{
  "report_contract_version": "monthly-observatory-brief/v2",
  "month": "2026-08",
  "title": "Monthly Observatory Brief - August 2026",
  "period_label": "August 2026",
  "status": "published",
  "publication": {
    "status": "published",
    "prepared_at": "2026-09-01",
    "published_at": "2026-09-01",
    "updated_at": null,
    "update_note": null
  },
  "monthly_readout": [
    "Repeated observation exposed nameserver variability that a point-in-time check would not show as a longitudinal pattern: 43 structured nameserver-change rows were recorded across five domains, with 40 concentrated in three domains where recurring nameserver sets alternated during the month.",
    "Most recorded activity was routine address churn: 928 of 1,039 observatory event rows were A/AAAA changes. After evidence qualification, 103 rows across 34 domains remained in the supported-movement review population.",
    "At the final August observation, MX, SPF and DMARC evidence was determinate for 98 of the 100 panel domains. MX was visible for 94, a single SPF record was observed for 84 and a valid DMARC record for 97."
  ],
  "observed_activity": {
    "status": "qualified",
    "recorded_event_rows": 1039,
    "affected_domains": 44,
    "affected_domains_status": "published",
    "supported_movement_rows": 103,
    "supported_movement_domains": 34,
    "routine_or_low_confidence_rows": 928,
    "routine_or_low_confidence_domains": 29,
    "legacy_dns_sensitive_event_rows": 33,
    "note": "Recorded event rows preserve the full observatory record. Routine A/AAAA churn and first-day pre-structured DNS evidence remain visible in the accounting but do not become stronger public movement claims merely because they were stored."
  },
  "cohort_context": {
    "status": "qualified",
    "membership_model": "canonical_published_cohorts",
    "membership_effective_from": "2026-07-01",
    "overlap_note": "A domain may appear in more than one analytical cohort. Cohort membership totals therefore do not sum to the fixed panel size.",
    "rows": [
      {
        "id": "government",
        "title": "Australian government domains",
        "denominator": 14,
        "overlapping_membership": false,
        "recorded_event_rows": 0,
        "domains_with_recorded_activity": 0,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 0,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 0,
        "domains_with_supported_movement": 0,
        "routine_or_low_confidence_rows": 0,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "nfp",
        "title": "Australian not-for-profit domains",
        "denominator": 16,
        "overlapping_membership": false,
        "recorded_event_rows": 8,
        "domains_with_recorded_activity": 5,
        "legacy_dns_sensitive_event_rows": 6,
        "material_movement_rows": 1,
        "supporting_movement_rows": 1,
        "supported_movement_rows": 2,
        "domains_with_supported_movement": 1,
        "routine_or_low_confidence_rows": 0,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "education",
        "title": "Australian higher education domains",
        "denominator": 10,
        "overlapping_membership": false,
        "recorded_event_rows": 569,
        "domains_with_recorded_activity": 8,
        "legacy_dns_sensitive_event_rows": 1,
        "material_movement_rows": 39,
        "supporting_movement_rows": 1,
        "supported_movement_rows": 40,
        "domains_with_supported_movement": 6,
        "routine_or_low_confidence_rows": 528,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "media",
        "title": "Australian media domains",
        "denominator": 8,
        "overlapping_membership": false,
        "recorded_event_rows": 102,
        "domains_with_recorded_activity": 8,
        "legacy_dns_sensitive_event_rows": 2,
        "material_movement_rows": 13,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 13,
        "domains_with_supported_movement": 8,
        "routine_or_low_confidence_rows": 87,
        "legacy_dns_sensitive_not_supported_rows": 2
      },
      {
        "id": "commercial",
        "title": "Retail and marketplace domains",
        "denominator": 14,
        "overlapping_membership": false,
        "recorded_event_rows": 89,
        "domains_with_recorded_activity": 11,
        "legacy_dns_sensitive_event_rows": 4,
        "material_movement_rows": 17,
        "supporting_movement_rows": 3,
        "supported_movement_rows": 20,
        "domains_with_supported_movement": 9,
        "routine_or_low_confidence_rows": 65,
        "legacy_dns_sensitive_not_supported_rows": 4
      },
      {
        "id": "financial-services",
        "title": "Financial services domains",
        "denominator": 8,
        "overlapping_membership": false,
