How many domains have declared themselves to OpenAI?

230,938 domains publish an openai-domain-verification TXT record at the apex, out of the 167,692,006 domains where the September 2026 census observed at least one apex TXT record. The census read that count from public DNS, and the rest of this page is about what it can and can’t be used to say.

The count

The census reads the TXT records at the apex of each domain it scans, meaning the bare registered name with no host in front of it. Where a string beginning openai-domain-verification= sits in that set, the domain is counted once, whatever the rest of the string contains and however many copies it carries. In the September 2026 edition that came to 230,938 domains, which is 0.14% of the 167,692,006 domains carrying any apex TXT record, and the string turned up in 535 top-level domains.

The 535 is worth having next to the headline. It tells you the record isn’t a quirk of one registry or one country. Wherever people register domains and connect them to outside services, some of them have connected one to this service and left the proof in DNS.

The surface it was counted on

A verification token, for the census, is a TXT string shaped <token>=<value> or <token>:<value> that isn’t an SPF, DMARC or DKIM record and doesn’t begin with v=. Across the same 167,692,006 domains, 44,285,266 carry at least one such token, which is 26.41% of the domains with any apex TXT record. That’s the population the OpenAI string lives inside, and it is the right shape to hold in mind: the domains that have proved control of their zone to at least one outside service, of any kind, at some point.

Counted against that population, the OpenAI string is on 0.52% of the domains carrying any verification token. Both denominators come from the September 2026 census, and which one you quote depends on the question. If the question is “how common is this among domains that publish anything at the apex”, use the 167,692,006. If it’s “how common is this among domains that verify with services at all”, use the 44,285,266.

What the record looks like in a zone

Run a TXT lookup against your own apex and you’ll see the whole set at once:

dig +short TXT example.com

A domain that has been through the verification flow shows a line like this among whatever else is there:

"openai-domain-verification=<the value the service issued>"

The mechanism is the same one other verification tokens use. The service generates a string, you paste it into a TXT record at the apex, the service queries DNS, finds it, and marks the domain as controlled by whoever holds the account. The record isn’t secret; it exists to be read by a third party over public DNS, which is the only reason a census can count it at all.

The record sits beside your SPF and DMARC records in the same TXT set, and it’s read by the same lookup. A zone that has accumulated a dozen verification strings over the years is a zone where somebody has been granted write access a dozen times, and it’s worth knowing who still has it.

What a token proves

Publishing the token proves one thing: at the moment the service checked, the person who set up the account could write to the zone. It says nothing about which product they were connecting, whether the connection still exists, how many people inside the organisation touch anything behind it, or what, if anything, was paid.

The 230,938 are domains that have declared themselves to a service at some point, in a way that stays visible until somebody deletes the record. Nothing in the flow prompts anyone to remove it afterwards, so a record can outlive the account it was created for and the person who set it up.

That makes it a declaration, and declarations are useful in a way survey answers aren’t. The census read them from DNS rather than from a questionnaire, so nobody chose to answer and no one picked the sample; the domain either carries the string or it doesn’t. But if what you need is customers, seats, revenue or a share of anything, this isn’t that number, and no arithmetic turns it into one.

Why the number is a floor

Two rules push the count down rather than up. The census includes a token in these sums only where at least three domains in the same top-level domain carry it, so it leaves out a string that appears on one or two domains in a small TLD. And a domain that publishes no apex TXT record at all can’t carry a verification token, so it isn’t among the 167,692,006 to begin with.

Then add the ordinary limits of a scan. A lookup that timed out, a zone that answered the census resolver differently from the way it answers yours, a token pasted at a subdomain instead of the apex, a record the owner deleted the week before the pass ran. Each of those loses a domain from the count and none of them adds one.

So 230,938 is the number of domains where the string was seen, on the day it was seen. The number of domains carrying it is at least that, and the number that have ever carried it is higher again by some amount the census can’t see.

Citing it without overreaching

The safe sentence is the literal one. “In the September 2026 defaults.exposed census, 230,938 domains published an openai-domain-verification TXT record at the apex, out of 167,692,006 domains with any apex TXT record.” That sentence survives any challenge because it claims exactly what was measured.

The sentences that don’t survive are the ones that swap the noun. “230,938 companies use OpenAI” fails because a domain isn’t a company and a record isn’t use. “0.14% of businesses have adopted AI” fails twice over, because the denominator is domains with a TXT record, and because the token has no idea what was adopted. If a slide needs an adoption figure, this count can sit beside it as an independent, counted signal that points the same way or doesn’t, though it can’t stand in for it.

What changes month to month

The count above is the September 2026 figure and will be replaced when the next census runs, since the same TXT set gets read again on the same terms. Once a second edition of this count exists, the page will carry the change from the previous month beside the current figure, so a reader who cites it can see direction as well as level. There’s no such line yet, because there’s no earlier count of this token to set against it.

When that line appears, the caveat travels with it. A rise means more domains published the record. A fall may mean deletions, expired registrations, or a TLD slipping under the three-domain threshold, and none of those says anything about what happened at the service.

Check your own zone

If you’re citing the figure, the useful thing to have alongside it is your own apex TXT set, because that’s the same surface it was counted on. The free scan reads the TXT records at the apex, lists what’s published there, and separates the authentication records from the verification tokens left behind by services you may or may not still use. It also grades the records that carry security weight, which the tokens don’t. Before you remove a token you don’t recognise, check whether the service still re-verifies against it; some do.

What else lives at your apex, and why an unattended record there matters more than it looks, is covered under DNS.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.