iPGaze

Research · August 2026

Who Runs DNS for the Top 10,000 Domains (August 2026)

We read the delegated nameservers of 10,000 of the web's most-linked domains; 9,751 returned a delegation. Cloudflare and AWS Route 53 serve 42.3% of them between them, and almost nobody has a second provider to fall back on.

on Cloudflare
24%
on AWS Route 53
18.3%
on the top five
55.6%
use a second provider
1.5%

Percentages are of the 9,751 domains that returned a nameserver delegation.

Who serves the zones

Share of domains by DNS operator
  • Cloudflare24% (2,344)
  • AWS Route 5318.3% (1,785)
  • Akamai5.8% (566)
  • Google4.4% (428)
  • Alibaba Cloud3.1% (299)
  • NS12.3% (227)
  • Azure DNS1.8% (179)
  • UltraDNS1.2% (121)
  • GoDaddy1.1% (107)
  • DNS Made Easy0.9% (84)

A further 34.2% (3,330 domains) matched no known operator — mostly self-hosted zones or providers too small to have a recognisable nameserver signature. That bucket is excluded from the concentration figures below, because it is not a company.

27 distinct operators appear in the sample, but the distribution is steep: the largest serves 24%, the top three 48.1%, the top five 55.6% and the top ten 63%. Everything after that is a long tail of single-digit-thousand counts.

Read the operator names as “whose nameservers answer for this zone”, not “who the customer pays”. A domain registered anywhere can point its NS records at Cloudflare or Route 53, and many do — which is precisely why the concentration is higher than registrar market share would suggest.

Almost nobody has a second provider

Only 1.5% of these domains — 144 of 9,751 — delegate to more than one operator. The rest have every authoritative nameserver inside a single company's infrastructure.

That matters more than the raw market share. Nameserver redundancy within one provider protects against a single server failing; it does nothing when the provider itself has a control-plane or routing incident, which is the failure mode that actually takes large parts of the web offline. A genuinely redundant setup means NS records at two independent operators, which is operationally harder — it needs zone data kept in sync, and DNSSEC across two providers needs multi-signer support.

Number of authoritative nameservers per domain
  • 2 nameservers40.3% (3,932)
  • 3 nameservers8.9% (869)
  • 4 nameservers34.2% (3,336)
  • 5 nameservers3.5% (342)
  • 6 nameservers8% (784)
  • 7 nameservers0.9% (92)
  • 8 nameservers3% (294)

Two nameservers is the most common configuration and the bare minimum the RFCs contemplate. Four is the next cluster, which is what the large managed providers hand out by default — so a domain with four nameservers usually has four names belonging to one operator, not four independent ones.

TTLs: cautious at the edge, slow at the delegation

Time-to-live of the A record
  • under 5 min40.1% (3,719)
  • 5–60 min43.6% (4,047)
  • 1–24 h13.5% (1,254)
  • 24 h or more2.8% (260)
Time-to-live of the NS delegation
  • under 5 min2% (192)
  • 5–60 min12.1% (1,181)
  • 1–24 h23.6% (2,301)
  • 24 h or more62.3% (6,077)

The two distributions point in opposite directions, and both are rational. Address records skew short — most sit under an hour — because that is the record you need to move quickly during a failover or a migration. Delegations skew long, with 62.3% at a day or more, because nameservers rarely change and a long TTL there reduces load on the parent zone.

The practical consequence is worth knowing before you plan a migration: lowering your A record TTL the day before a cutover works, but lowering your NS TTL does not help nearly as fast, because resolvers may hold the old delegation for as long as the parent said they could.

Check your own domain

Every lookup behind this study is available as a free tool:

Methodology

On 2026-08-08 we took the top 10,000 domains from the Majestic Million list — ranked by the number of distinct referring subnets, so it reflects how widely a domain is linked rather than raw traffic — and issued three DNS-over-HTTPS queries per domain: NS, SOA and A. 9,751 returned a delegation; the remainder failed to resolve or returned no NS records and are excluded rather than counted as unknown.

Operators are inferred from the nameserver hostname against a list of known signatures. Each domain is counted once, against the first recognised operator among its nameservers. Zones whose nameservers match no signature are grouped as self-hosted or other and reported separately — folding that bucket into the ranking would let a collection of unrelated zones appear as the single largest provider, which would be false.

Two limits worth stating. Signature matching undercounts smaller providers, so the long tail is almost certainly more fragmented than it looks here rather than less. And a domain delegated to one operator may still sit behind another company's CDN or mail infrastructure; this study measures who answers authoritative DNS queries, nothing more.

These figures are free to cite or reproduce with attribution and a link to this page. Data collected ; we re-run the scan periodically and update the numbers in place.