Defaults.Exposed › Reports

DNS Concentration: Two Providers Control a Third of the Internet (2026)

Published 2026-08-01 · updated2026-08-13

Figures as of 2026-07-29 · methodology v8. Aggregate census data; we never publish an individual domain’s status or grade. See how we grade.

GoDaddy answers authoritative DNS for 18.5% of the 297 million domains measured in this edition of the census. Cloudflare answers for another 14.7%. Authoritative DNS is the service that publishes a domain’s official records. It is the closest thing there is to the internet’s address book, and two companies now hold roughly a third of it.

It goes further. Add Afternic (GoDaddy parking) at 4.1%. That is Afternic, the domain aftermarket and parking arm GoDaddy bought in 2013. Count just its two largest nameserver brands, then, and the GoDaddy group answers for at least 18.5% of all measured domains. More than one domain in five points its DNS at a single corporate group.

DNS is not a hosting detail. It is the layer every other service depends on. Concentrate it, and you concentrate everything built on top of it.

DNS provider market share in 2026: the league table

First, how we counted. For every domain with an observed delegation (the registry record that names its nameservers), we recorded those nameservers. Then we grouped them by the organisation that operates the hostname. Nameservers under *.domaincontrol.com, for example, count as GoDaddy. Some brands run their nameservers on another company’s infrastructure. We credit those to the brand, which can shift a share a point or two either way.

Roughly 21 million of the 297 million domains in this edition had no delegation at all. They are the census’s dead cohort, and they belong to no operator. We keep them in the base anyway. So every share below is a share of all 297 million measured domains. If anything, that errs on the conservative side.

The league is not close. The live nameserver market-share table updates every edition:

Two caveats are worth being honest about. First, corporate umbrellas matter more than brand names. Afternic appears in the table as its own operator, but GoDaddy has owned it since 2013. That is why the top umbrella’s true share is at least 18.5%. Treat that number as a floor: it counts only the group’s two largest nameserver brands.

Second, an aftermarket and parking service mostly hosts domains that do nothing. Part of that umbrella is dormant inventory, not active websites. That softens the traffic picture. It does not soften the control picture: parked or not, those domains resolve through the same corporate infrastructure.

Beyond the leaders sits a very long tail of registrars, hosters, telcos and self-run nameservers. Each one is tiny. Together, they are the internet’s remaining diversity. Our June snapshot, who runs the internet’s DNS, covers the previous edition’s market shares. This report carries the current numbers, and the risk they add up to.

What does a nameserver actually control?

It is tempting to file DNS under plumbing. The census data says to file it under trust. A nameserver is the machine that answers for your domain: whenever anything on the internet needs your addresses, this is what it asks.

Your A and AAAA records decide which server visitors reach when they type your name. Your MX records decide which machines receive your email. Your TXT records carry SPF, DKIM and DMARC — the anti-spoofing records we grade domains on. CAA records tell certificate authorities which of them may issue TLS certificates in your name. Verification records prove you own the domain to every SaaS platform you have ever connected.

Whoever operates your authoritative nameservers can, technically, rewrite any of those answers. That is a property of how DNS works. It is true of any operator, and it is not a suggestion that any provider named here does so. DNSSEC is the control that lets resolvers (the servers that look up DNS on users’ behalf) detect tampered answers. Only 6.28% of domains are validly signed — see our DNSSEC adoption report.

There is a blunter failure too. When your nameservers stop responding, everything stops resolving as cached answers expire: your website, your inbound mail, your API, your single sign-on. Your web server can be perfectly healthy and completely unreachable, because the internet no longer knows where it is.

That is what the percentages in the table really measure: control of every answer your name gives.

Every record listed above is visible from the outside. See what yours are telling the world — a free scan, no signup.

What happens when a major DNS provider goes down?

Even the best-run DNS operators eventually stumble. The trigger varies: a botched configuration push, a routing mistake, a software rollout that misbehaves, a denial-of-service attack big enough to hurt well-built infrastructure. The pattern does not vary.

What concentration changes is the scale: a failure stops being one company’s incident and becomes the internet’s. When DNS was spread across thousands of small operators, a bad day was somebody’s bad day. At today’s shares, a serious failure at either leading operator is everybody’s bad day. A huge slice of the internet’s address book degrades at the same time. Sites that have never heard of each other start failing together, because they made the same reasonable choice.

