on scope: this list was compiled from general brand recognition across running, cycling, ski, and team-sport categories, not one canonical index — treat it as a representative sample rather than an exhaustive census. All 102 domains were checked live on August 7, 2026; DNS configurations drift, so exact numbers will shift over time.
The numbers
| Metric | Value |
|---|---|
| Domains scored | 102 |
| Average Health score | 94.7 / 100 |
| Average Best Practice score | 79.2 / 100 |
| Best Practice standard deviation | ~8.4 |
| Best Practice range | 61 – 100 |
Health holds up well — these are commercial operations with real uptime incentives, and it shows. Best Practice trails by 15 points on average, in a now-familiar pattern: DNS runs, security hygiene lags.
DNSSEC: essentially absent
Just 2.9% of sports brands have DNSSEC enabled — meaning 97.1% do not. This is, by a wide margin, the lowest DNSSEC adoption of any sector we've scored. Where university and museum domains at least have a small existing base to build on, commercial sports brands have effectively not started. For companies running e-commerce, loyalty programs, and increasingly direct-to-consumer subscription services on these same domains, that's a gap between customer trust and the infrastructure backing it.
DNSSEC cryptographically signs DNS responses so a resolver can verify they weren't tampered with in transit. Without it, an attacker on the network path can silently redirect a checkout or account-login flow to a convincing counterfeit — exactly the kind of attack e-commerce brands are otherwise heavily invested in defending against (fraud teams, bot mitigation, PCI compliance) while leaving this particular door unlocked.
DKIM: missing on more than half
53.5% of sports brands have no DKIM record at all — the single worst check result across every sector and every category we've measured in this run. DKIM cryptographically signs outbound mail so a receiving server can verify it actually came from the claimed domain. Without it, a domain's ability to prove its own email is genuine collapses, regardless of what its SPF or DMARC records say.
This isn't just a theoretical security gap. Gmail and Yahoo's 2024 bulk-sender rules mean mail without DKIM increasingly lands in spam — a direct hit to whether "your order shipped" and "your loyalty points expire soon" emails actually reach customers, on top of making brand-impersonation phishing easier to pull off convincingly.
But: DMARC enforcement leads the pack
Here's the twist. Despite the DKIM gap, sports brands post the highest DMARC p=reject enforcement rate of any sector scored — 46.1%, ahead of universities (28.8%) and museums (32%). That's a genuinely interesting structural contrast: these companies are common phishing and brand-impersonation targets — fake "your order shipped" emails, counterfeit-goods phishing — and DMARC enforcement is the control that most directly protects against that specific abuse pattern. Commerce doesn't prioritize DNSSEC. It clearly does prioritize not getting spoofed in a customer's inbox.
The incentive is obvious once you see it: one protects the brand from impersonation complaints; the other protects an abstraction most marketing and IT teams never think about.
DMARC has three enforcement levels: p=none (monitor only — spoofed mail still gets delivered), p=quarantine (spoofed mail gets flagged as spam), and p=reject (spoofed mail gets blocked outright, before it ever reaches an inbox). Only p=reject actually stops phishing that impersonates the domain; the other two levels just watch it happen and report on it. That sports brands lead every sector on reaching p=reject says something real about which security investments get funded when there's a recognizable threat behind them.
Single points of failure
67.6% of sports brands run all nameservers from a single Autonomous System — lower than museums (75.7%) but still a majority, and higher than universities (37.9%). For companies running seasonal launch traffic and flash-sale spikes, a single-AS outage is a revenue event, not just a technical inconvenience.
An Autonomous System (AS) is an independently-operated network — which provider actually owns the IP block the nameservers sit in. A single-AS setup means one outage or misconfiguration can take checkout, product pages, and email all offline at once — during a shoe drop or Black Friday sale, that's directly lost revenue, not just downtime. Caveat: if that single AS is a large anycast network like Cloudflare, the practical risk is much lower than the raw percentage suggests — the real exposure is a single small, non-anycast provider with no fallback.
Best and worst performers
Top 5 (Best Practice score):
| Domain | Best Practice | Health |
|---|---|---|
| craftsports.com | 100 | 92 |
| hoka.com | 97 | 98 |
| head.com | 97 | 95 |
| reebok.com | 90 | 97 |
| onrunning.com | 90 | 94 |
Bottom 5:
| Domain | Best Practice | Health |
|---|---|---|
| revelyst.com | 61 | 99 |
| adidas.com | 67 | 94 |
| puma.com | 67 | 97 |
| saucony.com | 67 | 96 |
| merrell.com | 67 | 96 |
All five domains in this bottom five follow the sector's usual pattern — fully operational, under-configured on the security layer. No domain in this sample shows genuine Health degradation.
The takeaway
Sports brands treat DNS the way most consumer companies do: as plumbing that should stay invisible, funded only when a specific, named threat forces the issue. DMARC got funded because brand-impersonation phishing is a recognizable, budgetable risk. DNSSEC didn't, because the threat it addresses — DNS-path attacks and cache poisoning — rarely shows up as a support ticket or a headline. The sites work fine. The hygiene is inconsistent — and which parts of that hygiene get fixed tracks closely with which parts get noticed.
What to do about it
If your organization looks like these — commerce-first, DNS treated as invisible plumbing — the good news is the fixes are cheap relative to the DMARC work already done:
- Close the DKIM gap first. At 53.5% missing, this is the single most common and most fixable finding in the whole dataset — most managed mail platforms (Klaviyo, SendGrid, Mailchimp, etc.) support DKIM signing natively; it's usually a DNS record away, not a project.
- Enable DNSSEC. Since DMARC enforcement is already mature here, the team clearly can execute on DNS security when the case is made — DNSSEC just needs the same treatment: a named risk (checkout/login redirection) and a champion.
- If DMARC is still below
p=reject, use it as the template: this dataset shows the playbook (start atp=none, use reports to clean up legitimate senders, tighten) already works — apply it to whichever record is lagging. - Treat nameserver AS diversity as a revenue question, not just an uptime one — model what a single-AS outage costs during a launch window before deciding it's an acceptable risk.
Curious where your own domain lands? Run it through NODA and see the same 41 checks scored live.