DNS Security Explained: Why 94 Million Domains Rely on Two Landlords

Published 2026-08-21

DNS security is the practice of protecting the Domain Name System — the public directory that turns your domain name into the servers that answer for your website and email — against three failure modes: tampering (integrity), outage (availability), and impersonation (authenticity). It is the layer beneath every other control, because a domain whose DNS can be redirected, forged, or knocked offline can have perfect email authentication and a flawless TLS certificate and still hand every visitor and every message to an attacker. The August 2026 defaults.exposed census scanned 432,127,908 domains and surfaced the single most under-appreciated fact in the field: roughly 94 million of the world’s nameservers sit under just two DNS landlords — GoDaddy and Cloudflare — a concentration that turns one provider incident into a shared, internet-scale outage. This guide explains what DNS security actually covers, the attacks it defends against, what our census found at scale, and a six-point checklist you can verify on your own domain for free.

Most people who search for “DNS security” are not looking for a definition — they are looking for the thing they have not checked yet. DNS is invisible when it works, which is exactly why its weaknesses go unaudited for years. The figures throughout come from the defaults.exposed August 2026 census, an independent scan of 432,127,908 domains graded as of 2026-08-16.

What “DNS Security” Actually Means: Integrity, Availability and Authenticity

The Domain Name System is the internet’s address book. When someone types your domain, a chain of DNS servers translates that name into the numeric address of your web server, the mail exchangers that receive your email (MX records), the text records that carry your email-authentication policies, and more. DNS is the first thing that happens in almost every connection — and it happens in the open, over a protocol designed in the 1980s with no built-in cryptography.

DNS security is not one product. It is three distinct properties, each with its own failure mode:

Integrity — the answer a user receives is the answer you published, unaltered. Without integrity protection, a forged response can send your visitors to an attacker’s server while your real records sit untouched. DNSSEC is the mechanism that provides it.
Availability — the name always resolves. If every server authoritative for your domain goes offline, your domain effectively ceases to exist: no website, no email, no way in. Redundant, diverse nameservers provide this.
Authenticity — the answer genuinely comes from the party that controls the zone, and the records themselves cannot be quietly repointed by someone who has taken over your registrar account. Registrar locks, strong access control, and monitoring provide it.

A domain can be strong on one and catastrophically weak on another. A site can have DNSSEC signatures (integrity) yet run on a single nameserver (no availability), or run on a redundant global network (availability) yet publish no DNSSEC at all (no integrity). Treating DNS security as a single checkbox is the first mistake; it is a small portfolio of independent controls.

The Attacks DNS Invites: Hijacking, Cache Poisoning and Dangling Takeover

Because DNS sits before every other control and answers by default in cleartext, it is a rich target. Four attack classes matter most.

DNS hijacking. An attacker gains control of your records — usually not by breaking DNS itself but by compromising the account that manages it: a registrar login with a weak password and no multi-factor, a reused credential, or a support-desk social-engineering call. Once in, they repoint your domain wherever they like: your website to a phishing clone, your MX records to intercept email, your TXT records to pass fraudulent domain-validation checks and mint TLS certificates in your name. This is the highest-impact DNS attack because it turns your own trusted name against you. We cover the mechanics in DNS hijacking and spoofing: how attackers steal domain records.

Cache poisoning. Resolvers cache answers to speed the web up. If an attacker can inject a forged answer into a resolver’s cache before the legitimate reply arrives, everyone using that resolver is sent to the wrong place — while your authoritative records remain perfectly correct, so nothing on your side looks wrong. This is the classic spoofing attack DNSSEC was designed to defeat: a validating resolver rejects the forged answer because it is not cryptographically signed by your zone.

Dangling takeover. A DNS record can point to a resource you no longer control. A CNAME aimed at a cloud bucket, a SaaS subdomain, or an app platform you have since deprovisioned becomes a “dangling” pointer. An attacker who re-registers that abandoned resource inherits your trusted subdomain — serving content, and sometimes cookies and certificates, under your name. The census surface for this is enormous, as the dark-matter finding below shows.

Availability attacks. A volumetric flood aimed at your authoritative nameservers, or a provider-side outage, removes your domain from the internet entirely for as long as it lasts. There is no “degraded mode” for a domain that cannot be resolved — it is simply gone. This is where nameserver diversity stops being best-practice pedantry and becomes the difference between a shrug and a total outage.

