Who Moves the World's DNS: 15 Months of Delegation Flux, a One-Month Million-Domain Migration, and the Nameservers That Outlive Their Owners

Thirteen months ago, Who Runs the World's DNS took a single photograph of the delegation layer: 277.6 million delegated domains, GoDaddy first, Cloudflare second, a long tail of registrar defaults. A photograph tells you who holds the territory. It cannot tell you how the territory changes hands — who is gaining, who is quietly draining away, and what happens to the hundreds of thousands of domains whose nameservers belong to companies that no longer exist.

The delegation record is the internet's least glamorous coordinates. An NS record does nothing visible: it names the servers that answer for a domain, and as long as something answers, nobody looks at it again. Registrars set it at purchase, platforms rewrite it in bulk, and owners forget it exists. The conventional wisdom — repeated in every DNS provider's marketing — is that delegation is sticky, that winning a domain's NS record means holding it for years. Nobody publishes the actual number, because measuring it requires asking the same question about every domain on the internet, every month, and remembering the answers.

That is what this post does. It is the delegation-layer companion to The Restless Aliases (which measured one month of CNAME churn) and The SaaS Ledger (which measured fifteen months of TXT records), and it completes the longitudinal set: A records for where the web lives, CNAME for how it is wired, TXT for what it subscribes to — and now NS for who answers for it.

We ran nine full NS-typed crawls of the DomainsProject corpus — an April 2025 baseline, then monthly from December 2025 through July 2026 — and reduced each to one record per registrable apex domain: its nameserver host set, and the DNS operator behind it, using the exact methodology of the published census. Joined by name across all nine passes, that is 404,134,492 apex domains tracked through 15 months, with the June 2026 pass reproducing the published census to the row.

The headline: the delegation layer barely moves — and when it does move at scale, it is almost never the customer moving. 61.1% of the April 2025 delegated web sits on the exact same nameserver hosts fifteen months later (83.0% of the domains that survived), and 82.7% of persistently-observed domains never changed DNS operator once. Against that stillness, the largest single flow in the entire dataset — 2,107,989 domains from namefind.com to afternic.com — is GoDaddy consolidating its own premium portfolio, and the fastest flow — 1,077,731 domains onto parity.domains in 32 days — is Namecheap re-plumbing its parking estate onto a platform with no public footprint. Meanwhile, 338,741 domains still delegate to Dan.com, a marketplace GoDaddy retired a year ago, and their number has essentially stopped shrinking.

The Data

Each pass queries the full corpus for NS records and keeps only names that are themselves registrable apexes — delegation lives at the apex, and counting each domain once is what makes operator shares one-domain-one-vote. The union across all nine passes is 404,134,492 distinct apexes; 173,848,335 of them (43.0%) appear in every single pass, forming the fully-observed panel behind the per-domain stability numbers. The cadence is uneven and we treat it honestly: an April 2025 baseline, a gap, then monthly. Where a change lands inside the gap, we say so rather than interpolating.

One column above needs an immediate flag. The "zero NS answers" state oscillates between 8.1 million and 30.9 million from pass to pass, and the oscillation tracks passes, not domains: after each zero-NS spike (December, February, June), 16–17 million of the affected domains return as ordinarily delegated in the very next pass. Domains do not mass-de-delegate and re-delegate in synchronized waves; resolvers time out. The July pass carries the largest zero-NS count of the series (30.9 million), and its recovery lies beyond our window — so transitions into that state at the July edge are read as artifact-heavy, never as de-delegation. We therefore treat "zero NS" as a measurement state, never as evidence of de-delegation — and this retroactively qualifies the census's own 7.86% no-NS figure, part of which is transient. The May 2026 pass, which under-resolved in our TXT-record series, is normal on the NS side and is included.

Methodology

Unit of analysis. The registrable apex domain under the ICANN section of the Public Suffix List — private-section suffixes (blogspot.com, kasserver.com) are walked past, so platform subdomains do not masquerade as registered domains and one operator's nameservers do not fragment into several. Russian-administered TLDs are excluded from all counts per project policy.

States. In each pass an apex is delegated (≥1 NS answer), zero-NS (present, NOERROR, no NS answers — treated as a resolution state, see above), or absent (not in that pass). The corpus stores NOERROR responses only, so absence bundles death, resolution failure, and crawl misses: every death-shaped number in this post is an upper bound, the same caveat that governed The Restless Aliases.

