The Landlords of the Web: 297 Million CNAME Records Show Half the Internet Is Served by Platforms, a Fifth Is Parked, and the Dominant CDN Is Invisible

A CNAME record is the closest thing DNS has to a forwarding address. It does not say where a name is; it says the name is an alias, and points at another name that answers for it. When www.example.com is a CNAME to shops.myshopify.com, the domain's owner has told the entire Internet, in public, that Shopify serves this site. Multiply that disclosure across every resolvable hostname on the Internet and the CNAME record becomes something larger than a routing convenience: it is a deed registry. Read in bulk, it tells you not where the web is, but who actually serves it — which is a different, and more revealing, question.

The conventional mental model of the web is a population of independent operators: millions of people and companies, each running or renting a server, each making their own choices. The CNAME map disagrees. It shows a web that is overwhelmingly aliased — pointed, by its owners, at a short list of platforms that do the actual serving. It also shows something subtler, and directly connected to our companion measurement of IPv6: the record type you query determines which infrastructure you are allowed to see. Ask for an address (A/AAAA) and Cloudflare dominates the answer. Ask for an alias (CNAME) and Cloudflare nearly vanishes — not because it left, but because of how it answers. The same Internet looks like two different industries depending on which DNS question you ask.

So we asked the CNAME question. DomainsProject runs full-corpus, typed DNS measurement passes against its master hostname dataset, and the 9 June 2026 pass queried the CNAME record for every resolvable hostname we track. That is 3,170 result archives, roughly 48 GB compressed, and 1,858,351,708 DNS answers — not a sample of popular sites, not the Tranco top-N, but the long tail of the actual registered Internet. For every name we recorded whether it is an alias; whether that alias stays inside its own registered domain or points outward to a third party; and, for the outward ones, who the third party is. Russian-territorial TLDs are excluded throughout, per project policy.

The headline: the web is rented, and the lease is written in CNAME records. Of 1.86 billion hostnames, 297,318,569 — 16.0% — are aliases. Of those, 43.2% merely canonicalize within their own domain (the familiar www → apex redirect), and 56.8% — 169 million names — point outward to a different operator. Where they point is the story. Just over half of those outward aliases (50.7%) land on a site builder, managed host, or cloud app platform — Blogger, Wix, Shopify, Squarespace, GoDaddy, Hostinger, Heroku — and one in five (20.3%) lands on a domain-parking or for-sale service that hosts no real site at all. A parking company, HugeDomains, is the third-busiest CNAME destination on the entire web, ahead of Shopify and Squarespace. And the CDN that fronts a quarter of all websites, Cloudflare, accounts for 0.7% of the alias map — because it flattens CNAMEs into address records at its edge, and so the dominant proxy on the Internet is, to a CNAME crawler, almost invisible. Self-hosting, the thing the web was supposed to be, barely registers.

The Data

Every record in this study is a single CNAME query answered from the public DNS, in June 2026, against the DomainsProject master hostname corpus.

The unit that matters here is the hostname (FQDN), not the registry domain. An alias is a property of a specific name — www.example.com and shop.example.com can point to entirely different operators — so unlike our IPv6 census, which collapsed to the registrable apex, this analysis counts each fully-qualified name on its own terms. That is the right grain for the question "who serves this name," and it is also why our totals run larger than any count of registered domains: a single registration routinely contributes several aliased hostnames. We resolve each alias to the registrable domain of its target using ICANN public-suffix rules (so shops.myshopify.com collapses to myshopify.com, user.github.io to github.io, d1234.cloudfront.net to cloudfront.net), and classify that target operator. The 16.0% alias rate is a floor on platform dependence, not a ceiling: it excludes every domain that points at a platform via an A record instead of a CNAME — which, as we will see, is exactly how the single largest platform on the web does it.

Methodology

Any number with this many zeros in it deserves to have its definitions spelled out.

