June 27, 2026
23 min read
The first edition of the Internet Concentration Index: a synthesis of four full-corpus, typed-DNS censuses of the same ~3-billion-name dataset, measuring who controls the Internet's core layers one domain at a time. DNS, email, cloud hosting and the CDN/proxy edge each have a different owner — GoDaddy, Google, Amazon and Cloudflare — no single company controls all four, the enterprise giant everyone names (Microsoft) is nearly invisible by domain count, and 92.5% of delegated domains sit on a single point of failure. For policymakers, security teams, and anyone who has watched one outage take down half the web.
June 25, 2026
20 min read
We crossed two full-corpus DNS censuses of the same May 2026 crawl — the MX layer that names who runs each domain's mail, and the SPF/DMARC/MTA-STS/BIMI layer that says whether that mail is authenticated. Across 149.8 million mail-capable apex domains, email-authentication posture turns out to be inherited from the provider, not chosen by the owner: security gateways and Microsoft 365 run the credible anti-spoofing stack on 17–19% of their domains, while the four largest registrar-bundled hosts — IONOS, Hostinger, Namecheap, OVH — run it on under 1.2%, and the largest email category on the Internet stops spoofing on just 3.5% of its 46.7 million domains. The 9% that actually resist spoofing are not spread across the Internet; they cluster behind a handful of operators.
June 22, 2026
20 min read
India has 954 million internet users and the world's second-highest IPv6 capability — 78% of its users can reach the modern Internet, and Reliance Jio's all-IP network runs at ~95%. We then crawled its national namespace: 20.2 million .in hostnames, 10.2 million resolving across forward-DNS, MX, AAAA, NS, DMARC and IP-to-ASN data. The content layer tells the opposite story. Only 20% of .in domains are hosted on Indian soil — the United States alone hosts twice as much; only 20% offer IPv6 despite the world-class access network; Amazon AWS is the single largest operator of the Indian web. India consumes the Internet on world-class rails and publishes it on borrowed ground.
June 21, 2026
20 min read
We pointed an MX-typed crawl at 390 million registered domains to ask who actually handles the Internet's email. Only 38.7% can receive mail at all. Among those that can, Google Workspace leads Microsoft 365 by 1.4 to 1 (13.2% vs 9.4%) — the inverse of the enterprise market — yet both are dwarfed by registrar- and host-bundled email, which serves nearly a third of all mail-capable domains directly and most of the long tail besides. The result is a geographic map: Google owns the Americas and the developer world, Microsoft owns Northern Europe and the Commonwealth, and domestic hosts own their home ccTLDs. Built from 151 million apex MX records.
June 01, 2026
19 min read
We resolved the full DNS, MX, web-edge, and email-authentication stack of 500 Fortune 500 corporate domains against a May 2026 typed crawl. No single vendor owns enterprise DNS — 28% of the F500 still run their own. Proofpoint sits in front of 48% of mail-enabled inboxes. Akamai serves a third of the web edge. And the F500 enforce DMARC at 73% versus ~42% globally — yet MTA-STS reaches just 2.3%. This is the corporate Internet's plumbing, measured from the records themselves.
May 29, 2026
18 min read
We queried the email-authentication TXT layer directly — _dmarc, _mta-sts, default._bimi, and apex SPF — across a May 2026 DNS crawl, using MX records as the denominator. Of 150,020,997 mail-capable apex domains, 71.3% publish SPF, 34.1% publish DMARC, but only 11.7% enforce DMARC and just 9.0% run the minimum credible SPF-plus-enforced-DMARC stack. Two-thirds of DMARC records sit at p=none. MTA-STS reaches 0.144% and BIMI 0.084%. And 45.7% of all DMARC reports flow to a single registrar's default configuration. This is the state of email authentication, measured from the records themselves.