Operator. Each NS hostname maps to a DNS operator key: its ICANN-registrable domain, with one collapse for the families that deliberately spread nameservers across registrables (awsdns, azure-dns, Akamai, UltraDNS, Dyn, IONOS's ui-dns, Hetzner's first-ns/second-ns, DNSPod), and a (self-hosted) token when a nameserver lives under the apex it serves. The primary operator of an apex is the most common key among its NS hosts (ties broken lexicographically). This is the census's exact classifier, and it inherits the census's granularity: an operator key is an infrastructure identity, not a corporate one. The sharpest instance: ns-cloud-*.googledomains.com is the nameserver domain of both Google Cloud DNS and the defaults of the defunct Google Domains registrar — the two are indistinguishable at the NS layer, and we label the key "Google DNS infrastructure" throughout. Treating it as "the dead registrar's estate" would be wrong: it gained 2.79 million new delegations between April and December 2025 alone.

Change detection. For each apex we also store the full operator set and a hash of the sorted NS host set. Between two passes, a surviving delegation is classified as: same hosts (identical host set), same operator set, hosts renamed (ns1 → ns2 shuffles inside one provider), operator set adjusted (primary kept, secondaries changed), or operator changed (primary moved). Flows are counted only for the last class, so provider-internal renames never masquerade as migrations.

Validation. The June 2026 pass, aggregated from the per-apex tuples, reproduces the published census exactly: the top-14 operator counts to the domain (GoDaddy 52,558,251, Cloudflare 38,539,040, ...), and the scalar totals within 2 rows of 301,278,780 — the 2 being duplicate apexes the census counted twice and the global sort deduplicates. Live-DNS spot checks in July 2026 verified the load-bearing claims: registry delegations to ns1.dan.com still exist and that host still answers authoritatively (from GoDaddy address space); sampled bodis.com-delegated domains SERVFAIL because the Bodis nameserver hosts no longer resolve; renewyourname.net is registered at and served by Tucows.

Known limitations. Fifteen months and nine passes support flux rates and flow attribution, not long-run survival curves — for mortality proper, see The Half-Life of a Domain. Operator keys undercount corporate families that use distinct NS brands (Namecheap's registrar-servers.com, namecheaphosting.com and spaceship.net count separately; Alibaba's hichina.com and share-dns.com likewise). Multi-provider statistics count operator keys, so a provider using two registrable NS domains inflates "multi-provider" slightly — the same limitation the census carried, kept for comparability. Aggregate zombie counts are published; per-domain enumerations of hijackable delegations are not.

Reproducibility. Every chart links its CSV below; the full operator × pass matrix is nsflux-scorecard.csv and the complete pair ledgers are nsflux-monthly.csv and nsflux-flows.csv. The pipeline is ~200 lines of Go per stage: a per-shard extractor emitting one tuple per apex, an external sort, and a 9-way streaming merge-join. The active dataset is available at domainsproject.org/dataset.

The Scorecard in Motion

Primary-operator counts at the endpoints, with share per 1,000 delegated apexes — the normalization that removes the corpus's own growth (253.2M → 285.4M delegated).

Download: nsflux-scorecard.csv — top 25 operators × 9 passes, with per-1,000 shares.

Cloudflare is the only large operator gaining organic share, and it is gaining a lot of it: from 94.9 to 142.4 delegations per 1,000 — a 69% absolute increase (24.0M → 40.6M) in fifteen months. Every mid-size incumbent in the table — Wix, IONOS, Alibaba, NameBright, NS1, OVH, Strato — lost share over the window; GoDaddy's flagship domaincontrol.com lost 10.5 per 1,000. The delegation layer's drift is the same story the census told, now with a slope attached: default-concentrated at the top, with one operator compounding.

The two other big gainers are not market movements at all. Afternic's +25.9 per 1,000 is overwhelmingly GoDaddy relocating inventory between its own brands (next section). And Hostinger's dns-parking.com (+9.2) is the parking build-out already chronicled in The Parking Lot — domains arriving at a registrar default that happens to be a parking machine. Watched naively, "DNS market share" conflates customer choice, corporate reshuffling, and parking-default gravity; the flow decomposition below is what separates them.

One resilience note from the same series: the single-provider share of delegated domains rose monotonically from 91.87% to 92.59%, and the count of domains with a single NS host — the configuration RFC 2182 warns against — fell 433,221 → 365,532. The web is becoming slightly more dependent on single operators, while the most fragile single-host setups slowly disappear.

