{
  "report_contract_version": "monthly-observatory-brief/v2",
  "month": "2026-10",
  "title": "Monthly Observatory Brief - October 2026",
  "period_label": "October 2026",
  "status": "published",
  "publication": {
    "status": "published",
    "prepared_at": "2026-11-01",
    "published_at": "2026-11-01"
  },
  "monthly_readout": [
    "Nameserver changes were concentrated in a small part of the observation panel during October. The observatory recorded 58 nameserver-change observations across seven domains. In two of those domains, DNS-provider and hosting-related signals also appeared alongside nameserver changes on nine observation dates. These overlapping observations show repeated visible infrastructure movement, but do not establish completed or permanent migrations.",
    "October's month-end observations illustrate the difference between visible records and their recorded posture. DMARC records were observed for 97 of the 98 domains with determinate DMARC evidence. Of those, 96 were classified as valid, while one had multiple records. DNSSEC evidence was visible for 15 panel domains. These are dated observations of public signals, not conclusions about the effectiveness of internal controls."
  ],
  "observed_activity": {
    "status": "published",
    "recorded_event_rows": 918,
    "affected_domains": 38,
    "affected_domains_status": "published",
    "supported_movement_rows": 103,
    "supported_movement_domains": 18,
    "routine_or_low_confidence_rows": 815,
    "routine_or_low_confidence_domains": 27,
    "legacy_dns_sensitive_event_rows": 0,
    "note": "Event rows include routine address changes and repeated observations of the same domain. Supported movement is a subset selected for interpretation, not a count of incidents or confirmed migrations."
  },
  "cohort_context": {
    "status": "published",
    "membership_model": "canonical_published_cohorts",
    "membership_effective_from": "2026-07-01",
    "overlap_note": "A domain may appear in more than one analytical cohort. Cohort membership totals therefore do not sum to the fixed panel size.",
    "rows": [
      {
        "id": "government",
        "title": "Australian government domains",
        "denominator": 14,
        "overlapping_membership": false,
        "recorded_event_rows": 66,
        "domains_with_recorded_activity": 2,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 5,
        "supporting_movement_rows": 1,
        "supported_movement_rows": 6,
        "domains_with_supported_movement": 2,
        "routine_or_low_confidence_rows": 60,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "nfp",
        "title": "Australian not-for-profit domains",
        "denominator": 16,
        "overlapping_membership": false,
        "recorded_event_rows": 42,
        "domains_with_recorded_activity": 4,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 6,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 6,
        "domains_with_supported_movement": 2,
        "routine_or_low_confidence_rows": 36,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "education",
        "title": "Australian higher education domains",
        "denominator": 10,
        "overlapping_membership": false,
        "recorded_event_rows": 56,
        "domains_with_recorded_activity": 4,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 46,
        "supporting_movement_rows": 8,
        "supported_movement_rows": 54,
        "domains_with_supported_movement": 3,
        "routine_or_low_confidence_rows": 2,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "media",
        "title": "Australian media domains",
        "denominator": 8,
        "overlapping_membership": false,
        "recorded_event_rows": 160,
        "domains_with_recorded_activity": 3,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 15,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 15,
        "domains_with_supported_movement": 2,
        "routine_or_low_confidence_rows": 145,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "commercial",
        "title": "Retail and marketplace domains",
        "denominator": 14,
        "overlapping_membership": false,
        "recorded_event_rows": 307,
        "domains_with_recorded_activity": 10,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 9,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 9,
        "domains_with_supported_movement": 2,
        "routine_or_low_confidence_rows": 298,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "financial-services",
        "title": "Financial services domains",
        "denominator": 8,
        "overlapping_membership": false,
        "recorded_event_rows": 85,
        "domains_with_recorded_activity": 4,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 3,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 3,
        "domains_with_supported_movement": 2,
        "routine_or_low_confidence_rows": 82,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "public-interest",
        "title": "Public-interest domains",
        "denominator": 21,
        "overlapping_membership": true,
        "recorded_event_rows": 120,
        "domains_with_recorded_activity": 4,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 5,
        "supporting_movement_rows": 1,
        "supported_movement_rows": 6,
        "domains_with_supported_movement": 2,
        "routine_or_low_confidence_rows": 114,
        "legacy_dns_sensitive_not_supported_rows": 0
      },
      {
        "id": "software-platforms",
        "title": "Australian software platforms",
        "denominator": 5,
        "overlapping_membership": false,
        "recorded_event_rows": 30,
        "domains_with_recorded_activity": 1,
        "legacy_dns_sensitive_event_rows": 0,
        "material_movement_rows": 0,
        "supporting_movement_rows": 0,
        "supported_movement_rows": 0,
        "domains_with_supported_movement": 0,
        "routine_or_low_confidence_rows": 30,
        "legacy_dns_sensitive_not_supported_rows": 0
      }
    ],
    "note": "Cohorts are curated analytical lenses within the fixed panel, not representative sector samples. Public-interest membership overlaps other cohorts; do not add the cohort totals together."