        "recorded_event_rows": 32,
        "domains_with_recorded_activity": 4,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 13,
        "supporting_movement_rows": 1,
        "supported_movement_rows": 14,
        "domains_with_supported_movement": 3,
        "routine_or_low_confidence_rows": 18,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "public-interest",
        "title": "Public-interest domains",
        "denominator": 21,
        "overlapping_membership": true,
        "recorded_event_rows": 20,
        "domains_with_recorded_activity": 10,
        "legacy_dns_sensitive_event_rows": 1,
        "material_movement_rows": 14,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 14,
        "domains_with_supported_movement": 10,
        "routine_or_low_confidence_rows": 5,
        "legacy_dns_sensitive_not_supported_rows": 1
      },
      {
        "id": "software-platforms",
        "title": "Australian software platforms",
        "denominator": 5,
        "overlapping_membership": false,
        "recorded_event_rows": 1,
        "domains_with_recorded_activity": 1,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 1,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 1,
        "domains_with_supported_movement": 1,
        "routine_or_low_confidence_rows": 0,
        "legacy_dns_sensitive_not_supported_rows": 0
      }
    ],
    "note": "Cohort counts are descriptive analytical lenses. Supported-event volume is not used to rank cohorts because repeated observations can concentrate within a small number of domains."
  },
  "month_end_posture": {
    "status": "published",
    "as_of": "2026-08-31T05:57:07.554061+10:00",
    "latest_run_date": "2026-08-31",
    "panel_denominator": 100,
    "comparison_status": "qualified",
    "metrics": [
      {
        "id": "dnssec_visible",
        "label": "DNSSEC visible",
        "count": 15
      },
      {
        "id": "mx_visible",
        "label": "MX visible",
        "count": 94
      },
      {
        "id": "spf_visible",
        "label": "SPF visible",
        "count": 98
      },
      {
        "id": "dmarc_visible",
        "label": "DMARC visible",
        "count": 97
      },
      {
        "id": "dns_provider_classified",
        "label": "DNS provider classified",
        "count": 100
      },
      {
        "id": "email_provider_classified",
        "label": "Email provider classified",
        "count": 94
      },
      {
        "id": "rdap_available",
        "label": "RDAP available",
        "count": 99
      },
      {
        "id": "registrar_visible",
        "label": "Registrar visible",
        "count": 99
      }
    ],
    "source": "data/state/index.json",
    "note": "Counts preserve the final generated 31 August State snapshot. Live State pages continue to move after publication; this brief retains the dated month-end record."
  },
  "supported_movement": {
    "status": "qualified",
    "material_movement_rows": 96,
    "material_movement_domains": 34,
    "supporting_movement_rows": 7,
    "supporting_movement_domains": 7,
    "items": [
      {
        "id": "nameservers_changed",
        "label": "Nameserver movement",
        "event_rows": 43,
        "affected_domains": 5,
        "evidence_status": "structured"
      },
      {
        "id": "rdap_status_changed",
        "label": "Registration-status movement",
        "event_rows": 37,
        "affected_domains": 27,
        "evidence_status": "bounded"
      },
      {
        "id": "mx_changed",
        "label": "MX movement",
        "event_rows": 11,
        "affected_domains": 6,
        "evidence_status": "structured"
      },
      {
        "id": "spf_present_changed",
        "label": "SPF presence movement",
        "event_rows": 4,
        "affected_domains": 2,
        "evidence_status": "structured"
      },
      {
        "id": "hosting_move_signal",
        "label": "Hosting-move signal",
        "event_rows": 1,
        "affected_domains": 1,
        "evidence_status": "structured"
      },
      {
        "id": "email_provider_changed",
        "label": "Email-provider movement",
        "event_rows": 6,
        "affected_domains": 6,
        "evidence_status": "structured"
      },
      {
        "id": "dns_provider_changed",
        "label": "DNS-provider movement",
        "event_rows": 1,
        "affected_domains": 1,
        "evidence_status": "structured"
      }
    ],
    "legacy_dns_sensitive_not_supported_rows": 8,
    "note": "The 103 supported rows are a review population, not 103 independent migrations or incidents. Repeated nameserver observations are concentrated in a small number of domains, and RDAP status movement is retained as bounded registration-layer evidence rather than an organisation-level finding."