What DE’s Census Reveals: 94 Million Nameservers, Two Landlords

Zoom out from a single domain to the whole namespace and a different risk appears — not a flaw in any one domain, but a structural fragility in the system.

Across the 432,127,908 domains scanned in the August 2026 census, roughly 94 million nameservers resolve to just two operators: GoDaddy and Cloudflare. That is not a criticism of either — both run large, competent, redundant networks, and for most owners moving from a self-run single nameserver to either is a security upgrade. The systemic point is different: when a very large share of the internet’s name resolution depends on a small number of providers, a single misconfiguration, control-plane bug, or routing incident at one of them becomes a correlated, internet-scale event. Redundancy within one provider does not protect you from that provider itself having a bad day.

This is the DNS blind spot the “dns security” searcher almost never sees. You can do everything right inside your own account — DNSSEC on, registrar locked, records clean — and still share a single point of failure with tens of millions of unrelated domains. The mitigation is deliberate diversity: a secondary DNS provider on a different network and codebase, so that no single operator’s outage can take your name off the air. The full breakdown of who runs the world’s nameservers is in the companion report, The DNS Landlords: how GoDaddy and Cloudflare control nameservers for 94 million domains, and the grading logic is in the nameserver-diversity methodology.

Check your domain free at defaults.exposed — one scan reports your nameserver spread, your DNSSEC status, and your email-authentication posture together, so you can see in about 30 seconds whether your name resolution rests on a single operator.

DNSSEC: The Integrity Layer Almost Everyone Skips (and 157,064 Break)

DNSSEC — the DNS Security Extensions (RFC 4033–4035) — is the mechanism that gives DNS integrity and origin authenticity. It does not encrypt anything and it does not hide your records; it signs them. Each record set in a signed zone carries a cryptographic signature (RRSIG). A validating resolver checks that signature against your zone’s public key (DNSKEY), and it trusts that key because your parent zone — your TLD’s registry — publishes a matching DS (Delegation Signer) record that fingerprints it. That chain runs unbroken from the DNS root down to your domain. When it holds, a forged or poisoned answer is rejected because it cannot be signed by a key the chain vouches for.

That is the theory, and it is excellent. In practice, DNSSEC is skipped far more often than it is deployed, for three reasons that recur across every operations team:

Key management is unforgiving. Signatures expire. Keys must be rolled on a schedule. A DS record in the parent must be updated in lockstep with a key change in the child. Miss the coordination and validation fails.
The failure mode is severe and silent. A broken chain does not degrade gracefully — a validating resolver returns SERVFAIL, and the domain simply does not resolve for everyone behind a validating resolver (which includes major public resolvers). To the operator, whose own non-validating tools still work, the site looks fine while a large slice of users see nothing.
The upside is invisible. DNSSEC prevents an attack most owners have never personally experienced, so it loses the prioritisation contest to work with visible payoff.

The census makes the risk concrete. 157,064 domains publish broken DNSSEC — signatures are present but fail validation. This is strictly worse than publishing none: a domain with no DNSSEC resolves normally everywhere, while a domain with broken DNSSEC is invisibly down for every user on a validating resolver, and its owner is usually the last to know. We quantify that population in Broken DNSSEC: 157,064 domains are invisibly down, and the grading is split across the DNSSEC DS and DNSSEC DNSKEY methodology pages. If you enable DNSSEC, the deployment is only half the job — validating that the parent DS and child DNSKEY actually chain, and monitoring that they stay chained through every key roll, is the other half. For a plain-English walk-through of the trust chain, see What is DNSSEC? A plain-English guide to the DNS trust layer.

Availability: Single-Nameserver Fragility and 64 Million Domains of Dark Matter

Integrity keeps answers honest. Availability keeps them coming at all — and it is where the largest, quietest census finding lives.

Every domain should be served by at least two nameservers, ideally on separate networks so that no single outage removes them together. It is one of the oldest recommendations in DNS operations, and it exists because a domain with one nameserver is one incident — one crashed host, one routing blip, one expired billing line — from disappearing entirely. There is no partial outage: if the only nameserver stops answering, the website is gone, the email bounces, and there is no cached fallback once TTLs lapse. We measure how many domains live on this knife-edge in Single-nameserver domains: one record from oblivion.