Alias, self, and cross. A hostname is an alias if its CNAME query returns at least one CNAME answer record (as opposed to a SOA-only authority section, which we read as "exists, but is not a CNAME"). Where a chain returned more than one CNAME, we follow it to its sink — the final target that is not itself the owner-name of another CNAME in the answer — and classify that. We then compare the registrable domain of the alias to the registrable domain of its target. If they match, the alias is self / internal (www.example.com → example.com, or cdn.example.com → example.com): a canonicalization the owner performs within their own zone, telling us nothing about a third party. If they differ, the alias is cross-domain, and the target's registrable domain is the operator we classify. All category percentages in this post use the 169,036,913 cross-domain aliases as their base unless stated otherwise, because those are the names that actually disclose an external relationship.

Name role. For each alias we record whether the queried name is the apex (the registrable domain itself, e.g. example.com), the www subdomain, or another subdomain. This matters because of a rule from the foundations of DNS, discussed below.

Target categories. Each cross-domain target operator is assigned to one category by what it does with the name:

• Site builder / managed host — the provider serves the page. No-code builders (Wix, Squarespace, Webflow, Jimdo, Framer), hosted commerce (Shopify, BigCommerce, GoDaddy Commerce), blogging and publishing platforms (Blogger/Google Sites, WordPress.com, WP Engine, Ghost), static-site and edge hosts (GitHub Pages, Netlify, Vercel), and shared/managed hosting (Hostinger, Turbify, Gandi). From DNS we cannot always separate a Hostinger website-builder site from a Hostinger shared-hosting account, and we do not try to — in both the host serves the page, which is the distinction that matters.
• Cloud app platform — IaaS/PaaS where the operator deploys their own application (Heroku, AWS, Azure, Google Cloud, Alibaba Cloud, Render, Railway, Fly.io).
• Domain parking / for-sale — the target hosts no real content: for-sale portfolios (HugeDomains, Sedo, Afternic), pay-per-click monetizers (ParkingCrew, Bodis, ParkLogic), and registrar "coming soon"/lander pages (Namecheap, GoDaddy, Porkbun, Name.com).
• CDN / reverse proxy — the target is an edge node you alias into (Akamai, Fastly, CloudFront, Azure Front Door, and the Chinese CDNs Alibaba, Tencent, Wangsu).
• Email & marketing — deliverability and tracking aliases (Microsoft 365 autodiscover, Mailgun, SendGrid, GoDaddy Email, branded-link trackers).
• Other SaaS — vanity CNAMEs for identity, support, and conversion tools (Auth0, Okta, Zendesk, Statuspage, GTranslate).

Classification is by ordered substring match against the target's registrable domain, validated by sampling the actual target hostnames behind every registrable domain that accounts for more than ~0.1% of the corpus — which is how we confirmed, for instance, that the 5.1M aliases to godaddy.com are paylinks.commerce.godaddy.com (GoDaddy's hosted-commerce payment pages) and the 1.0M to outlook.com are Microsoft 365 autodiscover and mail-routing records.

Known limitations. Six, stated plainly. (1) The flattening blind spot is the central caveat. A provider that resolves a customer's CNAME server-side and returns A/AAAA records — Cloudflare's default, and the mechanism behind ALIAS/ANAME records elsewhere — is invisible to a CNAME crawl. This understates CDN and proxy share enormously and is the single most important thing to hold in mind; we treat it not as an error to apologize for but as a finding to examine. (2) 19.0% of cross-domain aliases are unclassified. This residual is genuine long tail, and a visibly large fraction of it is algorithmically-named throwaway domains (iflvopx.net, 32b2yjhrzxe8.com, and thousands like them) consistent with spam and CNAME-cloaking networks — so the residual is not randomly distributed across the real categories, and our parking and builder shares are floors. (3) First-sink classification. We classify the end of the CNAME chain; chains are 0.004% of aliases, so this is immaterial. (4) Hostnames, not owners. A platform with many subdomains per customer (Blogger, Heroku) accumulates hostname count quickly; we count names, not deduplicated customers, and say so wherever it changes the reading. (5) Presence, not liveness. A CNAME means a name advertises an alias; we did not fetch the target to confirm it serves content. Parked and dangling aliases are part of the picture, by design. (6) Snapshot, not longitudinal. One pass, 9 June 2026; we make no growth claims from it. Reproduction inputs — the extractor, the classifier, and the per-shard aggregates — are archived alongside the crawl.