  },
  "mail_trust": {
    "status": "published",
    "as_of": "2026-08-31",
    "panel_denominator": 100,
    "contract_versions": {
      "item": "mail-posture/v1",
      "aggregate": "mail-posture-aggregate/v1"
    },
    "mx": {
      "evidence": {
        "determinate_count": 98,
        "indeterminate_count": 2
      },
      "posture": {
        "denominator": 98,
        "visible": 94,
        "null_mx": 0,
        "not_observed": 4
      }
    },
    "spf": {
      "evidence": {
        "determinate_count": 98,
        "indeterminate_count": 2
      },
      "posture": {
        "denominator": 98,
        "not_observed": 0,
        "single": 84,
        "multiple": 0,
        "malformed": 14
      },
      "terminal_qualifier": {
        "denominator": 84,
        "fail": 41,
        "softfail": 34,
        "neutral": 4,
        "pass": 0,
        "missing": 5
      }
    },
    "dmarc": {
      "evidence": {
        "determinate_count": 98,
        "indeterminate_count": 2
      },
      "posture": {
        "denominator": 98,
        "not_observed": 1,
        "valid": 97,
        "multiple": 0,
        "malformed": 0
      },
      "policy": {
        "denominator": 97,
        "none": 16,
        "quarantine": 13,
        "reject": 68
      },
      "adkim": {
        "denominator": 97,
        "relaxed": 92,
        "strict": 5
      },
      "aspf": {
        "denominator": 97,
        "relaxed": 92,
        "strict": 5
      },
      "subdomain_policy": {
        "denominator": 97,
        "none": 9,
        "quarantine": 4,
        "reject": 18,
        "inherited": 66
      }
    },
    "source": "data/state/mail-trust.json",
    "note": "Mail trust reports public MX, SPF and DMARC evidence only. Indeterminate observations are not treated as absence; SPF evaluation remains deliberately bounded and visible DMARC policy is not an assessment of organisational maturity or compliance."
  },
  "auda_context": {
    "status": "pending",
    "target_month": "2026-08",
    "registry_month": null,
    "source": "auDA Registry Monthly Statistics",
    "reason": "current_month_registry_statistics_not_available_at_preparation",
    "note": "August 2026 auDA Registry Monthly Statistics were not available when this draft was prepared. This does not block publication; the section may be updated later while retaining the original report publication date."
  },
  "observation_coverage": {
    "status": "qualified",
    "panel_denominator": 100,
    "observation_days": 31,
    "collector_runs": 206,
    "successful_runs": 205,
    "partial_runs": 0,
    "failed_runs": 0,
    "running_runs": 1,
    "domain_observations_attempted": 3409,
    "domain_observations_succeeded": 3409,
    "domain_observations_failed": 0,
    "snapshot_rows_written": 3409,
    "actual_snapshot_rows": 3412,
    "snapshot_write_delta": 3,
    "event_rows_written": 1039,
    "actual_event_rows": 1039,
    "event_write_delta": 0,
    "rdap_fallback_count": 0,
    "dns_error_count": 0,
    "rdap_error_count": 33,
    "note": "One historical collector-run row remained in running state with zero telemetry counters but three linked snapshots. All 3,412 August snapshots are attributed to August runs, no snapshots are unattributed, and the three-row telemetry delta reconciles exactly to that stale run."