  },
  "month_end_posture": {
    "status": "qualified",
    "as_of": "2026-10-31T08:38:34.590659+11:00",
    "latest_run_date": "2026-10-31",
    "panel_denominator": 100,
    "comparison_status": "withheld",
    "metrics": [
      {
        "id": "dnssec_visible",
        "label": "DNSSEC visible",
        "count": 15
      },
      {
        "id": "mx_visible",
        "label": "MX visible",
        "count": 93
      },
      {
        "id": "spf_visible",
        "label": "SPF visible",
        "count": 98
      },
      {
        "id": "dmarc_visible",
        "label": "DMARC visible",
        "count": 97
      },
      {
        "id": "dns_provider_classified",
        "label": "Named DNS-provider association",
        "count": 70
      },
      {
        "id": "email_provider_classified",
        "label": "Named inbound-mail provider association",
        "count": 84
      },
      {
        "id": "rdap_available",
        "label": "RDAP available",
        "count": 99
      },
      {
        "id": "registrar_visible",
        "label": "Registrar visible",
        "count": 99
      }
    ],
    "source": "data/state/index.json",
    "note": "Dated 31 October public-signal visibility in the fixed panel. Counts are observations, not assessments of effectiveness or compliance. Month-on-month posture comparisons are withheld where a like-for-like comparison has not been established."
  },
  "supported_movement": {
    "status": "qualified",
    "material_movement_rows": 94,
    "material_movement_domains": 18,
    "supporting_movement_rows": 9,
    "supporting_movement_domains": 2,
    "items": [
      {
        "id": "nameservers_changed",
        "label": "Nameserver movement",
        "event_rows": 58,
        "affected_domains": 7,
        "evidence_status": "structured"
      },
      {
        "id": "rdap_status_changed",
        "label": "Registration-status movement",
        "event_rows": 26,
        "affected_domains": 12,
        "evidence_status": "bounded"
      },
      {
        "id": "hosting_move_signal",
        "label": "Hosting-movement signal",
        "event_rows": 9,
        "affected_domains": 2,
        "evidence_status": "structured"
      },
      {
        "id": "dns_provider_changed",
        "label": "DNS-provider association movement",
        "event_rows": 9,
        "affected_domains": 2,
        "evidence_status": "structured"
      },
      {
        "id": "registrar_changed",
        "label": "Registrar movement",
        "event_rows": 1,
        "affected_domains": 1,
        "evidence_status": "bounded"
      }
    ],
    "legacy_dns_sensitive_not_supported_rows": 0,
    "note": "Related DNS-provider and hosting signals can accompany the same nameserver observation. Repeated nameserver or registration-status changes may reverse; totals do not establish independent, permanent infrastructure changes."
  },
  "mail_trust": {
    "status": "published",
    "as_of": "2026-10-31",
    "panel_denominator": 100,
    "contract_versions": {
      "item": "mail-posture/v1",
      "aggregate": "mail-posture-aggregate/v1"
    },
    "mx": {
      "evidence": {
        "determinate_count": 97,
        "indeterminate_count": 3
      },
      "posture": {
        "denominator": 97,
        "visible": 93,
        "null_mx": 0,
        "not_observed": 4
      }
    },
    "spf": {
      "evidence": {
        "determinate_count": 98,
        "indeterminate_count": 2
      },
      "posture": {
        "denominator": 98,
        "not_observed": 0,
        "single": 85,
        "multiple": 0,
        "malformed": 13
      },
      "terminal_qualifier": {
        "denominator": 85,
        "fail": 41,
        "softfail": 35,
        "neutral": 3,
        "pass": 0,
        "missing": 6
      }
    },
    "dmarc": {
      "evidence": {
        "determinate_count": 98,
        "indeterminate_count": 2
      },
      "posture": {
        "denominator": 98,
        "not_observed": 1,
        "valid": 96,
        "multiple": 1,
        "malformed": 0
      },
      "policy": {
        "denominator": 96,
        "none": 16,
        "quarantine": 12,
        "reject": 68
      },
      "adkim": {
        "denominator": 96,
        "relaxed": 91,
        "strict": 5
      },
      "aspf": {
        "denominator": 96,
        "relaxed": 91,
        "strict": 5
      },
      "subdomain_policy": {
        "denominator": 96,
        "none": 8,
        "quarantine": 4,
        "reject": 18,
        "inherited": 66
      }
    },
    "source": "data/state/mail-trust.json",
    "note": "Observed on 31 October. Indeterminate evidence is kept separate from absence; valid record syntax and published policy do not establish compliance or the effectiveness of mail controls."