The Stillness: What Fifteen Months Does to a Delegation

The fate of the 253,197,693 domains delegated in April 2025, by July 2026:

Download: nsflux-fates.csv · nsflux-monthly.csv

Among domains that survived the fifteen months, 83.0% sit on the bit-identical nameserver host set — not the same provider, the same hosts. Another 2.2% stayed with their operators through host renames or secondary changes, leaving 14.8% of survivors that actually moved. Annualized, that is roughly 11.8% per year — and it triangulates almost exactly with the A-record layer, where Where the Web Moves measured 32.3% of survivors changing hosting provider over 38 months (≈10.2%/yr). Two independent instruments, two different layers, one conclusion: about one domain in nine changes infrastructure operator per year; everything else is inertia.

The monthly ledgers put a pulse on it. Across the seven true month-over-month pairs, the operator-change rate among survivors stays in a narrow band — 1.76%, 2.20%, 2.16%, 3.00%, 2.34%, 2.09%, 2.29% — a 2.3% monthly average with no trend, while 96–97% of survivors keep exact hosts every single month. For comparison, the CNAME layer's all-causes monthly churn is ~7.5%, but its retarget rate — the closest analogue to an operator change — is 1.25%. The two layers churn at the same order of magnitude; what distinguishes delegation is what the churn is made of. At the alias layer the biggest flows were platform re-plumbs of records; at the delegation layer, as the next section shows, they are re-plumbs of ownership.

The per-domain view is the starkest. Of 334,345,078 apexes with at least two delegated observations, 276,585,537 — 82.7% — never changed primary operator once; 13.6% changed exactly once (a domain's move is usually a single event: an expiry, a sale, a migration — not a habit); and just 778,101 changed four or more times. At the extreme, 6,369 domains changed operator at every observation — a serial-flipper population three orders of magnitude smaller than the stable core.

The Corporate Steps: When a Million Domains Move Overnight

The largest operator-to-operator flows over the full window, and over the final month:

April 2025 → July 2026

June 2026 → July 2026 (32 days)

The single biggest move of the entire fifteen months is GoDaddy talking to itself. NameFind is GoDaddy's premium-portfolio arm; between April and December 2025 its nameserver estate collapsed from 4,471,643 domains to 905,721 while 2.1 million of them re-emerged on Afternic's nameservers — the same consolidation the SaaS Ledger watched at the TXT layer, where Afternic's verification-token population quintupled after GoDaddy retired Dan.com and folded its marketplaces into Afternic. Add the direct domaincontrol → afternic flow and Afternic's rise from 2.1M to 9.8M delegations is accounted for almost entirely inside one company. GoDaddy-family share, counted together (domaincontrol + Afternic + NameFind), is flat across the window: 223.3 → 224.1 per 1,000. The most dramatic line on the scorecard chart is an org chart, not a market.

The fastest move belongs to Namecheap — and to a platform that did not exist in our data until this month. parity.domains went from zero delegations in June 2026 to 1,077,731 in July: 553,387 re-delegated from registrar-servers.com, another ~40,000 from namecheaphosting.com and namecheap.com, 237,849 from cloudflare.com — consistent with expired registrations whose owners had pointed DNS at Cloudflare, reclaimed by the registrar at expiry — plus 109,030 arriving from outside the June crawl. The Restless Aliases caught this operator's birth at the CNAME layer three weeks earlier (parkingpage.namecheap.com → parking.d.parity.domains, 177K aliases); the NS layer now shows the same event at 6× the scale. Parity has essentially no public footprint — no press release, no product page describing the estate it now fronts. A million-domain DNS operator materialized in 32 days, and the only public record of it is measurement.

The pattern repeats at every scale: judns.com → julydns.com (250,226) is one Chinese DNS provider's rebrand — the old brand drained 840,660 → 51,667 across the window while the new one grew 302,622 → 1,648,667. Unstoppable Domains moved its estate off Google Cloud DNS onto its own nameservers in spring 2026 (106,604 in a single month-pair, 0 → 156,687 overall). In the delegation layer, the tail is organic and the steps are corporate — the same law the TXT series found, now measured in delegations rather than tokens.

The genuine customer flows are real but smaller: domaincontrol → cloudflare (653,088) is the largest owner-driven migration on the board — GoDaddy-registered domains whose owners pointed delegation at Cloudflare — followed by the same pattern from every major registrar default (Namecheap, Hostinger, Alibaba's share-dns, Google infra: 149,881). Cloudflare's organic rise is the sum of a thousand small defections from registrar defaults, at ~2% of survivors a month.

