{
  "slug": "observed-infrastructure-concentration-context",
  "title": "Observed: infrastructure concentration in context",
  "subtitle": "Featured · .au Domain Observatory · 26 May 2026",
  "published_at": "2026-05-26T09:00:00+10:00",
  "report_type": "featured",
  "series": "observations",
  "status": "published",
  "summary": "Across the fixed 100-domain .au panel, DNS, email, and registrar dependencies continue to cluster around a small number of providers. This featured report places the observed concentration alongside the public record on resolver centralisation, large-provider operational events, and the root- and trust-anchor layers that sit above the .au namespace.",
  "href": "/reports/featured/observed-infrastructure-concentration-context/",
  "tags": [
    "Featured",
    "Infrastructure",
    "DNS",
    "Concentration",
    "Observations"
  ],
  "source": {
    "daily_report_date": "2026-05-26",
    "daily_manifest_path": "/data/report_manifests/2026-05-26.json",
    "analysis_manifest_path": "/data/analysis_manifests/2026-05-26.json",
    "observation_window_start": "2026-03-26",
    "observation_window_end": "2026-05-26",
    "collector_runs": 62,
    "panel_size": 100,
    "cohort_count": 14,
    "note": "Concentration figures are read from the same panel-normalised posture extract used in the 30-day featured report. The pattern is durable across the extended observation window; this report adds context from the public record, not new measurement."
  },
  "metrics": {
    "infrastructure_concentration": {
      "dns_providers": [
        { "provider": "Amazon Route53", "domain_count": 20, "share_pct": 19.8 },
        { "provider": "Akamai / Edge DNS", "domain_count": 19, "share_pct": 18.8 },
        { "provider": "Cloudflare", "domain_count": 11, "share_pct": 10.9 },
        { "provider": "Organisation-managed / Self-hosted DNS", "domain_count": 9, "share_pct": 8.9 },
        { "provider": "Azure DNS", "domain_count": 9, "share_pct": 8.9 }
      ],
      "email_providers": [
        { "provider": "Microsoft 365", "domain_count": 38, "share_pct": 37.6 },
        { "provider": "Proofpoint", "domain_count": 16, "share_pct": 15.8 },
        { "provider": "Google Workspace", "domain_count": 13, "share_pct": 12.9 },
        { "provider": "Mimecast", "domain_count": 11, "share_pct": 10.9 }
      ],
      "registrars": [
        { "provider": "Corporation Service Company (Aust) Pty Ltd", "domain_count": 35, "share_pct": 34.7 },
        { "provider": "Domain Directors Pty Ltd trading as Instra", "domain_count": 12, "share_pct": 11.9 },
        { "provider": "Melbourne IT", "domain_count": 12, "share_pct": 11.9 },
        { "provider": "Education Services Australia Limited", "domain_count": 10, "share_pct": 9.9 }
      ],
      "clarification": "Concentration is an observation, not a finding of weakness. A small number of providers carry a large share of the observed authoritative DNS, mail, and registrar relationships across the panel. The same providers also appear across the wider internet, which is the reason this pattern is worth surfacing rather than treating as panel-specific."
    }
  },
  "key_points": [
    "On the fixed 100-domain .au panel, the top three authoritative DNS providers account for roughly half of observed domains; the top email provider accounts for over a third; the top registrar accounts for over a third.",
    "The pattern is consistent across the full observation window (26 March to 26 May 2026) and matches the shape reported at the 30-day mark.",
    "APNIC measurement work on resolver-side concentration shows that recursive DNS is similarly clustered globally, which is the layer that returns the answers our panel domains publish.",
    "Public operational records from large providers in late 2025 illustrate that visible concentration is correlated with shared-incident reach, not an assertion about any specific provider on the panel.",
    "The .au namespace sits beneath the IANA root zone and the IANA DNSSEC trust anchors. Concentration at the provider layer is observable; the root and trust-anchor layers above it are managed and published separately by IANA.",
    "Routing-layer assurance (RPKI) sits alongside DNS as part of the wider resilience picture. .auDO does not measure routing; the link is included to show where DNS-layer observation stops."