Dataset vs. external counts. Our shares are of CNAME aliases, a population that systematically over-represents platforms (which require CNAMEs) and under-represents both self-hosting and Cloudflare-style flattening. Where we cite external market share — W3Techs' percentage of all websites, BuiltWith-style live-site counts, academic parking censuses — we flag the unit explicitly, because "share of CNAME aliases," "share of the top 10 million sites," and "share of all live sites" are three different denominators that must not be mixed.

The Scorecard

Two numbers frame everything. Of 169 million outward-pointing aliases, 41.1% name a site builder or managed host and 20.3% name a parking lot — and the two parking giants, HugeDomains and ParkingCrew, between them out-rank Shopify and Squarespace.

Add the platforms together and the picture is stark: builders, managed hosts, and cloud app platforms account for 50.7% of every outward alias on the web. Fold in the CDNs you genuinely CNAME into and 56.6% of all outward aliases name an operator other than the domain's owner serving the content — and that figure is a floor, because it cannot see the flattened CDNs at all. The category that is conspicuously small is the one the popular press treats as synonymous with web infrastructure — CDN, at 5.89% — and the reason is not that CDNs are rare but that the biggest one does not answer in CNAME. Meanwhile the category that "should" be a footnote, domain parking, is the second-largest destination on the entire map. This is the structural fact the per-site view hides: the long-tail web is not a frontier of independent servers. It is a tenancy, and a surprising share of the tenancy is vacant lots with for-sale signs.

Top destinations

The top ten destinations include three parking services, and two of them sit in the top five. That a domain-for-sale company aliases more hostnames than Shopify hosts stores is the single most counterintuitive result in this dataset, and it survives every robustness check we ran. It is not a CDN artifact (parking targets are unambiguous, self-identifying hostnames like traff-https.hugedomains.com and parkingpage.namecheap.com), and it is not a single-shard fluke (it is distributed across the corpus). The web's busiest alias targets are a blogging platform from 2003, a website builder, and a domain reseller — in that order.

The Platform Web: Half the Internet Is Served by Someone Else

The builder category is both the largest and the most concentrated: 69.4 million aliases, with the top seven operators accounting for the bulk of it. Blogger leads at 18.1 million — a number that lands with extra weight because our IPv6 census independently measured 18.1 million Blogspot properties from a completely different record type, two instruments agreeing on the size of Google's sprawling, half-dormant blogging estate to within a rounding error. Below it sit the modern builders: Wix (12.2M), Shopify (8.6M), Squarespace (8.5M), GoDaddy's hosted-commerce paylinks (5.1M), Hostinger (3.6M), and Vercel (3.2M).

Our ranking differs from the popular market-share tables in a way that is itself informative. W3Techs puts Wix at 4.3% of all websites and Squarespace at 2.5%, and among the top one million sites, hosted-solution share runs Shopify ~31%, Wix ~23%, Squarespace ~9% — Blogger does not appear. Yet in the long tail, Blogger is the largest single destination on the web. There is no contradiction: popularity-weighted rankings count sites people visit, and Blogger's tens of millions of blogs are mostly long-dormant, so they are enormous in name-count and negligible in traffic. The lesson is a normalization one. A census of all hostnames and a census of the top million measure different things, and platforms age differently within them — Shopify and Wix dominate the sites that matter today; Blogger dominates the sites that merely still resolve. Both facts are true, and the dataset you pick decides which one you'll report. (BuiltWith-style live counts — Shopify ~5.6M live stores, Wix ~8M — sit between our hostname counts and W3Techs' percentages, exactly as the unit difference predicts.)

