Built for Speed, Not for Signing: The DNS Habits of 102 Global Sports Brands

We ran 102 global sports and outdoor brands — Nike, Adidas, Puma, Hoka, Salomon, Wilson, Callaway, and a long tail of running, cycling, ski, and team-sport labels — through NODA's dual-axis methodology: 41 checks across infrastructure, security, mail authentication, reliability, and operations, rolled up into a Health score and a Best Practice score.

Sports brands are consumer-commerce companies first and infrastructure operators second, and it shows in a specific, structural way: they under-invest in DNS-layer cryptography almost entirely, while over-indexing — relative to the other sectors we've scored — on the one mail-security control that actually stops phishing in a customer's inbox. That split is the story of this dataset.

A note on scope: this list was compiled from general brand recognition across running, cycling, ski, and team-sport categories, not one canonical index — treat it as a representative sample rather than an exhaustive census. All 102 domains were checked live on August 7, 2026; DNS configurations drift, so exact numbers will shift over time.

The numbers

Health holds up well — these are commercial operations with real uptime incentives, and it shows. Best Practice trails by 15 points on average, in a now-familiar pattern: DNS runs, security hygiene lags.

DNSSEC: essentially absent

Just 2.9% of sports brands have DNSSEC enabled — meaning 97.1% do not. This is, by a wide margin, the lowest DNSSEC adoption of any sector we've scored. Where university and museum domains at least have a small existing base to build on, commercial sports brands have effectively not started. For companies running e-commerce, loyalty programs, and increasingly direct-to-consumer subscription services on these same domains, that's a gap between customer trust and the infrastructure backing it.

DKIM: missing on more than half

53.5% of sports brands have no DKIM record at all — the single worst check result across every sector and every category we've measured in this run. DKIM cryptographically signs outbound mail so a receiving server can verify it actually came from the claimed domain. Without it, a domain's ability to prove its own email is genuine collapses, regardless of what its SPF or DMARC records say.

But: DMARC enforcement leads the pack

Here's the twist. Despite the DKIM gap, sports brands post the highest DMARC p=reject enforcement rate of any sector scored — 46.1%, ahead of universities (28.8%) and museums (32%). That's a genuinely interesting structural contrast: these companies are common phishing and brand-impersonation targets — fake "your order shipped" emails, counterfeit-goods phishing — and DMARC enforcement is the control that most directly protects against that specific abuse pattern. Commerce doesn't prioritize DNSSEC. It clearly does prioritize not getting spoofed in a customer's inbox.

The incentive is obvious once you see it: one protects the brand from impersonation complaints; the other protects an abstraction most marketing and IT teams never think about.

Single points of failure

67.6% of sports brands run all nameservers from a single Autonomous System — lower than museums (75.7%) but still a majority, and higher than universities (37.9%). For companies running seasonal launch traffic and flash-sale spikes, a single-AS outage is a revenue event, not just a technical inconvenience.

Best and worst performers

Top 5 (Best Practice score):

Bottom 5:

All five domains in this bottom five follow the sector's usual pattern — fully operational, under-configured on the security layer. No domain in this sample shows genuine Health degradation.

The takeaway

Sports brands treat DNS the way most consumer companies do: as plumbing that should stay invisible, funded only when a specific, named threat forces the issue. DMARC got funded because brand-impersonation phishing is a recognizable, budgetable risk. DNSSEC didn't, because the threat it addresses — DNS-path attacks and cache poisoning — rarely shows up as a support ticket or a headline. The sites work fine. The hygiene is inconsistent — and which parts of that hygiene get fixed tracks closely with which parts get noticed.

What to do about it

If your organization looks like these — commerce-first, DNS treated as invisible plumbing — the good news is the fixes are cheap relative to the DMARC work already done:

• Close the DKIM gap first. At 53.5% missing, this is the single most common and most fixable finding in the whole dataset — most managed mail platforms (Klaviyo, SendGrid, Mailchimp, etc.) support DKIM signing natively; it's usually a DNS record away, not a project.
• Enable DNSSEC. Since DMARC enforcement is already mature here, the team clearly can execute on DNS security when the case is made — DNSSEC just needs the same treatment: a named risk (checkout/login redirection) and a champion.
• If DMARC is still below p=reject, use it as the template: this dataset shows the playbook (start at p=none, use reports to clean up legitimate senders, tighten) already works — apply it to whichever record is lagging.
• Treat nameserver AS diversity as a revenue question, not just an uptime one — model what a single-AS outage costs during a launch window before deciding it's an acceptable risk.

⇩ Download full report (PDF)

Curious where your own domain lands? Run it through NODA and see the same 41 checks scored live.