A CNAME record is a promise someone else keeps. When www.example.com aliases to sites.builder.com, the domain's owner has delegated their front door to an organization they probably couldn't name — and The Landlords of the Web measured that arrangement at planetary scale: 297 million aliases, 41% of the outward-pointing ones landing on site builders, 20% on parking lots. That was one photograph. This post is the second frame of the film.
The conventional model of DNS churn is that domains move when people move them: an owner switches hosts, a site dies, a startup outgrows its page builder. Under that model the alias layer should drift slowly, one deliberate decision at a time. Nobody publishes the actual rate — registrars see only their own book, CDNs see only their own tenants, and passive-DNS vendors sell samples, not censuses.
We re-crawled the entire CNAME layer 32 days after the crawl behind The Landlords of the Web and followed every name individually: 1.86 billion hostnames in the June 9 crawl, 1.90 billion on July 11, 169,036,912 cross-domain aliases tracked by name from one snapshot to the other. Russian-administered TLDs are excluded throughout, per project policy.
One month later, 92.53% of cross-domain aliases still pointed at the same registrable target. The other 7.5% — 12.6 million domains — retargeted, dropped their alias, or went absent from the crawl. 10.5 million left the cross-alias layer entirely while 12.2 million new aliases arrived, leaving the stock up 1.7M on the month. And the single largest flows in the retarget ledger were not customers leaving anybody: they were Heroku, GoDaddy, and Namecheap re-plumbing their own infrastructure, silently relocating 900,000 tenant domains' observed endpoints in the process. The alias layer is stable the way an airport is stable — the building holds still while a tenth of everything inside it is replaced every month.
The Data
| Dimension | Value |
|---|---|
| Snapshots | CNAME-typed crawls, 9 Jun 2026 (3,170 archives, 48 GB xz) and 11 Jul 2026 (3,202 archives, 53 GB xz) |
| Interval | 32 days |
| Hostnames answering | 1,858,351,700 (June) → 1,903,925,010 (July) |
| Aliases (any CNAME answer) | 297.3M = 16.00% of June hostnames; 300.3M = 15.77% of July |
| Cross-domain aliases followed | 169,036,912 (June cohort), joined by exact hostname to July |
| New cross-domain aliases | 12,237,855 (July names not cross-aliased in June) |
| Classification | Target registrable → 347 ordered substring rules (the Landlords rule set + three additions), validated against the published June numbers to ±1 domain |
| Exclusions | Russian-administered TLDs (classified into a quarantined pseudo-vendor so the ledger still balances) |
Both crawls query the same known-name corpus with the CNAME record type and store NOERROR responses — we verified the corpus contains no NXDOMAIN or SERVFAIL rows, which shapes what "disappeared" can mean below.
Methodology
Definitions. For each hostname we take the CNAME sink: the last alias target in the answer chain that never appears as an owner name — for www.shop.example → shop.example.myshopify.com → shops.myshopify.com, the sink is shops.myshopify.com. The sink's registrable domain is its eTLD+1 under the Public Suffix List with private suffixes honored, so shops.myshopify.com and ingress.herokuapp.com are distinct registrables rather than collapsing into myshopify.com's owner page or an undifferentiated herokuapp.com. A cross-domain alias has a sink registrable different from its own; a self alias stays inside its own registrable. Every hostname in a snapshot is in exactly one of three states: C (cross-domain alias), S (self alias), or P (present with no CNAME answer); a name missing from a snapshot entirely is A (absent).
The join. Both snapshots reduce to one row per hostname (a name with multiple records collapses to its strongest state, C > S > P), sort by name, and merge-join — 1,957,920,852 distinct hostnames across both crawls, 1.80 billion present in both. Every June cross-alias therefore has exactly one July fate: same target, retargeted, de-aliased to P, turned self-alias, or absent. The vendor-level ledger satisfies the accounting identity Δstock = gained − lost + retargets-in − retargets-out exactly (maximum deviation zero) — every domain in this post is in one and only one cell.
Vendor classification happens on the sink registrable via the same ordered substring rules as The Landlords of the Web, unchanged, so the June side of this study reproduces the published June census to within one domain (a single duplicate record absorbed by deduplication). Three rules were added for targets that only surfaced in the flows — cloud.microsoft and office.com (Microsoft 365) and parity.domains (parking) — all three former residuals, so no published June category shifts by more than those additions.
