{
  "month": "2026-06",
  "title": "Monthly Observatory Brief - June 2026",
  "period_label": "June 2026",
  "status": "published",
  "publication": {
    "status": "published",
    "published_at": "2026-07-03",
    "updated_at": "2026-07-07",
    "update_note": "auDA June 2026 registry context added after initial publication."
  },
  "collection_health": {
    "collector_runs": 186,
    "successful_runs": 186,
    "partial_runs": 0,
    "failed_runs": 0,
    "running_runs": 0,
    "domain_observations_attempted": 3100,
    "domain_observations_succeeded": 3100,
    "domain_observations_failed": 0,
    "snapshot_rows_written": 3100,
    "event_rows_written": 929,
    "rdap_fallback_count": 0,
    "dns_error_count": 0,
    "rdap_error_count": 28,
    "first_run_started_at": "2026-05-31T18:15:17.668851+00:00",
    "last_run_completed_at": "2026-06-29T19:19:53.966547+00:00"
  },
  "history_context": {
    "first_collector_run": "2026-03-20T10:53:22.847545+00:00",
    "latest_collector_run": "2026-06-30T19:08:21.263248+00:00",
    "observed_run_days": 104,
    "collector_runs": 661,
    "successful_runs": 652
  },
  "monthly_summary": {
    "observatory_events": 929,
    "affected_domains": 54,
    "tier_1_events": 84,
    "tier_2_events": 6,
    "tier_3_events": 839,
    "unclassified_events": 0,
    "routine_churn_events": 839,
    "routine_address_churn_domains": 35
  },
  "comparison": {
    "may_2026": {
      "observatory_events": 962,
      "affected_domains": 57,
      "tier_1_events": 123,
      "tier_2_events": 17,
      "tier_3_events": 822,
      "unclassified_events": 0,
      "routine_churn_events": 822,
      "routine_address_churn_domains": 31
    },
    "june_2026": {
      "observatory_events": 929,
      "affected_domains": 54,
      "tier_1_events": 84,
      "tier_2_events": 6,
      "tier_3_events": 839,
      "unclassified_events": 0,
      "routine_churn_events": 839,
      "routine_address_churn_domains": 35
    }
  },
  "signal_families": [
    {
      "signal_family": "Address-record churn",
      "may_events": 822,
      "june_events": 839,
      "june_affected_domains": 35
    },
    {
      "signal_family": "Mail posture",
      "may_events": 63,
      "june_events": 15,
      "june_affected_domains": 5
    },
    {
      "signal_family": "Provider and infrastructure movement",
      "may_events": 52,
      "june_events": 44,
      "june_affected_domains": 5
    },
    {
      "signal_family": "RDAP and registration signals",
      "may_events": 25,
      "june_events": 31,
      "june_affected_domains": 22
    }
  ],
  "higher_signal_movement": [
    {
      "event_type": "nameservers_changed",
      "public_label": "Nameservers changed",
      "tier": "tier_1",
      "event_count": 42,
      "affected_domains": 5
    },
    {
      "event_type": "rdap_status_changed",
      "public_label": "RDAP status changed",
      "tier": "tier_1",
      "event_count": 31,
      "affected_domains": 22
    },
    {
      "event_type": "mx_changed",
      "public_label": "MX changed",
      "tier": "tier_1",
      "event_count": 7,
      "affected_domains": 4
    },
    {
      "event_type": "spf_present_changed",
      "public_label": "SPF visibility changed",
      "tier": "tier_1",
      "event_count": 3,
      "affected_domains": 2
    },
    {
      "event_type": "dmarc_present_changed",
      "public_label": "DMARC visibility changed",
      "tier": "tier_1",
      "event_count": 1,
      "affected_domains": 1
    },
    {
      "event_type": "email_provider_changed",
      "public_label": "Email provider changed",
      "tier": "tier_2",
      "event_count": 4,
      "affected_domains": 3
    },
    {
      "event_type": "dns_provider_changed",
      "public_label": "DNS provider changed",
      "tier": "tier_2",
      "event_count": 1,
      "affected_domains": 1
    },
    {
      "event_type": "hosting_move_signal",
      "public_label": "Hosting or CDN movement",
      "tier": "tier_2",
      "event_count": 1,
      "affected_domains": 1
    }
  ],
  "month_end_posture": {
    "dnssec_visible": {
      "end_may": 15,
      "end_june": 15
    },
    "secure_delegation_asserted": {
      "end_may": 13,
      "end_june": 13
    },
    "dnskey_observed": {
      "end_may": 8,
      "end_june": 8
    },
    "mx_present": {
      "end_may": 95,
      "end_june": 94
    },
    "spf_visible": {
      "end_may": 99,
      "end_june": 98
    },
    "dmarc_visible": {
      "end_may": 98,
      "end_june": 97
    },
    "dns_provider_known": {
      "end_may": 100,
      "end_june": 100
    },
    "email_provider_known": {
      "end_may": 95,
      "end_june": 94
    },
    "registrar_known": {
      "end_may": 99,
      "end_june": 99
    }
  },
  "cohort_summary": [
    {
      "cohort": "education-watchlist",
      "domains": 10,
      "events": 36,
      "affected_domains": 6,
      "tier_1": 36,
      "tier_2": 0,
      "routine_churn": 0,
      "events_per_domain": 3.6,
      "public_note": "Higher-signal nameserver and RDAP status movement appeared in this cohort."