Then there is the other end of the availability problem: names that resolve to nothing useful. The census found 63,840,407 domains — 14.8% of everything scanned — that are “dark matter”: delegated in DNS but serving no live content. Some are parked, some are abandoned, some are half-provisioned and never finished. The security relevance is the dangling-takeover surface described earlier: a delegated-but-empty domain, or a live domain with delegated-but-empty subdomains pointing at deprovisioned third-party resources, is exactly where an attacker looks to inherit a trusted name. Sixty-four million domains of dark matter is not idle real estate — it is unattended attack surface. The full analysis is in Domain dark matter: 64 million delegated, empty domains.

Underneath both problems sits the most-neglected record of all — the SOA (Start of Authority), which governs how secondaries refresh and how long failures are cached. Misconfigured SOA timers turn a short provider blip into a long outage. The grading detail is in the SOA configuration methodology.

A 6-Point DNS Security Checklist You Can Verify Today (Free)

You do not need a project to make measurable progress on DNS security. Six controls cover the large majority of real-world risk, and every one of them is visible from public DNS — which means you can verify your own posture, and an attacker can too, without any access to your systems.

Run at least two nameservers on diverse networks — ideally two providers. This is the single most valuable availability control, and the direct mitigation for the 94-million-domain concentration risk. A secondary DNS provider on a different codebase means no single operator’s outage takes you offline. Verify with the nameserver-diversity methodology.
Enable DNSSEC — and confirm the chain validates. Signing your zone is step one; confirming the parent DS record chains to your DNSKEY, and that neither has an expired signature, is what actually delivers integrity. A broken chain is worse than no DNSSEC at all.
Lock the registrar and the account. Enforce multi-factor authentication on the registrar login, enable registry/registrar lock so records cannot be transferred or repointed without an out-of-band step, and restrict who can edit the zone. Most hijacks are account compromises, not protocol breaks.
Publish a CAA record. A Certification Authority Authorization record tells the world which CAs may issue certificates for your domain, closing off mis-issuance from every other CA. The census found 98.9% of domains never restrict their CA — one short DNS record fixes it. See the CAA-record methodology.
Get your email-authentication DNS right. SPF, DKIM and DMARC all live in DNS, and they are how you stop your domain being forged in email. Across the email-graded base, 90.7% of domains publish no enforcing DMARC — an enormous, DNS-resident gap. Start at the DMARC-policy methodology.
Audit for dangling and dark-matter records. Remove CNAME/NS/A records that point to resources you no longer control, and retire delegated subdomains you have finished with. Every one is a potential takeover.

Check your domain free at defaults.exposed surfaces items 1, 2, 4 and 5 in a single scan; if you want continuous monitoring so a broken key roll or a repointed record is caught the day it happens rather than months later, see how continuous DNS monitoring works.

What This Means

For IT and infrastructure teams, DNS security is not a feature you buy once but a small set of independent properties you keep true over time. The census pattern is clear: integrity (DNSSEC) is skipped or, worse, half-deployed and quietly broken across 157,064 domains; availability rests for tens of millions of domains on a single operator; and the largest single failure class is neglect, not attack — 64 million domains sitting as unattended dark matter. The work is not hard in any individual step; it is a coordination and monitoring discipline. Signing a zone is easy. Keeping the parent DS chained through every key roll, keeping a secondary provider in sync, and catching a repointed record before your users do — that is the job.

For business owners, the practical stake is that DNS is the one layer that, if compromised, defeats everything else you paid for. An attacker who controls your DNS can redirect your customers to a fake site, silently reroute your inbound email, and even obtain a valid TLS certificate in your name — all while your website and your inbox look normal to you. The defences are cheap and mostly free: turn on multi-factor authentication at your registrar, ask your provider to enable DNSSEC and a registry lock, and add a one-line CAA record. None of it requires an engineering project, and the cost of skipping it is your entire online presence at once.

FAQ

What is DNS security? DNS security is the set of controls that protect the Domain Name System — the public directory mapping your domain to its web servers, mail servers and policy records — against tampering, outage and impersonation. In practice it means three things: integrity (answers arrive unaltered, provided by DNSSEC), availability (the name always resolves, provided by redundant nameservers), and authenticity (only you can change your records, protected by registrar locks and access control). It is the foundational layer, because a domain whose DNS is compromised can have perfect email and TLS and still route every visitor to an attacker. The August 2026 census found roughly 94 million nameservers concentrated under just two providers — a systemic availability risk most owners never check.