Known limitations. (1) The corpus stores successful lookups only, so absent is an upper bound on death: it conflates expired names, resolution failures, and crawl misses. We report it as its own category and never call it "died". (2) Sink identity depends on resolver chain expansion. If a resolver returns only the first hop of a chain, we see a different sink than if it expands three hops; when a platform inserts or changes a mid-chain hop, the observed sink of every domain behind it can change at once. Retarget counts are therefore lower bounds on chain motion, and the three big platform events below were each verified by live DNS queries against the current chains, not inferred from the corpus alone. (3) Cloudflare flattens CNAMEs into A/AAAA records at its edge, so the largest reverse proxy on the Internet is nearly invisible here — this study sees the alias layer, not the proxy layer, exactly as in the June census. (4) The corpus is known-names-only: "new aliases" mixes newly registered names, newly crawled names, and known names newly aliased; we split those flows by the name's June state (P = was there without a CNAME, A = wasn't there at all) wherever it matters. (5) One interval is not a trend. Every number here is one month of motion between two crawls 32 days apart; we annualize only as explicit if-this-month-is-typical arithmetic and draw no growth or decline trends from it. (6) A platform can move tenants between record types — ParkingCrew's 1.0M alias-to-A conversions below are the worked example — so a category shrinking in the CNAME layer is not necessarily shrinking on the web. Where we claim the parked web itself declined, the claim rests on the A-record series, and this study's role is a second instrument agreeing with it.
Reproducibility. The Go extraction/join pipeline and per-vendor flow ledgers are retained; chart data ships with this post (fates, categories, momentum, platform re-plumbs) plus the top-50 vendor retarget matrix. The underlying crawls are part of the dataset.
The Scorecard
| Fate of a June cross-domain alias, 32 days on | Domains | Share |
|---|---|---|
| Same registrable target | 156,412,710 | 92.53% |
| De-aliased (resolves, no longer a CNAME) | 5,523,380 | 3.27% |
| Absent from the July crawl | 4,694,097 | 2.78% |
| Retargeted to a different registrable | 2,110,056 | 1.25% |
| Turned self-alias | 296,669 | 0.18% |
Download: cnameflux-fates.csv
A 92.53% monthly hold rate sounds like stability until you run the compound interest. If this month's churn rate held steady, only 39% of the alias layer would remain on its current targets after a year — for a record type that most operators configure once and never look at again. (That is population-level arithmetic from a single interval, not a per-domain forecast: stable and volatile subsets clearly coexist, as the vendor table below shows.) The churn is real on both sides of the ledger: 10.5M June cross-aliases left the layer (de-aliased, went absent, or turned self-alias), 2.1M more retargeted within it, and 12,237,855 new cross-domain aliases appeared (3.9M on names that existed in June without a CNAME, 7.9M on names not in the June crawl at all) — netting the stock up 1.7M on the month. For calibration, The Half-Life of a Domain found 85.4% of resolving apexes survive twelve months; the alias layer's configuration is far more perishable than the domains under it.
Aliased names do not disappear faster than plain ones. 2.78% of June's cross-aliases were absent in July, against 2.99% of June's nine-times-larger no-CNAME population — being parked on someone else's infrastructure is not a death marker at one-month resolution; it's just how the modern long tail is wired.
The Re-Plumbed Web: The Biggest Movers Were the Landlords Themselves
The retarget ledger's headline rows are not migrations in any meaningful consumer sense. They are three platforms changing their own plumbing — each verified by live DNS queries at publication time — plus one deliberate brand consolidation:
| Platform event | Domains observed moving | What actually happened |
|---|---|---|
| Heroku ingress wildcard | 442,331 | *.herokuapp.com now answers with a CNAME to va*/ie*.ingress.herokuapp.com; names that were dark or CNAME-less in June alias into the new layer |
| GoDaddy Commerce → AWS | 278,105 | paylinks.commerce.godaddy.com now chains through t1k.poynt.net into an AWS us-east-1 ELB; every domain behind it changed observed sink from godaddy.com to amazonaws.com |
| Namecheap → Parity | 177,464 | parkingpage.namecheap.com now CNAMEs to parking.d.parity.domains; Namecheap's parked tenants followed |
| Microsoft → .microsoft | 41,492 | Chains that terminated at outlook.com re-terminate at cloud.microsoft / office.com |
Download: cnameflux-replumb.csv
GoDaddy's commerce estate now exits through its payments subsidiary into AWS. In June, ~5.1M domains' website chains sank at paylinks.commerce.godaddy.com. By July 11, a live query shows that hostname itself aliasing to t1k.poynt.net — Poynt being the payments company GoDaddy acquired in 2021 — and onward to t1kpay-…elb.us-east-1.amazonaws.com. The 278K domains our join recorded as "GoDaddy → AWS" moved nowhere; a hop changed above them. This is the same pattern Where the Web Moves found at the A-record layer, where GoDaddy relocating its lander estate from Google Cloud to AWS anycast produced the single largest "migration" of 110 million tracked domains. Data → inference: at both DNS layers, the largest apparent flows on the Internet are platform logistics, not customer decisions.