  },
  "evidence_quality": {
    "status": "qualified",
    "dns_outcome_model": "query_outcomes_v1_with_august_cutover",
    "comparison_status": "qualified",
    "metrics": [
      {
        "id": "structured_dns_snapshots",
        "label": "Structured DNS snapshots",
        "value": 3312
      },
      {
        "id": "legacy_dns_snapshots",
        "label": "Pre-structured DNS snapshots",
        "value": 100
      },
      {
        "id": "structured_dns_coverage_pct",
        "label": "Structured DNS snapshot coverage (%)",
        "value": 97.1
      },
      {
        "id": "observed_domains",
        "label": "Observed domains",
        "value": 100
      },
      {
        "id": "observatory_event_rows",
        "label": "Stored observatory event rows",
        "value": 1039
      },
      {
        "id": "legacy_dns_sensitive_event_rows",
        "label": "Legacy DNS-sensitive rows",
        "value": 33
      },
      {
        "id": "legacy_dns_sensitive_not_supported_rows",
        "label": "Legacy non-routine DNS-sensitive rows excluded from supported movement",
        "value": 8
      },
      {
        "id": "unknown_event_rows",
        "label": "Unknown event rows",
        "value": 0
      }
    ],
    "structured_dns_snapshot_rows": 3312,
    "legacy_dns_snapshot_rows": 100,
    "structured_dns_domains": 100,
    "legacy_dns_observation_days": 1,
    "first_structured_dns_snapshot": "2026-08-01T18:08:48.403395+00:00",
    "last_legacy_dns_snapshot": "2026-07-31T18:48:20.961461+00:00",
    "observed_domains": 100,
    "observatory_event_rows": 1039,
    "legacy_dns_sensitive_event_rows": 33,
    "legacy_dns_sensitive_not_supported_rows": 8,
    "unknown_event_rows": 0,
    "note": "The first August observation day predates persisted query_outcomes_v1 evidence. The 100 pre-structured snapshots are confined to that transition day; all 100 panel domains have structured DNS evidence from the following daily collection onward. DNS-sensitive supported movement is gated on the linked structured snapshot."
  },
  "provider_context": {
    "status": "qualified",
    "as_of": "2026-08-31T05:57:07.554061+10:00",
    "panel_denominator": 100,
    "dns": {
      "status": "published",
      "classified_count": 100,
      "unclassified_count": 0,
      "distinct_provider_count": 23,
      "published_distribution_count": 89,
      "other_classified_count": 11,
      "providers": [
        {
          "label": "Amazon Route53",
          "count": 20
        },
        {
          "label": "Akamai / Edge DNS",
          "count": 19
        },
        {
          "label": "Cloudflare",
          "count": 11
        },
        {
          "label": "Azure DNS",
          "count": 10
        },
        {
          "label": "Organisation-managed / Self-hosted DNS",
          "count": 9
        },
        {
          "label": ".au registry / parent-zone delegation",
          "count": 6
        },
        {
          "label": "AARNet / Institutional",
          "count": 4
        },
        {
          "label": "CSC / Enterprise DNS",
          "count": 3
        },
        {
          "label": "CSC / Domain Network",
          "count": 2
        },
        {
          "label": "UltraDNS",
          "count": 2
        },
        {
          "label": "VentraIP / HostingPlatform",
          "count": 2
        },
        {
          "label": "Afrihost",
          "count": 1
        }
      ],
      "source": "data/state/dns-providers.json",
      "note": "The generated State artefact publishes a bounded provider summary covering 89 classified panel domains. The remaining 11 domains are classified among additional provider labels not individually listed in that summary."