    },
    {
      "cohort": "namespace-diversity",
      "domains": 1,
      "events": 2,
      "affected_domains": 1,
      "tier_1": 2,
      "tier_2": 0,
      "routine_churn": 0,
      "events_per_domain": 2.0,
      "public_note": "Small cohort; both visible events were higher-signal movement."
    },
    {
      "cohort": "media-watchlist",
      "domains": 8,
      "events": 185,
      "affected_domains": 4,
      "tier_1": 10,
      "tier_2": 0,
      "routine_churn": 175,
      "events_per_domain": 23.13,
      "public_note": "High event volume, dominated by address-record churn."
    },
    {
      "cohort": "nfp-watchlist",
      "domains": 15,
      "events": 66,
      "affected_domains": 11,
      "tier_1": 17,
      "tier_2": 3,
      "routine_churn": 46,
      "events_per_domain": 4.4,
      "public_note": "Mixed higher-signal, infrastructure and routine movement."
    },
    {
      "cohort": "legal-watchlist",
      "domains": 1,
      "events": 1,
      "affected_domains": 1,
      "tier_1": 1,
      "tier_2": 0,
      "routine_churn": 0,
      "events_per_domain": 1.0,
      "public_note": "One higher-signal movement was visible in this one-domain cohort."
    },
    {
      "cohort": "finance-watchlist",
      "domains": 8,
      "events": 86,
      "affected_domains": 4,
      "tier_1": 6,
      "tier_2": 2,
      "routine_churn": 78,
      "events_per_domain": 10.75,
      "public_note": "Mostly address-record churn with some higher-signal and infrastructure movement."
    },
    {
      "cohort": "telecom-watchlist",
      "domains": 4,
      "events": 17,
      "affected_domains": 3,
      "tier_1": 3,
      "tier_2": 0,
      "routine_churn": 14,
      "events_per_domain": 4.25,
      "public_note": "Small-volume movement, mostly routine churn with limited higher-signal movement."
    },
    {
      "cohort": "critical-infrastructure",
      "domains": 25,
      "events": 189,
      "affected_domains": 8,
      "tier_1": 6,
      "tier_2": 0,
      "routine_churn": 183,
      "events_per_domain": 7.56,
      "public_note": "Routine address-record churn dominated; limited higher-signal movement was also visible."
    },
    {
      "cohort": "saas-watchlist",
      "domains": 5,
      "events": 32,
      "affected_domains": 2,
      "tier_1": 1,
      "tier_2": 0,
      "routine_churn": 31,
      "events_per_domain": 6.4,
      "public_note": "Visible movement was mostly routine address-record churn."
    },
    {
      "cohort": "commercial-watchlist",
      "domains": 14,
      "events": 302,
      "affected_domains": 10,
      "tier_1": 2,
      "tier_2": 1,
      "routine_churn": 299,
      "events_per_domain": 21.57,
      "public_note": "High event volume, mostly address-record movement."
    },
    {
      "cohort": "healthcare-watchlist",
      "domains": 1,
      "events": 8,
      "affected_domains": 1,
      "tier_1": 0,
      "tier_2": 0,
      "routine_churn": 8,
      "events_per_domain": 8.0,
      "public_note": "One-domain cohort with routine address-record churn only."
    },
    {
      "cohort": "platform-hosted",
      "domains": 3,
      "events": 4,
      "affected_domains": 2,
      "tier_1": 0,
      "tier_2": 0,
      "routine_churn": 4,
      "events_per_domain": 1.33,
      "public_note": "Low-volume movement; all visible events were routine churn."
    },
    {
      "cohort": "smb-watchlist",
      "domains": 4,
      "events": 1,
      "affected_domains": 1,
      "tier_1": 0,
      "tier_2": 0,
      "routine_churn": 1,
      "events_per_domain": 0.25,
      "public_note": "One routine-churn event was visible in this cohort."
    },
    {
      "cohort": "founder-surface",
      "domains": 1,
      "events": 0,
      "affected_domains": 0,
      "tier_1": 0,
      "tier_2": 0,
      "routine_churn": 0,
      "events_per_domain": 0.0,
      "public_note": "No observatory events were recorded for this cohort during June."
    }
  ],
  "auda_context": {
    "status": "current",
    "target_month": "2026-06",
    "registry_month": "2026-06",
    "source": "auDA Registry Monthly Statistics",
    "source_url": "https://files.auda.org.au/documents/Registry-Monthly-Stats-June-2026.pdf",
    "total_names_under_management": 4387430,
    "total_new_domains": 66824,
    "panel_per_million": 22.8,
    "note": "June 2026 auDA Registry Monthly Statistics are included as external namespace context."
  },
  "limitations": [
    "The fixed .auDO panel is an observation panel, not a representative sample of the whole .au namespace.",
    "The brief is a descriptive observation, not a score, benchmark, risk rating, compliance assessment, market-share claim, whole-namespace finding or allegation.",
    "auDA June 2026 registry context added after initial publication - registry statistics are external namespace context only.",
    "Routine address-record churn is retained as evidence but should not dominate interpretation."
  ]
}