October 06, 2026
66 min read
We measured how much of 77 national namespaces depends on US-headquartered operators or US soil: per-domain web, mail and DNS for 65.5 million live websites, plus cloud regions, CDN points of presence, TLS certificates, ccTLD registries, routing, latency and 21,000 institutions. 43.9% of the live websites whose layers we could attribute have at least one layer run by a US-headquartered operator or sit on US soil, and the switching ran toward US operators: 2.8 mail moves onto a US-headquartered operator for every move off one, 2.4 for DNS. US soil and US ownership are different problems with different fixes. We end with a measured guide to who should move, where to, and who should not bother. For policymakers, registries, hosting providers and anyone running a website outside the US.
October 04, 2026
42 min read
A .ca domain needs a Canadian owner, but nothing requires its website, mail or DNS to be Canadian. We measured all three for 1.86 million live .ca websites, followed hosting from 2023 to 2026, ran about 6,800 traceroutes from Canadian vantage points, timed the front doors of the largest operators from Toronto, Montreal and Vancouver, sampled .ca registrars and checked 989 government websites. Only 6.5% of .ca websites keep web, mail and DNS with Canadian operators and the website in Canada; 54.6% run all three on US-headquartered operators, more than Mexico, Australia or the UK. Physically, much of the .ca web answers from inside Canada; legally, four in five .ca websites have at least one layer run by a US company or hosted in the US. The 2025 tariff shock was followed by a small relative gain for Canadian hosting and no homecoming. For policymakers, registries, hosting providers and anyone running a Canadian domain.
October 03, 2026
36 min read
How much of each country's own namespace is hosted at home, mailed by a domestic operator and served by a domestic DNS provider? We measured all three layers for 78 national country-code TLDs plus .eu: 29 hosting crawls from April 2023 to September 2026, and 12 MX and 10 NS crawls from April 2025. Domestic hosting is not losing to foreign data centres but to the edge: the median share of a country's websites behind anycast front doors doubled from 11% to 23%, almost all of them run by US companies, while the home share of located websites barely moved. With US-headquartered operators gaining mail share in 76 countries and DNS share in 74, the index — a descriptive composite of domestic control, not a measure of sovereignty or resilience — fell in 70 of 78 countries in seventeen months, from a median of 42.1 to 38.1. Iran, the United States, Japan and Germany keep most of their namespaces at home; among the 30 largest, Mexico, Canada and India keep the least. For policymakers working on digital sovereignty, registries, hosting and DNS operators, and Internet measurement researchers.
September 28, 2026
27 min read
.xyz accounted for 98% of the domain market's net growth in August 2026, and nobody said why. Our Newly Observed Hostnames feed saw 3.27 million new .xyz names between June and September, 2.7 million more than the spring pace. In our September sample, 84% came through one Japanese registrar, and almost all of those went straight to Afternic, GoDaddy's domain marketplace. They were generated by gluing a keyword such as gpu, taxi or manga to dictionary words. The same pattern ran in 2025, and the August 2025 batch was 88% deleted a year later. Two in three resolving .xyz names now point at an Afternic for-sale page. The flood also blunts a common security signal: in every wave month, a new .xyz name was less likely than a new name elsewhere to be reported for phishing. For registries, registrars, domain investors, security teams and anyone who uses domain counts as a signal.
September 27, 2026
28 min read
In July we told SOC teams to gate new-domain watchlists on activation: a live mail server, not a parking nameserver. We tested that advice on 29.2 million registered domains our Newly Observed Hostnames feed first saw between May and July 2026, against every later OpenPhish and URLhaus listing. A live MX did not predict a listing; parking predicted its absence; self-hosted mail was the one mail signal that did; and 84% of listings came within days, before any monthly crawl looked. Our feed saw 58.5% of OpenPhish's registered phishing domains by listing day, but only 1.3% of its free-hosting sites. For SOC teams, threat-intelligence analysts, and brand-protection researchers.
September 05, 2026
31 min read
We kept the exact TTL of every A record in 28 full crawls of the DomainsProject corpus, April 2023 to August 2026 — 43.6 billion DNS answers, 6.9 billion of them the address record of a registrable domain. The share of domains whose address expires in five minutes or less rose from 21.27% to 28.67%, and among live (non-parked) sites from 23.00% to 36.38%, almost all of it since March 2025, while the share at a day or more did not grow. Corrected September 23, 2026. But 60.8% of surviving domains publish the same value 40 months later: GoDaddy's domaincontrol.com (mode 600) and Cloudflare (mode 300, 89% of its zones) set the number for a third of the web, and Cloudflare alone accounts for 47% of every domain at five minutes or less. For DNS and platform operators, SRE and incident-response teams, and Internet measurement researchers.
August 20, 2026
39 min read
We followed the MX record of every apex domain across eleven full crawls, April 2025 - August 2026 (421.9 million apexes). 70.8% of mail-capable domains sit on the bit-identical MX record set sixteen months later; provider switching runs under 1% a month. Google Workspace's lead over Microsoft 365 widened at every single pass (1.28 to 1.43 by domain count) - yet direct switching between the two is a wash; the gap is made by new domains, which arrive 2.3-to-1 for Google, while Microsoft wins the migrations out of self-hosting. Null MX quadrupled from 3.4M to 13.4M domains, and 77% of it is one aftermarket platform's zone template. For email and security teams, hosting providers, and Internet measurement researchers.
July 24, 2026
31 min read
We mapped a week of Google Trends spikes (US + Canada) against our Newly Observed Hostnames feed. A brand-new AI model was followed by a clean launch-day lookalike wave; a breach at a household-name AI company saw no measurable wave at all; and a two-hour Instagram outage saw none either — its phishing lives on free-hosting subdomains a registration feed never sees. Of 195 event-matched lookalikes, 94% resolve but only 30% are provisioned for email. Corrected September 27, 2026. For SOC teams, brand-protection researchers, and threat-intelligence analysts.
July 23, 2026
22 min read
We followed the NS delegation of every apex domain across nine full crawls, April 2025 - July 2026 (404 million apexes). 61% of the web kept the exact same nameservers for fifteen months; operator switching runs at 2.3% a month; and the biggest moves were corporate re-plumbs - GoDaddy consolidating 2.1 million NameFind domains onto Afternic, Namecheap shifting 1.1 million parked names to an undocumented platform in one month. Meanwhile 339,000 domains still delegate to the retired Dan.com. For DNS operators, security teams, and Internet measurement researchers.
July 18, 2026
21 min read
We re-classified 18 billion DNS TXT queries across ten full crawls (April 2025 - July 2026) and turned the SaaS verification-token census into a time series. Anthropic tokens grew 625x to 131,812 apexes. The Dan.com shutdown moved five million marketplace tokens. Microsoft 365's domain share is flat while Google's climbs. And across every major vendor, only 19-29% of token disappearances are deliberate cleanup - the rest is domain death. For SaaS analysts, security teams, and Internet measurement researchers.