  },
  "auda_context": {
    "status": "pending",
    "target_month": "2026-10",
    "registry_month": null,
    "source": "auDA Registry Monthly Statistics",
    "source_url": "https://www.auda.org.au/news-insights/au-registry-reports/",
    "total_names_under_management": null,
    "total_new_domains": null,
    "panel_per_million": null,
    "note": "October 2026 registry statistics were not available when this brief was prepared. The external namespace reference may be added later; it does not make the fixed panel a representative sample."
  },
  "observation_coverage": {
    "status": "published",
    "panel_denominator": 100,
    "observation_days": 31,
    "collector_runs": 186,
    "successful_runs": 186,
    "partial_runs": 0,
    "failed_runs": 0,
    "running_runs": 0,
    "domain_observations_attempted": 3100,
    "domain_observations_succeeded": 3100,
    "domain_observations_failed": 0,
    "snapshot_rows_written": 3100,
    "actual_snapshot_rows": 3100,
    "snapshot_write_delta": 0,
    "event_rows_written": 918,
    "actual_event_rows": 918,
    "event_write_delta": 0,
    "rdap_fallback_count": 0,
    "dns_error_count": 1,
    "rdap_error_count": 38,
    "note": "All 31 observation dates were covered. Successful collection runs do not mean that every individual DNS or RDAP query produced determinate evidence."
  },
  "evidence_quality": {
    "status": "published",
    "dns_outcome_model": "query_outcomes_v1",
    "comparison_status": "qualified",
    "metrics": [
      {
        "id": "structured_dns_snapshots",
        "label": "Structured DNS snapshots",
        "value": 3100
      },
      {
        "id": "legacy_dns_snapshots",
        "label": "Legacy/missing DNS-outcome snapshots",
        "value": 0
      },
      {
        "id": "structured_dns_coverage_pct",
        "label": "Structured DNS snapshot coverage (%)",
        "value": 100
      },
      {
        "id": "observed_domains",
        "label": "Observed domains",
        "value": 100
      },
      {
        "id": "observatory_event_rows",
        "label": "Stored observatory event rows",
        "value": 918
      },
      {
        "id": "legacy_dns_sensitive_event_rows",
        "label": "Legacy DNS-sensitive event rows",
        "value": 0
      },
      {
        "id": "legacy_dns_sensitive_not_supported_rows",
        "label": "Legacy unsupported DNS-sensitive rows",
        "value": 0
      },
      {
        "id": "unknown_event_rows",
        "label": "Unknown event rows",
        "value": 0
      }
    ],
    "structured_dns_snapshot_rows": 3100,
    "legacy_dns_snapshot_rows": 0,
    "structured_dns_domains": 100,
    "legacy_dns_observation_days": 0,
    "first_structured_dns_snapshot": "2026-09-30T21:24:38.369995+00:00",
    "last_legacy_dns_snapshot": null,
    "observed_domains": 100,
    "observatory_event_rows": 918,
    "legacy_dns_sensitive_event_rows": 0,
    "legacy_dns_sensitive_not_supported_rows": 0,
    "unknown_event_rows": 0,
    "note": "All 3,100 retained October snapshots contain structured DNS outcomes, with no unknown event types or unattributed writes. Evidence comparability qualifies the observation record; it does not imply that a month-on-month posture comparison is published."