Why is DNS security important? Because DNS runs before every other control, a weakness there defeats everything downstream. An attacker who redirects your DNS can serve a phishing clone of your site, intercept your inbound email by repointing MX records, and even mint a valid TLS certificate for your domain by passing DNS-based validation — all while your own systems appear untouched. The scale of neglect is the argument: the census found 157,064 domains with broken DNSSEC (invisibly down for validating users), 63,840,407 domains sitting as unattended “dark matter,” and 90.7% of email-graded domains with no enforcing DMARC. DNS is the cheapest layer to secure and the most expensive to lose.

What is DNS in cyber security? In cyber security, DNS is treated as both critical infrastructure and a common attack path. It is critical because name resolution is a prerequisite for nearly every connection: no DNS, no service. It is an attack path because the protocol answers in cleartext by default and its records can be forged (cache poisoning), redirected (registrar or account hijacking), abandoned into takeover targets (dangling records), or flooded offline (availability attacks). Defenders harden DNS with DNSSEC for integrity, redundant and diverse nameservers for availability, registrar locks and MFA for authenticity, and CAA records to constrain certificate issuance. The census shows these controls remain the exception, not the rule — for example, 98.9% of domains never restrict which certificate authority may issue for them.

How do I secure DNS? Work through six controls, all verifiable from public DNS: run at least two nameservers on diverse networks (ideally two providers) to remove single points of failure; enable DNSSEC and confirm the parent DS record chains to your DNSKEY without expired signatures; lock your registrar account with MFA and a registry lock; publish a CAA record to constrain certificate issuance; get SPF, DKIM and enforcing DMARC right, since all three live in DNS; and audit for dangling or dark-matter records pointing at resources you no longer control. Check your domain free at defaults.exposed to see your nameserver spread, DNSSEC status and email-authentication posture in one scan, then fix the gaps it names.

Data to cite

“Roughly 94 million of the world’s nameservers sit under two DNS landlords, GoDaddy and Cloudflare, concentrating name resolution for a large share of the internet on two operators.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“157,064 domains publish broken DNSSEC — signatures present but failing validation — leaving them invisibly down for every user on a validating resolver, a state strictly worse than publishing no DNSSEC at all.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“63,840,407 domains — 14.8% of all scanned — are ‘dark matter’: delegated in DNS but serving nothing, an unattended dangling-takeover surface.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“341,945,132 domains — 90.7% of the 376,928,750 email-graded — publish no enforcing DMARC, an authentication gap that lives entirely in DNS.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“Only 34,983,618 domains (9.3%) enforce DMARC, and just 10,902,284 (2.9%) are fully protected with SPF, DKIM and an enforcing DMARC policy together.” — defaults.exposed August 2026 Domain Security Census (432M domains)

See where your own domain stands

DNS security fails quietly. A broken DNSSEC chain, a single overloaded nameserver, a subdomain pointing at a resource you deleted last year — none of it shows up in your inbox or your browser until the day it becomes an incident. The whole point of checking is to see the gap before an attacker does, and the check costs nothing.

Check your domain free at defaults.exposed — it reads your live DNS straight from the public record and reports your nameserver spread, your DNSSEC status, your CAA and email-authentication posture, and the grade that follows from them. It takes about 30 seconds and needs no account. If you want those gaps closed and kept closed — DNSSEC validated through every key roll, a secondary provider in place, records audited for dangling takeover — see how continuous DNS monitoring works.

Read the flagship census report: The State of Domain Security 2026 →

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 432,127,908 domains scanned; 376,928,750 graded on email authentication; 284,598,752 on overall posture. All figures are counts of graded domains. References: RFC 1034/1035 (DNS), RFC 4033–4035 (DNSSEC), RFC 8659 (CAA), RFC 7489 (DMARC).

How to cite this report

Press / blog: defaults.exposed (2026). DNS Security Explained: Why 94 Million Domains Rely on Two Landlords. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/v9/articles/dns-security-explained-why-94-million-domains-rely-on-two-landlords

Academic: defaults.exposed. (2026, August 21). DNS Security Explained: Why 94 Million Domains Rely on Two Landlords. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/v9/articles/dns-security-explained-why-94-million-domains-rely-on-two-landlords

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=432,127,908 domains scanned)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/v9/methodology Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Data sourced from the August 2026 grading methodology (v9) — 34 checks, 376 million domains. Browse the census statistics or the Census Explorer, or see all August 2026 research →