Namecheap quietly outsourced its parking lander — and the operator has no public footprint. parkingpage.namecheap.com, the default destination Namecheap's own documentation points parked domains at, now aliases to parking.d.parity.domains, whose lander nameservers (ns1.lander.d.parity.domains) also appear as the delegation for GUID-style parked hostnames across the corpus. As of publication we can find no public documentation of who operates Parity Domains — no announcement, no site content, no industry coverage. A company we cannot name is now the DNS terminus for a six-figure slice of Namecheap's parked estate; the delegation chain is the only visible trace.
Heroku's event is the biggest and the most artifact-prone, which is why we don't call it growth. 442,331 names alias into ingress.herokuapp.com in July that didn't in June — but sampling shows these are <app>.herokuapp.com platform names now resolving through a wildcard to numbered ingress hosts (va04, ie02 — the naming is consistent with Virginia and Ireland regions and with Heroku's published router-modernization work). A wildcard answers for every name under the suffix, including names that previously answered nothing — 357K of the 442K were entirely absent from the June crawl. Heroku's apparent +349K vendor-level month is its own ingress answering for names that previously answered nothing. We report it as the clearest illustration of the study's core measurement lesson: when the target of a wildcard or a mid-chain hop changes, the DNS "moves" at population scale with zero human intent.
Microsoft's 41K is the opposite: deliberate, documented, and visible in the long tail. Chains that used to end at outlook.com now end at cloud.microsoft or office.com — the consolidation onto the .microsoft brand TLD Microsoft announced in 2023. Brand TLDs are routinely dismissed as $185K vanity projects; here is one absorbing tens of thousands of third-party domains' mail-adjacent chains in a month.
Parking: The Second Instrument Agrees — the Lot Is Draining
| Category | June stock | July stock | Net |
|---|---|---|---|
| Site builders | 69.41M | 70.64M | +1.23M (+1.8%) |
| Parking & for-sale | 34.35M | 32.81M | −1.54M (−4.5%) |
| Unclassified | 33.85M | 34.48M | +0.64M (+1.9%) |
| Cloud platforms | 16.33M | 17.40M | +1.07M (+6.6%) |
| CDN | 9.95M | 10.21M | +0.26M (+2.7%) |
| Email/marketing | 3.52M | 3.52M | +2.3K (+0.1%) |
| SaaS vanity | 1.42M | 1.47M | +0.05M (+3.5%) |
Download: cnameflux-category.csv
Parking is the only category that shrank — by 4.5% in a single month. The Parking Lot measured the parked web monthly for 38 months in the A-record layer and found the first sustained decline on record beginning February 2026. This is an independent record type, a different classifier, and a different denominator saying the same thing four months into that decline: the lot is draining. ParkingCrew's alias estate saw a net drop of 881,625 (though note the record-type caveat below), Bodis's 457,802, Namecheap's 261,026 — and 177K of Namecheap's "loss" is the Parity re-plumb, moving parked domains to a different sink while leaving them just as parked.
The record-type caveat, worked honestly: 1,036,570 of ParkingCrew's gross alias losses (larger than its net drop, since 470K new aliases arrived on its targets in the same month) didn't disappear — they de-aliased, still resolving in July but no longer via CNAME. A parking operator switching tenants from CNAME landers to direct A records leaves the CNAME layer without leaving the parking business. This is exactly why the parked-web decline claim rests on the A-record series, with this study as corroboration: in the A-record series, which is immune to record-type migration, the decline shows anyway.
Bodis has been dead for five months and its alias estate is still 2.78 million domains — and still growing on the inflow side. The parking platform shut down January 31, 2026; in this one month 739K of its aliases de-aliased or went absent, but 308,619 domains newly pointed at bodis.com — 253K of them names not even present in the June crawl. Deliberate re-pointing at a five-months-dead parking company at that scale is implausible; the parsimonious reading is stale templates, bulk-registration defaults, and copy-pasted zone files reproducing a dead endpoint. It is the strongest evidence yet for the zombie-infrastructure thesis — dangling delegations don't decay, they propagate — and it hands the planned orphan-NS study its headline mechanism.
The Momentum Table: The Marginal Month Belongs to Churn Machines and Deploy Platforms
Stock tells you who won the last decade; the composition of one month's new aliases tells you who is winning right now. We define momentum as a vendor's share of July's 12.2M new cross-aliases divided by its share of June stock — 1.0× means growing exactly with the market.
Download: cnameflux-momentum.csv
One Chinese registrar generated 13% of every new alias on the Internet this month — from 1.3% of the standing stock. Gname's parking targets gained 1,588,929 aliases in 32 days and lost 1,768,915 — a gross turnover of 157% of its own stock in one month, on a stock that barely moved (−51K net once its 136K retargets-in and 7K retargets-out are counted). This is not a business growing or shrinking; it is a conveyor belt, consistent with bulk-registered burner domains rotating through short lives — 1.51M of its losses left the crawl entirely rather than moving anywhere. Gname is a fixture of registrar abuse rankings (Interisle's phishing studies have repeatedly placed it among the most-abused registrars), and the alias layer shows the mechanism at industrial resolution: the churn is the product. Alibaba Cloud's 6.8× (hichina.com registrar holds, 699K new) and NameBright's 4.7× read the same way.