The risk also hides inside supply chains. Your own domain may sit with a boutique DNS host. But if your payment provider, your email relay and your status page all resolve through the same giant operator, their outage is still your outage. Concentration risk travels along your dependencies, and almost nobody maps it.

Why is DNS so concentrated?

Because each individual decision was sensible. Most registrars pre-fill their own nameservers at checkout, so the default path leads straight to the biggest registrar’s DNS. Cloudflare pairs a generous free tier with strong performance and DDoS protection few small operators can match. It serves the same answers from dozens of locations at once, a technique called anycast. Parked and speculative domains pool with Afternic (GoDaddy parking), because that is what aftermarket and parking services are for.

Nobody chose fragility. Millions of rational, convenient, individually correct choices added up to an address book where 18.5% of all measured domains answer to a single corporate umbrella. The risk is invisible in any single decision. It only becomes obvious in a census.

To be clear, the giants run superb infrastructure. For most small domains, a giant operator’s worst day is often better engineered than a self-hosted nameserver’s average one. The problem is not quality. It is correlation.

How do you stay reachable when your DNS provider isn’t?

Resilience here is unglamorous, and cheap compared with what it protects.

The highest-leverage fix is a second authoritative provider. DNS was designed for this: you can list nameservers from independent operators side by side, and resolvers automatically retry the remaining ones when some fail. Standard zone transfers, or a simple sync job, keep the copies aligned. Two catches before you call it a weekend job — some large managed providers only allow outbound zone transfers on higher-priced tiers, and provider-specific record types do not transfer cleanly: proxied records, ALIAS records, flattened CNAMEs. Check both first.

Know your TTLs before you need them. A TTL, or time-to-live, tells the world how long to cache each of your answers. Stable records with generous TTLs can let resolvers coast through a short outage on cached answers. Rock-bottom TTLs on everything mean any outage bites almost immediately. Discovering your TTL strategy during an incident is the expensive way to learn it.

Your registrar, your DNS operator and your hosting provider do not need to be the same company. Each separation removes a shared failure mode — and a shared account-takeover target. And a secondary provider you have never actually cut over to is a hope, not a control. Rehearse the failover from outside your own network, where your monitoring does not share your caches.

Every one of these fixes starts from the same question: what does your delegation look like today? A free scan reads your nameservers, and everything resolving through them, in seconds.

What this means for your business

When DNS fails, it does not fail like a server. Everything with your name on it degrades together as caches expire: website, checkout, inbound email, SSO logins, API integrations. Inbound email is the cruel one, because the failure is silent from the inside. Senders get bounces. You get a quiet day.

So treat this as a due-diligence question with a measurable answer. Run a free scan. The report names the organisation answering your delegation, alongside the email, TLS and DNS posture that hangs off it. Check whether that name is in the table above. The top two rows alone hold 18.5% and 14.7%, so the odds are roughly one in three.

Then price an unreachable day honestly. Hours of dead checkout times your average order value. Staff locked out of SSO. Every inbound lead bouncing while sales assumes a slow day. Set that against a second DNS provider, which typically costs less per month than one lost order. Then decide deliberately whether single-provider DNS is a risk you accept. For a hobby domain, the honest answer may be yes. For a company whose revenue and logins hang off one delegation, a second provider is among the cheapest insurance in your stack.

And ask the same question one level down. Your critical flows depend on other people’s domains too. The scanner works on any domain, so run your payment provider, your email relay and your status page through it as well.

Your nameservers are the first thing our scanner reads. They are the foundation your email security, TLS and web posture stand on. Scan your domain — free, in seconds, no signup. Just the answers your nameservers are already giving everyone else.

Quick answers

Which corporate umbrella controls the most domains’ DNS? As of 2026-07-29, GoDaddy leads the defaults.exposed census with 18.5% of 297 million measured domains under its own brand. Counting Afternic, the aftermarket and parking brand GoDaddy owns, the group holds at least 18.5%.

How concentrated is the DNS hosting market? As of 2026-07-29, the two largest operators are GoDaddy at 18.5% and Cloudflare at 14.7%. Together they answer DNS for roughly a third of the 297 million domains in the census.

What happens if a major DNS provider goes down? Every domain that relies only on that provider stops getting fresh DNS answers. As cached answers expire, its website, email, APIs and logins become unreachable. And because the top corporate umbrella holds at least 18.5% of measured domains, one outage can hit a huge slice of the internet at once.

How do I check who operates my domain’s DNS? Run a free scan at defaults.exposed. It reads your delegated nameservers and the security records they serve — in seconds, no signup.