The Zombie Delegations: Dead Platforms, Living Nameservers

Domains delegated to the nameservers of retired platforms:

Download: nsflux-zombies.csv

These are two different kinds of dead, and the difference is the whole story.

Bodis is a true orphan. The parking platform shut down on January 31, 2026, and the delegation layer reacted almost instantly: 484,432 → 50,737 between the January and February passes, an 89% cleanup in 28 days — proof that when registrars control the delegation (most parked domains sat on registrar accounts), dangling-NS hygiene at scale is achievable in weeks. But then the curve stopped obeying. A floor of 22–51K remained, and in July the count rose by 16K. Live checks show why these matter: the Bodis nameserver hosts no longer resolve, so every one of these domains SERVFAILs — and yet new delegations keep arriving at a dead operator, echoing the 2.78 million zombie aliases (and 308K monthly new arrivals) the CNAME layer still carries for Bodis. Dangling references propagate: templates, copied zone files, and bulk-import defaults keep writing a dead platform's name into fresh delegations.

Dan.com is a functioning zombie — and that is why it will not drain. GoDaddy announced Dan.com's retirement in September 2024 and completed it by August 2025, but the nameservers were never turned off: ns1.dan.com still answers today, authoritatively, from GoDaddy address space — serving Afternic-style landers. The result is visible in the curve: a halving from 693K to ~400K while the platform wound down, then a decay that flattens to almost nothing (−0.6% in the final month). With no breakage to force action, the remaining 338,741 delegations are simply abandoned in place. A dead platform whose nameservers still answer has no mechanism for finishing its death — the registrant has no error to notice, the registrar has no failure to sweep, and the brand persists in the DNS until someone is forced to act.

The third row is the long-tail version of the same law: uniregistrymarket.link — the marketplace NS of Uniregistry, acquired by GoDaddy in 2020 — still holds 5–12K delegations six years later, and its count also rose in July (+79% month-over-month). At every scale, the delegation layer accumulates references to the dead unless something breaks loudly enough to force cleanup.

The Expiry Conveyors: The Nameservers of the Domain Afterlife

The flow tables surface an operator genre invisible in any single snapshot: nameservers that exist to hold domains between lives.

renewyourname.net is the purest specimen: its stock is almost perfectly flat (~200K for fifteen months) while ~50,000 domains flow through it from Google DNS infrastructure every single month — a Tucows-operated waiting room whose population turns over roughly every four months: Tucows-registered domains that used Google Cloud DNS, hitting expiry, being re-delegated to the pool, then dropping or renewing out of it. Its counterpart at Hostinger (dns-expired.com) doubled as Hostinger's parking estate matured, and GMO's onamae-expired.com did not exist in April 2025 (18 domains) — an expiry conveyor born, populated to 190K, and stabilized entirely inside our observation window. Gname's conveyor is the same machine running in reverse gear: the burner-domain rotation visible as 152K arriving from Alibaba's share-dns in one month.

This genre is why the googledomains.com series confused us until the live checks resolved it. Its outflows (~50K/month to renewyourname.net) look like a dying registrar draining — but its inflows (2.79M new delegations Apr–Dec 2025) prove the opposite. Both are true, because the key conflates two populations: Google Cloud DNS customers arriving, and Tucows-registered Cloud-DNS users expiring out. The delegation layer records infrastructure, not org charts — an analyst who reads operator keys as companies will misread both this row and the Afternic one.

The Loyalty League: Stickiness Is a Business Model

Of the April 2025 cohort's survivors, the share still on the same primary operator in July 2026 (cohorts ≥1.5M):

Download: nsflux-stickiness.csv

Loyalty is a readout of business model, not service quality. The top of the table is European registrar-hosting bundles — Strato, OVH, IONOS — where DNS is welded to hosting, email, and an annual invoice: their surviving customers essentially never leave (96.8% for Strato), the same operators that topped the A-record stickiness league in Where the Web Moves. The bottom is not "bad providers" but different machines: share-dns.com survivors moved 54% of the time because that key hosts churn-and-rotate inventory, and NameFind's 23.7% is the Afternic consolidation seen from the cohort side — a portfolio owner moved its own holdings by fiat.