Below the churn machines sits a cleaner story: every modern deploy platform over-indexes, every legacy builder under-indexes. Cloudflare Pages (2.7×), Railway (2.6×), Vercel (2.2×, and the largest absolute builder gain at 507K new aliases), Netlify (2.0×) — versus Shopify at 0.73×, Squarespace 0.66×, Wix 0.56×, and Blogger/Google Sites at 0.30× (10.7% of the stock, 3.3% of the inflow). The aristocracy still grew in absolute terms — Wix +155K, Squarespace +195K, Shopify +158K net — but the marginal month is being wired to a different generation of infrastructure. One caveat cuts the other way: part of Vercel's inflow lands on newly numbered edge registrables (vercel-dns-016/017.com), so fleet expansion and customer growth are entangled in its number; the momentum ordering of deploy stack over legacy builders survives the caveat, since it holds for Railway, Render, and Cloudflare Pages, whose targets didn't change naming.
What's at Stake
- Your CNAME is a moving part you don't control. Three platforms re-pointed chains this month and ~900K domains' observed endpoints changed with zero owner action. Security allowlists, SSRF filters, and mail policies keyed to a CNAME target's IP or registrable are keyed to something with a 7.5%/month population-level mutation rate.
- Dead infrastructure accumulates tenants. Bodis gained 308K new aliases five months after shutting down. Whoever ever acquires control of an abandoned parking target's domain inherits the traffic — and the trust — of millions of names that never chose it. The subdomain-takeover literature treats dangling CNAMEs as a static stock; this data shows the stock is refilling faster than it drains.
- Market share studies that read one snapshot misread the market. Blogger holds 10.7% of the alias stock and 3.3% of its inflow; Gname holds 1.3% of the stock and 13% of the inflow. Stock and flow disagree by an order of magnitude in both directions — anyone pricing, regulating, or securing this layer from a single crawl is measuring the past.
- The parking contraction is real and now multi-instrument. A-record front doors (The Parking Lot) and CNAME sinks both show the lot draining in 2026 — and the CNAME side adds the mechanism detail that some of the "drain" is operators re-plumbing to different record types, which only strengthens the case for measuring every layer.
What Would Help
1. Security teams: treat CNAME targets as rotating infrastructure, not configuration. Re-resolve chains on a schedule measured in days; alert on sink-registrable changes for your own estate. This month's data says the chain above you changes without notice — GoDaddy Commerce's did, for 278K domains at once.
2. Registrars: expire your landers' DNS when you retire them. The Bodis inflow exists because templates and defaults outlive the company they point at. A registrar that ships a parking default should ship its removal path too — and a successor should not be able to acquire a dead lander's domain and inherit 2.8M tenants.
3. Platform operators: announce chain changes like the breaking changes they are. Microsoft published its .microsoft consolidation and the move reads as intentional in the data; Namecheap's Parity handoff is visible only as an undocumented delegation. Operators of multi-million-domain front doors should disclose re-points the way cloud providers disclose IP-range changes.
4. Measurement researchers: query more than one record type, more than once. The June census showed the record type you query decides which infrastructure you can see; this month shows the interval decides whether you see decisions or logistics. One crawl of one type is two abstractions away from the web.
5. Domain investors and registries: watch the momentum table, not the leaderboard. The stock leaderboard has been Blogger, Wix, Shopify for a decade. The inflow is Gname, Alibaba, and the deploy stack. Which list you believe determines whether you think the long tail's future looks like websites or like burner infrastructure — the honest answer this month is: 13% of it looks like one registrar's conveyor belt.
Methodology: two full CNAME-typed crawls of the DomainsProject known-name corpus (1.86B and 1.90B NOERROR hostnames, 9 June and 11 July 2026), reduced to one state per hostname (cross-alias with sink registrable / self-alias / present-no-CNAME), merge-joined by exact name across 1.96B distinct hostnames, and classified with the same 347-rule vendor table as the June census (validated to ±1 domain against its published numbers). The vendor flow ledger balances exactly: Δstock = gained − lost + retargets-in − retargets-out, deviation zero. Absent-in-July is an upper bound on death (the corpus stores successful lookups only); retarget counts are lower bounds on chain motion (resolver chain expansion varies); Cloudflare's CNAME flattening keeps the proxy layer invisible; all platform re-plumb findings were verified against live DNS at publication. Russian-administered TLDs excluded throughout. Explore the dataset and TLD statistics.