Heroku is the surprise of the cloud category: 10.4 million aliases, the fourth-busiest destination on the web, and by far the largest pure application-platform target — more than AWS (2.4M), Azure, and Google Cloud's app surfaces combined as they appear in CNAME. A decade of developers pointing custom domains at *.herokudns.com, many of them long since abandoned but still aliased in DNS, has left Heroku with a CNAME footprint that dwarfs its current mind-share. It is the clearest example in the dataset of a CNAME being a historical artifact as much as a live one: the alias outlives the app.

The Parking Lots: One Outward Alias in Five Points at a For-Sale Sign

34.4 million of the web's outward aliases — 20.3% — point at a service whose business is to host nothing. This is the finding that most resists the standard picture of the web. We are not measuring registered-but-unused domains in the abstract; we are measuring names that resolve, that someone queried and got a live answer for, and one in five of those answers is a redirect to a monetized placeholder or a "this domain is for sale" page.

The parking population splits cleanly into two businesses. The for-sale portfolios — HugeDomains (10.5M), Sedo, Afternic — are speculators holding inventory; HugeDomains' aliased-name count is consistent with the ~5.1 million .com domains it was reported to hold in late 2024 once you account for the additional TLDs and the www plus apex aliases each registration contributes. The PPC monetizers — ParkingCrew (8.8M), Bodis (3.2M), ParkLogic — run advertising pages on domains parked by their owners for income. And the registrar landers — Namecheap (3.5M), Porkbun, Name.com, GoDaddy — are the default "coming soon" pages a domain shows between registration and first use.

Our 20.3% is a CNAME-visible floor, and it brackets cleanly against the academic record. The most rigorous external measurement, Zirngibl et al.'s 2022 census, found 58.5 million of 334 million domains parked — 17.5%, explicitly a lower bound — rising to ~30% within the legacy gTLDs. We measure a different population (resolving hostnames, not registered domains) by a different method (CNAME target, not content fingerprint), and land at 20.3% of outward aliases — the same order of magnitude, from an independent instrument. It also lets us put a number on a piece of Internet folklore: the oft-repeated claim that "most domains are parked" is not supported. The measured reality across multiple methods is that parking is a large minority — somewhere between a sixth and a third of the namespace depending on how you count — not a majority. What is genuinely striking is not that parking exists but where it ranks: as a destination, it is second only to the entire site-builder industry combined, and ahead of every cloud platform on Earth.

One structural note explains why parking concentrates at the apex. A parked domain typically has nothing but a placeholder, so its owner — usually the parking service or registrar, which controls the whole zone — aliases the bare registered name directly. That makes parking disproportionately responsible for a phenomenon that should, by the rules of DNS, be rare.

Cloudflare's Vanishing Act: The Dominant CDN Doesn't Answer in CNAME

Here is the methodological heart of the study. Cloudflare fronts roughly a quarter of the web, and it accounts for 0.73% of the CNAME map. W3Techs measures Cloudflare at 23.3% of all websites and 83.4% of all sites using any reverse proxy; Statista puts it near 20% of all sites; our own IPv6 census found Cloudflare supplying 44.7% of every domain's IPv6 — 28.7 million domains. And yet in 169 million outward CNAME aliases, Cloudflare appears just 1.24 million times. The dominant infrastructure company on the Internet is, to a CNAME crawler, a rounding error.

The cause is a single default setting, and it is the same mechanism that made Cloudflare dominate our IPv6 numbers. When you proxy a zone through Cloudflare, your CNAME is resolved server-side: Cloudflare follows your alias to its address and returns its own anycast A and AAAA records to the client, never exposing a CNAME at all. This is the general technique that DNS providers market as CNAME flattening, ALIAS, or ANAME — and it exists because of a rule from RFC 1034: a CNAME cannot coexist with other records at a zone apex, where NS and SOA are mandatory, so providers that want apex-level proxying must synthesize address records instead. Cloudflare applies it everywhere, apex and subdomain alike. The result is that Cloudflare's entire footprint moves from the CNAME census to the address census. Query AAAA and it is 44.7% of the answer; query CNAME and it is 0.7%. Nothing about Cloudflare changed between those two numbers — only the question did.

