Product guide
Non-Profit Market Index
The Non-Profits list of the Market Index compares the DNS posture of the 500 largest eligible US charities by revenue, after hospitals, colleges, grantmakers and several other types are excluded, grouped by the cause each one serves.
The short answer
Use the Non-Profits list to see how large charities configure the DNS behind their websites and donation email, graded with the Security Posture grade from nine of its cards: Email Security, DNS Security, TLS and Certificates, Website Application Security, Endpoint Security, IP and Asset Reputation, Human and Social Engineering Exposure, Trust Center and Privacy. Brand Protection, Attack Surface, Network Security, Vulnerability Management and Credential Exposure take far more requests or paid services, so they aren’t checked here, and the Security Posture page can grade more areas than the score stored here. Donors are a frequent target of look-alike email, so SPF, DKIM and DMARC matter a great deal here.
Filter by cause to compare similar organizations, such as human services charities or environmental groups, then open a charity’s domain in Domain Visualizer for the record-level detail.
What is in the list
The list holds the 500 largest 501(c)(3) organizations by revenue. Hospitals and health care organizations, colleges and universities, and graduate and medical schools are left out because they have their own lists, and so are bodies run on behalf of a public college, such as its foundation or athletics fund. Many hospital and college bodies are filed under other codes, so anything named for a university, education support bodies such as university foundations and endowment managers, and hospital groups, clinics and physician practices are left out too. Grantmakers, such as donor-advised funds and community and private foundations, are left out because most of their revenue is donors’ money passed on to other charities. Pension funds and insurance pools (mutual benefit bodies) are left out, and so are organizations with no NTEE code or an unclassified one, because their cause cannot be checked.
The IRS publishes the file in four regional parts. All four are read together, so the list is one national ranking, not 500 from each part. Because of the exclusions, and because each organization's revenue comes from its own most recent return, it is a filtered reference sample rather than an exact count of the country's 500 largest non-profits.
Each row shows the organization’s name, its domain, its state, its cause group and NTEE code, its revenue and its latest DNS score and grade.
Where the data comes from
Names, states, NTEE codes and revenue come from the IRS Exempt Organizations Business Master File, which the IRS updates monthly. The list was built from the 2026 extract. It is not refreshed automatically: it changes when an administrator imports a newer extract. Revenue is the amount on each organization’s most recent return in that file, so the tax year can differ from one charity to the next. Organizations are identified by their Employer Identification Number (EIN).
The IRS file does not include websites, so each charity’s domain is added by hand. Only organizations with a known domain can be scored.
How often it is scored
Each organization on the list gets a fresh DNS score about once a month: the list is set to score every 30 days, and the work is spread across the month after the day’s S&P 500 scores, so a few organizations are re-checked every day rather than all of them at once.
A score counts only when every DNS lookup behind it was answered. The page shows each organization’s latest such score and its date, so an older score is labelled rather than hidden. For record-level investigation, open Domain Visualizer; for grades and remediation, use Security Posture. Check the Cached badge and timestamp: saved scans last 24 hours by default and are not necessarily fresh lookups. Query authoritative servers directly for immediate verification.
What the columns mean
The cause column is the organization’s NTEE major group. The National Taxonomy of Exempt Entities (NTEE) gives each charity a code; its first letter is one of 26 major groups. The groups you will see most often in this list:
| Group | Letter | Examples |
|---|---|---|
| Arts, Culture & Humanities | A | Museums, orchestras, public broadcasting |
| Education | B | K-12 schools, libraries, student aid (colleges are excluded) |
| Environment | C | Conservation and environmental protection |
| Diseases, Disorders & Medical Disciplines | G | Disease-specific charities such as cancer or heart associations |
| Medical Research | H | Research institutes and foundations |
| Human Services | P | Family and social services, youth and senior programs |
| International, Foreign Affairs & National Security | Q | International relief and development |
| Religion-Related | X | Religious organizations that file with the IRS |
The NTEE code column shows the full code, such as P20 for human service organizations, for a finer split within a group.
FAQ
Why is a well-known charity missing?
It may be below the top 500 by revenue in the IRS file, it may be a hospital, college, grantmaker or other excluded type, or the IRS may hold no NTEE code for it. Churches are not required to file and rarely appear.
Why does a charity show no score?
Most often because its domain has not been added yet, since the IRS file has no websites. A charity with a domain may also be waiting for its turn in the monthly scoring cycle.
Is the score a rating of the charity?
No. It measures how one domain’s DNS is configured. It says nothing about how a charity spends its money or how well it runs.