Cloudflare is the paradox row, and both of its numbers are the same fact. It has the worst survival of any major operator (58.2% of its April 2025 cohort still present — echoing its highest-in-class death rates at the A layer, where the free tier's magnetism for short-lived domains was measured directly) and it grew faster than everyone else. Cloudflare's delegation estate is a fast-flowing river: enormous inflow from registrar defaults, heavy mortality among the arrivals, high loyalty (86.4%) among what survives. Growth and churn are not opposites; at the delegation layer they are the same business.

What's at Stake

• Dangling delegations regrow like weeds — Bodis gained 16K new delegations in July, five months after its nameservers went dark, and Uniregistry's marketplace NS still collects domains six years after acquisition. Every one is a domain that resolves to nothing at best; if a retired platform's NS registrable ever lapses, whoever registers it inherits authoritative control of every domain still pointing at it.
• A "functioning zombie" resists cleanup by design — Dan.com's 338,741 delegations have stopped draining because the nameservers still answer. Keeping a dead brand's NS alive prevents breakage, and by preventing breakage, removes the one signal that drives cleanup.
• DNS market-share reporting is confounded by fiat moves — the largest flow (2.1M) and fastest flow (1.1M) in fifteen months were both single corporate decisions. Any market analysis that reads NS counts as customer preference — including snapshots of our own — will misattribute them.
• The delegation layer is quietly concentrating — single-provider dependence rose every single pass (91.87% → 92.59%), and the only organic share gainer is the operator that already fronts most of the proxied web. The stillness that makes delegation reliable also makes concentration a one-way ratchet: at 2.3% monthly switching, share, once gained, is nearly permanent.
• Single-crawl NS measurements have an error term nobody reports — the zero-NS state oscillates 8M ↔ 31M between passes of the same corpus. Any census-style number built on one crawl (including the 7.86% no-NS figure in our own) carries a transient component that only a panel reveals.

What Would Help

1. Registrars: sweep dangling delegations on platform death, not just on expiry. The Bodis cleanup proves the capability exists — 89% of half a million delegations re-pointed in 28 days, almost certainly because most sat on registrar-controlled accounts. The residue (and its July regrowth) is the part no automated process owns: delegations written by templates and bulk imports. A quarterly lame-delegation audit per registrar would drain the floor the event-driven sweep leaves behind.

2. Platform operators: publish a sunset standard for nameservers. GoDaddy kept ns*.dan.com answering (no breakage, no cleanup — 339K domains embalmed) while Bodis's hosts went dark (mass breakage, fast cleanup, SERVFAIL residue). Both choices have costs, and neither was documented anywhere. A retired platform should state what its NS will do — answer with landers, sinkhole, or go dark on a date — so registrars and owners can act on schedule rather than on archaeology.

3. Security teams: treat delegation changes as the rare events they are. The baseline is 2.3% of domains a month, and 82.7% of the persistent web never changes operator at all — so an NS change on a monitored domain is a low-noise, high-signal event, and a delegation pointing at a retired platform's namespace is a standing finding. The flow ledger doubles as a whitelist of known-benign mass moves (registrar re-plumbs, expiry conveyors) to subtract before alerting.

4. Researchers: never read the NS layer from one crawl. Two structural artifacts — the oscillating zero-NS state and infrastructure keys that conflate companies (googledomains.com, the Namecheap family) — are invisible in a snapshot and dominant in a series. Survivor-conditioned rates (this post's 2.3%/month) are robust to both; raw absent-counts and single-pass operator censuses are not.

5. Domain owners: audit your delegation when your platform dies, not when your site breaks. More than 300,000 Dan.com delegations still work by accident, on the continued goodwill of the acquirer's infrastructure. If a platform you delegate to is acquired or retired, the DNS will not warn you — check the NS records yourself, because the only failure mode this layer has is silent.

Methodology: nine full NS-typed crawls of the DomainsProject corpus (April 10, 2025; monthly December 19, 2025 – July 11, 2026; ~2,500–3,200 result shards and ~55 GB of compressed responses per pass), reduced to one record per ICANN-registrable apex — nameserver host set, operator set, and primary operator per the published census classifier — and merge-joined by name across all passes: 404,134,492 distinct apexes, 173.8M observed in every pass. The June 2026 pass reproduces the published census top-14 operator counts exactly. Delegation states, change classes, and flow attribution as defined in Methodology; Russian-administered TLDs excluded throughout. Full data: operator series, pair ledgers, flows, fates, zombies, loyalty. Explore the dataset at domainsproject.org/dataset and the live numbers at /stats.