This is why the CDN category is small and why its members are the providers you manually alias into. Fastly (2.55M), CloudFront (2.19M), and Akamai (1.25M) appear in CNAME because their standard onboarding is "create a CNAME to yoursite.fastly.net." They have not flattened, so they remain visible. The takeaway for anyone who measures the Internet from DNS is uncomfortable and important: no single record type sees the whole infrastructure. A CNAME census sees the platforms, builders, parkers, and alias-style CDNs with perfect clarity and is blind to the flatteners; an A/AAAA census sees the flatteners and the origins and cannot tell an alias from a direct host. The honest map requires both, and any study using one to estimate the other will be systematically wrong in a predictable direction.

www and the Apex: The Mechanics of the Alias

The alias has a canonical shape, and the data shows it precisely. Of all 297 million aliases, the www subdomain accounts for 41.7% and bare apex names for 12.6%, with all other subdomains making up the remaining 45.7%.

www being the single most-aliased name on the Internet is RFC 1034 made visible at scale. Because a CNAME cannot legally coexist with the NS and SOA records every apex must carry, the decades-old convention is to put the alias on www and an address (or a flattened pseudo-alias) on the bare domain. Forty-two percent of the alias web is operators following exactly that rule: www.example.com is a CNAME, example.com is not. A large share of those www aliases are the self variety — www pointing back at its own apex, the canonicalization that 43% of all aliases represent — while the rest point www straight at a platform.

The 12.6% of aliases that sit at the apex are the rule-breakers, and their existence is itself a finding. Thirty-seven million bare registered domains answer a CNAME query with a CNAME record, in technical violation of the apex coexistence rule — something that happens when an operator controls the entire zone and chooses to alias the naked domain anyway, accepting that it serves no other apex records. This is consistent with the populations we already identified as apex-heavy: parking services and managed platforms, which own the whole zone and have no MX or NS ambitions for the names they hold. We cannot fully attribute the apex aliases by category from this pass, so we state it as a correlation rather than a cause — but the overlap between "controls the entire zone" and "aliases the apex against the RFC" is exactly what the parking and builder concentrations predict.

The Long Tail Is Not Empty — It's Spam

The 19.0% unclassified residual is not noise to be apologized for; it is a population. Sampling it surfaces two recognizable things. The first is genuine long-tail hosting — small regional providers and SaaS tools below our classification threshold. The second, and more interesting, is a dense cluster of algorithmically-named throwaway domains — iflvopx.net, 32b2yjhrzxe8.com, q59361eoo03s.com, and thousands of their siblings — that serve as CNAME targets for large volumes of machine-generated subdomains. This is the DNS signature of spam and CNAME cloaking: the technique of hiding third-party infrastructure (trackers, redirect networks, gambling-spam farms) behind a same-looking alias.

Academic measurement of CNAME cloaking exists, but it is both narrow and aging, and our corpus is a more current and far larger lens on it. The canonical study, Dimova et al. at PETS 2021, found CNAME-based trackers on 9.98% of the top 10,000 websites and rising — but it measured the top of the web, five years ago, for tracking specifically. The residual we see is a different and larger phenomenon: cloaking and aliasing across the long tail, where spam and abuse concentrate and where no top-N study looks. We stop short of putting a precise prevalence number on it, because labeling a gibberish domain "spam" from its name alone is a heuristic, not a proof. But the shape is unambiguous: a meaningful fraction of the unclassified alias web is throwaway infrastructure, and it is the part of the dataset most worth a dedicated follow-up.

