Lab notes · 2026-09-17

How Europe delegates: 853 zones, 76 % outsourced, and DNSSEC depends on the registry

How Germany delegates read the delegation of 139 zones that matter in Germany. We have since done the same for six more lists: Austria (112 zones), Switzerland (112), France (145), the United Kingdom (133), the Netherlands (122) and the institutions of the European Union (90). 853 zones in seven lists. Every national list has the same shape as the German one: the main stock index (DAX-40, ATX, SMI, CAC-40, FTSE-100, AEX), central government and regulators, the regional tier (states, cantons, régions, the devolved administrations, provinces), public broadcasters and media, and the critical infrastructure of banks, insurers, telcos and grid operators. The EU list is different in kind: 13 institutions and bodies, 34 agencies, 32 domains the EU and its bodies hold outside europa.eu, and 11 European organisations, mostly research, that are not EU bodies. It is a list of institutions, not a country, and we read it as such.

Plain DNS queries from one server in Germany, all on 11 September, the German list in the early evening and the other six late that night: NS from the parent and from the zone itself, A and AAAA of every nameserver, origin AS and registration country of every address, NSID and hostname.bind, SOA serial per address, DS in the parent, DNSKEY at the apex. Between two and four minutes per list. No RIPE Atlas, no catchment, no load, and no latency: this note is about where the nameservers are, not what that costs. As in the German note, we do not name zones.

Who runs the nameservers

647 of the 853 zones (76 %) have every nameserver at an outside provider. 114 (13 %) mix their own servers with a provider. 92 (11 %) run everything themselves. The average hides a wide spread. The United Kingdom and the Netherlands outsource 87 % of their zones, Germany and Austria 76 %, France 72 %, Switzerland 66 %, the EU institutions 62 %. Fully self-operated runs the other way: EU institutions 20 %, Switzerland 18 %, Germany 12 %, France 11 %, the Netherlands 9 %, the UK 7 %, Austria 2 %.

Austria is the odd one out, and the provider list says why. Only 2 of 112 zones are fully self-operated, but 25 (22 %) are hybrid: the owner keeps a server of its own and adds a second operator, and that operator is usually Austrian. RcodeZero, the anycast service of the .at registry, serves 27 zones, the research network ACOnet 20, the incumbent A1 15, and the two government IT providers GovIX and BRZ 14 and 12. The Austrian federal zones are 24 of 35 outsourced and 10 hybrid. Switzerland is the mirror image: the highest share of fully self-operated zones among the six countries (20 of 112), the federal zones 4 self-operated and 5 hybrid of 17, the cantons 8 self-operated and 6 hybrid of 30, and Swisscom (17 zones) as the largest single provider ahead of Cloudflare (15), Akamai and AWS Route 53 (14 each) and SWITCH (8).

The providers are different in every country, and that is the most European thing in the data. In the United Kingdom the top of the list is the corporate registrars and the global anycast clouds: CSC 22 zones, UltraDNS 19, AWS Route 53 and Cloudflare 16 each, NS1 11, Akamai 9, and BT with 7 as the first domestic name. In France it is Nameshield with 30, then Akamai 18, CSC 13, OVH 12, Cloudflare 11 and Route 53 10; but only 4 of the 12 OVH zones use OVH's DNS service, the other 8 sit on IT providers' virtual machines inside OVH's network, single servers each, and the label covers both (see the method). In the Netherlands Akamai leads with 25, the research network SURF has 14, Cloudflare 11, and two more networks 10 each. Germany, for comparison: CSC 14, then Akamai, DFN, Deutsche Telekom and UltraDNS with 10 each. In France, Switzerland, Germany and the EU list the largest single entry is the owners themselves: 40 French, 34 Swiss, 33 EU and 28 German zones have at least one nameserver run by the organisation whose zone it is; in Austria it is 26, one behind RcodeZero.

DNSSEC depends on the registry

227 of the 853 zones (27 %) have a DS record in the parent, and that average is the least useful number in this note. In the Dutch list 95 of 122 zones (78 %) are signed and linked. In the other six lists it is 12 to 24 %: the UK 12 %, Austria 13 %, the EU institutions 17 %, France 17 %, Switzerland 24 %, Germany 24 %. Inside the Dutch list the split is sharper still. Central government 30 of 30, the provinces 17 of 17, banks, telcos and grid operators 28 of 32, public broadcasters and media 9 of 11; the 32 AEX companies 11 (34 %). Without the AEX, 84 of 90 Dutch zones (93 %) carry a DS.

The AEX companies, most of them on .com and on global providers, look like the rest of Europe. The Dutch public sector and infrastructure look like nowhere else. The difference is not the industry and not the provider, it is the registry and the government behind it: the .nl registry has rewarded registrars for signed delegations for years, and the Dutch government lists DNSSEC among the open standards that public bodies must apply or explain why not. Where nobody does that, the numbers for the same kinds of zones are what they are everywhere else. Central government: 8 of 27 signed in Germany, 8 of 35 in Austria, 7 of 17 in Switzerland, 7 of 32 in France, 5 of 29 in the UK. Public broadcasters and media: 0 of 14 in Germany, 0 of 14 in Austria, 0 of 13 in France, 0 of 11 in the UK, 1 of 13 in Switzerland. Eight zones across the seven lists carry a DNSKEY at the apex without a DS in the parent: signed, and no resolver can tell.