  ],
  "callouts": [
    {
      "type": "observation-note",
      "title": "Concentration is durable, not new",
      "text": "Across two months of continuous observation, the shape of provider concentration on the panel has not shifted. A small number of providers continue to carry a large share of authoritative DNS, mail, and registrar relationships."
    },
    {
      "type": "interpretation-note",
      "title": "Concentration is a visibility pattern, not a verdict",
      "text": "Provider clustering is a feature of how the modern .au namespace operates. .auDO records where dependencies cluster so that the pattern is legible. It does not rank providers, attribute behaviour, or assert that concentration is itself a problem."
    },
    {
      "type": "governance-note",
      "title": "Where DNS-layer observation stops",
      "text": "The observatory sees authoritative-side answers and the posture domains publish. It does not see recursive resolver behaviour, routing-layer state, or the IANA-managed layers above the namespace. Those layers are referenced through the public record, not measured here."
    },
    {
      "type": "clarification",
      "title": "Observation, not attribution",
      "text": "Naming providers reflects what is publicly resolvable from the panel. It is not a statement about any provider's operations, security posture, or suitability. Interpretation requires reading the figures alongside the sources listed below."
    }
  ],
  "sources": [
    {
      "title": "Root Zone Database - delegation record for .AU",
      "publisher": "IANA",
      "url": "https://www.iana.org/domains/root/db/au.html",
      "date": "2024-08-08",
      "relevance": "Public delegation record for the .au top-level domain. Establishes the layer above the panel that the observatory does not measure directly."
    },
    {
      "title": "DNSSEC trust anchors and KSK rollover",
      "publisher": "IANA",
      "url": "https://www.iana.org/dnssec/files",
      "date": "2026-05-01",
      "relevance": "Source for the published root trust anchors. Provides the reference layer behind any DNSSEC observation made on the panel."
    },
    {
      "title": "DNS resolver concentration (OARC measurement)",
      "publisher": "APNIC Labs",
      "url": "https://labs.apnic.net/presentations/store/2023-02-16-OARC-resolver-concentration.pdf",
      "date": "2023-02-16",
      "relevance": "Independent measurement showing that recursive resolution is clustered across a small number of large providers. Counterpart to the authoritative-side concentration the observatory records on the panel."
    },
    {
      "title": "18 November 2025 outage post-mortem",
      "publisher": "Cloudflare",
      "url": "https://blog.cloudflare.com/18-november-2025-outage/",
      "date": "2025-11-18",
      "relevance": "Public operational record from a provider that appears in the observed panel concentration set. Illustrates the kind of shared-incident reach that concentration produces; included as context, not as commentary on the provider."
    },
    {
      "title": "RPKI invalid prefixes - hidden causes and routing risk",
      "publisher": "CableLabs",
      "url": "https://www.cablelabs.com/blog/exploring-the-hidden-causes-and-security-risks-of-rpki-invalid-prefixes",
      "date": "2026-03-01",
      "relevance": "Routing-layer assurance reference. Marks where DNS-layer observation stops and where adjacent resilience disciplines (BGP, RPKI) continue."
    },
    {
      "title": "1.1.1.1 public resolver privacy policy (caveat)",
      "publisher": "Cloudflare",
      "url": "https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/",
      "date": "2026-05-01",
      "relevance": "Caveat. Cited to acknowledge that recursive resolver behaviour is governed by separate published policies that .auDO does not observe."
    },
    {
      "title": "Measuring the use of DNS over IPv6 (measurement caveat)",
      "publisher": "APNIC Blog",
      "url": "https://blog.apnic.net/2026/03/02/measuring-the-use-of-dns-over-ipv6/",
      "date": "2026-03-02",
      "relevance": "Caveat. Independent discussion of measurement uncertainty in DNS observation, including the IPv6 path. Provides context for the limits of any single panel-based reading."
    }
  ],
  "seo": {
    "title": "Observed: infrastructure concentration in context | .auDo",
    "description": ".au Domain Observatory featured report on 26 May 2026: provider concentration across DNS, email, and registrars on the fixed 100-domain .au panel, placed alongside the public record on resolver concentration, large-provider operational events, and the root and trust-anchor layers above the namespace."
  }
}