What's at Stake

• Platform dependence is now measurable, and it is most of the web. When 50.7% of outward aliases point at a builder, host, or cloud platform — and that is a floor that cannot see the flatteners — "the web" is operationally a few dozen companies serving everyone else's names. A change in policy, pricing, or availability at any of the top platforms propagates to tens of millions of sites that have no other way to be reached.
• A fifth of the resolving namespace is commercially inert. 34 million aliases to parking and for-sale services mean that a large minority of names that "work" lead nowhere a human wants to go. For search engines, threat intelligence, and anyone building a map of the live web, parking is not an edge case to filter — it is the second-largest thing on the map, and treating a resolving name as a real site overcounts the web by roughly one in five.
• DNS measurement is record-type-dependent, and most published figures pick one. Cloudflare at 44.7% of IPv6 and 0.7% of CNAMEs is the same company measured two ways. Any inventory, market-share estimate, or security scan that infers infrastructure from a single record type inherits a large, directional blind spot — and almost all of them do.
• The alias is a standing disclosure and a standing liability. Every CNAME publicly names a third party an organization depends on; aggregated, it is a supply-chain map an adversary can read for free. Worse, aliases outlive the services behind them — Heroku's 10 million and the dangling tail throughout the dataset are exactly the conditions for subdomain takeover, where an attacker claims the abandoned target a live CNAME still points at.
• Parking and cloaking share the long tail with everything else. The same corner of DNS that holds small legitimate hosts also holds the for-sale lots and the spam-cloaking networks. Defenders who write off the long tail as low-value are ceding the exact ground where domain abuse operates.

What Would Help

1. Security teams: inventory your CNAMEs the way an attacker does, and hunt the dangling ones. Every alias in your zones names an external dependency, and every alias whose target you no longer control is a takeover waiting to happen. Resolve your own apexes and subdomains, confirm each CNAME points at a service you still own, and retire the ones that don't — the abandoned alias is the most reliable foothold in this entire dataset. Benchmark your surface against the dataset.
2. Platforms and registrars: a CNAME you issue is a name you are now responsible for. The providers at the top of this map — builders, hosts, and parkers alike — hold tens of millions of customer aliases, and the dangling subset is a shared-security problem they are uniquely placed to fix with target-ownership validation. If you operate a platform, the most impactful thing you can do for the whole web's hygiene is refuse to keep serving an alias whose customer has gone.
3. The measurement community: never quote one record type as "the Internet." Report CNAME-visible and address-visible infrastructure as separate metrics, always, and name the flattening gap explicitly — so that "Cloudflare's share" reads as "44.7% of address records, 0.7% of aliases" and not as a single misleading number. The two halves only add up if you keep them labeled.
4. Search, threat-intel, and dataset builders: filter parking as a first-class category, not an afterthought. One resolving name in five is a placeholder; a live-web index that does not detect and segregate the 34 million parked aliases is overcounting the web by its second-largest component. The CNAME target is among the cheapest reliable parking signals available — use it.
5. Registries and policy makers: the apex-CNAME and cloaking tails deserve scrutiny. Thirty-seven million apex aliases against the RFC, and a long tail thick with machine-named cloaking targets, are both visible from nothing more than public CNAME queries. The same instrument that produced this post can monitor those populations continuously; the data is free, and the abuse hides in the part of the namespace nobody is counting. Explore the per-TLD statistics and the full dataset.

Methodology: 1,858,351,708 CNAME query results from a DomainsProject full-corpus typed DNS crawl dated 9 June 2026 (3,170 archives, ~48 GB compressed), reduced to 297,318,569 aliases and 169,036,913 cross-domain aliases via ICANN public-suffix rules, with each target operator classified by ordered substring match and validated against sampled target hostnames. Category shares use the cross-domain alias base; 79.9% of cross-domain aliases were classified to a named operator. Provider footprints are hostname counts, not deduplicated customers. Cloudflare's address-record share is from our companion IPv6 census of the same corpus; external figures are from W3Techs, Statista, the Internet Society/APNIC, Zirngibl et al. (2022), and Dimova et al. (PETS 2021). Russian-territorial TLDs (.ru, .su, .moscow, .xn--p1acf, .xn--p1ai) excluded throughout. This is a single snapshot; no growth claims are drawn from it. Companion measurements of the same corpus appear in The IPv6 Mirage, Where the Fortune 500 Actually Live, and The Dead Web. Explore the full dataset at /dataset and per-TLD statistics at /stats/.