  },
  "provider_context": {
    "status": "qualified",
    "as_of": "2026-10-31T08:38:34.590659+11:00",
    "panel_denominator": 100,
    "dns": {
      "status": "qualified",
      "classified_count": 70,
      "unclassified_count": 30,
      "distinct_provider_count": 12,
      "published_distribution_count": 69,
      "other_classified_count": 1,
      "providers": [
        {
          "label": "Amazon Web Services",
          "count": 21
        },
        {
          "label": "Akamai",
          "count": 18
        },
        {
          "label": "Cloudflare",
          "count": 11
        },
        {
          "label": "Microsoft",
          "count": 10
        },
        {
          "label": "UltraDNS",
          "count": 2
        },
        {
          "label": "VentraIP",
          "count": 2
        },
        {
          "label": "DNS Made Easy",
          "count": 1
        },
        {
          "label": "Discount Domain Name Services",
          "count": 1
        },
        {
          "label": "Gandi",
          "count": 1
        },
        {
          "label": "GoDaddy",
          "count": 1
        },
        {
          "label": "ZoneEdit",
          "count": 1
        }
      ],
      "source": "data/state/dns-providers.json",
      "note": "Thirty panel domains had no named DNS-provider association in the dated State summary. The compact table omits one further named association included in the published total; associations are inferred from public infrastructure, not supplier records."
    },
    "email": {
      "status": "qualified",
      "classified_count": 84,
      "unclassified_count": 16,
      "unavailable_count": 3,
      "distinct_provider_count": 6,
      "provider_denominator": 100,
      "published_distribution_count": 83,
      "other_classified_count": 1,
      "providers": [
        {
          "label": "Microsoft",
          "count": 41
        },
        {
          "label": "Proofpoint",
          "count": 17
        },
        {
          "label": "Google",
          "count": 11
        },
        {
          "label": "Mimecast",
          "count": 11
        },
        {
          "label": "Cisco",
          "count": 3
        }
      ],
      "source": "data/state/email-providers.json",
      "note": "The dated State summary contains 84 named inbound-mail provider associations across six distinct named providers. Five displayed providers account for 83 domains; one further named association is omitted from the bounded distribution. Of the 16 domains without a named association, three are explicitly [unavailable] and 13 have no named classification. Named counts exclude these categories."
    },
    "registrar": {
      "status": "qualified",
      "visible_count": 99,
      "unavailable_count": 1,
      "distinct_visible_name_count": 12,
      "providers": [
        {
          "label": "Corporation Service Company (Aust) Pty Ltd",
          "count": 35
        },
        {
          "label": "Domain Directors Pty Ltd trading as Instra",
          "count": 13
        },
        {
          "label": "Melbourne IT",
          "count": 11
        },
        {
          "label": "Education Services Australia Limited",
          "count": 10
        },
        {
          "label": "auDA Internal (9999)",
          "count": 8
        },
        {
          "label": "Department of Finance",
          "count": 6
        },
        {
          "label": "Synergy Wholesale Accreditations Pty Ltd",
          "count": 6
        },
        {
          "label": "Web Address Registration Pty Ltd",
          "count": 4
        },
        {
          "label": "Discount Domain Name Services Pty Ltd",
          "count": 2
        },
        {
          "label": "GoDaddy.com LLC trading as GoDaddy.com",
          "count": 2
        },
        {
          "label": "GoDaddy Online Services Cayman Islands Ltd",
          "count": 1
        },
        {
          "label": "MarkMonitor Corporate Services Inc",
          "count": 1
        }
      ],
      "source": "data/state/registrars.json",
      "note": "Registrar labels are drawn from visible registration records for this panel, not a measure of market share."
    },
    "window_note": "Dated State provider fields and the separately versioned Provider Resolution projection are distinct methods. No unqualified September–October provider composition comparison is presented; complete method versions and hashes remain in the evidence record.",
    "note": "Named providers describe publicly visible infrastructure associations across the fixed panel. They do not establish contractual suppliers or market shares."
  },
  "limitations": [
    "The fixed 100-domain panel and its curated, sometimes overlapping cohorts are not representative of the .au namespace or whole sectors. This brief is not a score, ranking, benchmark, risk rating or compliance assessment.",
    "Recorded rows are observations, not independent incidents or confirmed migrations. Repeated nameserver, DNS-provider and hosting signals may be linked or may reverse.",
    "Public DNS, registration and mail signals do not establish private systems, internal intent, service resilience, contractual providers or the effectiveness of controls. Indeterminate evidence is not treated as absence, and suppressed cohort cells are not reconstructed.",
    "Named provider associations in the dated State use established provider fields, which differ from the separately versioned Provider Resolution projection. Unqualified month-on-month provider composition comparisons are withheld.",
    "Collection completed across 31 observation days, but individual DNS and RDAP query errors remain recorded and are not converted into successful signal determinations.",
    "October auDA namespace statistics remain pending. Registry-wide reference figures, when available, provide external context only and do not make the fixed panel representative."
  ]
}