    },
    "email": {
      "status": "qualified",
      "classified_count": 94,
      "unclassified_count": 6,
      "distinct_provider_count": 13,
      "provider_denominator": 94,
      "published_distribution_count": 93,
      "other_classified_count": 1,
      "providers": [
        {
          "label": "Microsoft 365",
          "count": 41
        },
        {
          "label": "Proofpoint",
          "count": 17
        },
        {
          "label": "Google Workspace",
          "count": 11
        },
        {
          "label": "Mimecast",
          "count": 11
        },
        {
          "label": "Organisation-managed / Self-hosted Email",
          "count": 5
        },
        {
          "label": "Cisco Secure Email",
          "count": 2
        },
        {
          "label": "Atmail Cloud",
          "count": 1
        },
        {
          "label": "CITEC",
          "count": 1
        },
        {
          "label": "Hosted email security (azmx)",
          "count": 1
        },
        {
          "label": "Hosted email security (ppe-hosted)",
          "count": 1
        },
        {
          "label": "Newsprout",
          "count": 1
        },
        {
          "label": "SGE Email Gateway",
          "count": 1
        }
      ],
      "source": "data/state/email-providers.json",
      "note": "The generated State artefact publishes a bounded provider summary covering 93 of the 94 classified panel domains. One additional classified provider label is not individually listed in that summary; six panel domains are unclassified."
    },
    "registrar": {
      "status": "qualified",
      "visible_count": 99,
      "unavailable_count": 1,
      "distinct_visible_name_count": 12,
      "providers": [
        {
          "label": "Corporation Service Company (Aust) Pty Ltd",
          "count": 35
        },
        {
          "label": "Domain Directors Pty Ltd trading as Instra",
          "count": 12
        },
        {
          "label": "Melbourne IT",
          "count": 12
        },
        {
          "label": "Education Services Australia Limited",
          "count": 10
        },
        {
          "label": "auDA Internal (9999)",
          "count": 8
        },
        {
          "label": "Department of Finance",
          "count": 6
        },
        {
          "label": "Synergy Wholesale Accreditations Pty Ltd",
          "count": 6
        },
        {
          "label": "Web Address Registration Pty Ltd",
          "count": 4
        },
        {
          "label": "Discount Domain Name Services Pty Ltd",
          "count": 2
        },
        {
          "label": "GoDaddy.com LLC trading as GoDaddy.com",
          "count": 2
        },
        {
          "label": "GoDaddy Online Services Cayman Islands Ltd",
          "count": 1
        },
        {
          "label": "MarkMonitor Corporate Services Inc",
          "count": 1
        }
      ],
      "source": "data/state/registrars.json",
      "note": "Registrar identity is reported as visibly supplied by the source; visible-name variants are not silently normalised into a canonical market-share view."
    },
    "window_note": "The generated provider State files use a rolling 30-day movement window beginning 2 August for the 31 August artefact. Provider distributions above are the final dated posture; their rolling movement windows are not substituted for exact full-month movement totals.",
    "note": "Provider counts describe visible classification across the fixed .auDO panel only. They are not market share or whole-namespace concentration."
  },
  "limitations": [
    "The fixed .auDO panel is an observation panel, not a representative sample of the whole .au namespace.",
    "Recorded event rows are descriptive observatory records and are not all equivalent independent posture changes.",
    "Observed cohorts are curated analytical lenses and may overlap; they are not complete sector-wide coverage or rankings.",
    "The first August observation day predates persisted structured DNS query outcomes; DNS-sensitive supported movement excludes non-routine rows linked to that legacy evidence.",
    "One stale collector-run telemetry row accounts exactly for three snapshots omitted from run counters; the underlying snapshots and event rows remain attributed and reconciled.",
    "Mail trust reflects public MX, SPF and DMARC evidence under the mail-posture contracts; indeterminate evidence is not treated as absence.",
    "Provider distributions describe the fixed panel only, and the generated 30-day provider movement windows begin on 2 August rather than covering the exact calendar month.",
    "RDAP status movement is registration-layer evidence and is not interpreted as organisation-level posture or lifecycle evidence.",
    "August 2026 auDA Registry Monthly Statistics were pending when this draft was prepared.",
    "The brief is a descriptive observation, not a score, benchmark, assessment or whole-namespace finding."
  ]
}