One network, one provider

The United Kingdom is the most concentrated list on every axis we have. 102 of its 133 zones (77 %) have every nameserver address in a single autonomous system, and 102 (77 %) sit at exactly one provider. In the FTSE-100 it is 56 of 59 zones outsourced (95 %) and 47 (80 %) in one AS. That is not a rack in one building: most of those single systems are anycast clouds, and 91 UK zones (68 %) carry an anycast hint, the highest share of any list. It does mean that one operator's bad day is visible in one of every six British zones on the list at once. Austria is the other end: 38 zones (34 %) in one AS, 57 (51 %) at a single provider, because the hybrid setups spread a zone over its own servers and a domestic operator. The rest sit between: Switzerland 64 % in one AS, the Netherlands 60 %, France 52 %, Germany and the EU list 50 %.

One country is a different measure and needs the same grain of salt as in the German note: the country is where the prefix is registered, and an anycast provider registers in one place and answers from forty. Austria has 85 zones (76 %) with every address registered at home, Switzerland 62 %, Germany 60 %, France 59 %, the UK 56 %, the Netherlands 43 %, the EU institutions 38 %, which for a list spread over Luxembourg, Brussels and twenty agency host cities says little. The number that matters is the overlap: all addresses in one country and no anycast hint anywhere. That is 284 of the 853 zones (33 %): 53 French zones (37 %), 52 German (37 %), 48 Swiss (43 %), 46 Austrian (41 %), 34 Dutch (28 %), 27 British (20 %), 24 EU (27 %). Their DNS, as far as one vantage point can tell, stands in one country, mostly in one network. What that costs a resolver in São Paulo or Singapore we measured for the German list in What the delegation costs; the other six lists have not been measured yet.

Six indices

The stock indices are the most comparable slice, because a listed company in Frankfurt, Paris or London buys DNS from the same handful of vendors. They are also the slice where the national differences are smallest. Outsourcing runs from 72 % (DAX-40) to 95 % (FTSE-100); an anycast hint covers 78 to 80 % of the DAX, SMI and FTSE zones, but only 54 % of the ATX, 56 % of the AEX and 64 % of the CAC-40. DNSSEC is low everywhere: the AEX is the best index at 34 %, the FTSE-100 and the ATX the worst at 12 %.

Who serves them: in the DAX-40, self-operated 15 zones, CSC 12, UltraDNS 9; in the CAC-40, self-operated 11, CSC 10, Akamai and Cloudflare 7 each; in the AEX, self-operated 7, Azure DNS 6. The FTSE-100 has 3 self-operated zones behind UltraDNS 13, CSC 12 and Cloudflare 9. The SMI: Akamai 7, Cloudflare and self-operated 4 each. The ATX: A1 and self-operated 4 each, Cloudflare 3.

IPv6

568 zones (67 %) have an AAAA record for every nameserver; 155 (18 %) have none at all. The Netherlands is complete on 87 % of its zones and has 9 (7 %) without any IPv6 nameserver; the UK 77 % and 27 (20 %); France 62 % and 28 (19 %); Germany 62 % and 14 (10 %); Austria 61 % and 23 (21 %); Switzerland 59 % and 25 (22 %). The EU institutions come last: 50 of 90 complete (56 %) and 29 (32 %) with no IPv6 nameserver, among them 8 of the 13 institutions and bodies.

The EU institutions

The EU list is the one that the classifier corrections (see the method) changed the most, and it is worth reading with that in mind. It has the highest share of fully self-operated zones, 18 of 90 (20 %). Seven of those 18 got there because a nameserver that our first pass had booked as Azure DNS, AWS Route 53 or OVH turned out to be a single rented virtual machine in that cloud, unicast, one region, under the institution's own name. A rented machine is the owner's own server, so the zone is self-operated; the label is right. The picture behind it is still worth stating plainly: in seven EU zones at least one nameserver, in most cases the secondary that is meant to keep answering when the primary does not, is one virtual machine. Across the list, only 45 zones (50 %) carry any anycast hint, the lowest share next to France; Azure DNS is the largest outside provider with 14 zones; 11 zones (12 %) list a different nameserver set in the parent than at the apex, the highest rate of any list against 4 to 7 % elsewhere; and 2 zones delegate to a single nameserver. The 13 institutions and bodies themselves are 5 self-operated, 5 hybrid and 3 outsourced, 4 of them signed, 8 without an IPv6 nameserver. The 34 agencies: 7 self-operated, 5 hybrid, 22 outsourced, 2 signed.

Small things that were not supposed to be there

54 zones (6 %) list a different set of nameservers in the parent than in the zone itself, from 5 in the Dutch list to 11 in the EU list; usually a leftover from a provider change and harmless until the old provider drops the zone. 22 zones answered with different SOA serials from different addresses at the moment we asked, 9 of them in the Swiss list; we asked once, so it is a note, not a finding. Three zones, one British and two EU, delegate to a single nameserver. Zones have between 1 and 12 nameservers, median 4.

Method, so you can check it

Everything here comes from queries anyone can repeat with dig, exactly as in the German note: NS at the parent and at the apex, A/AAAA for each nameserver name, origin AS and country from Team Cymru's DNS lookup, NSID and CH TXT hostname.bind/id.server plus SOA directly at each address (UDP, 3 s timeout, one retry), DS at the parent, DNSKEY at the apex. The lists are hand-curated from public sources (index constituents, government directories, regulators, broadcasters, the critical-infrastructure sectors of each country), not a random sample, and names that turned out to be hostnames inside a larger zone rather than delegated zones were dropped before the run. "Self-operated" means the AS name carries the zone's own name, or the nameserver sits under the zone's own domain and not in a known DNS provider's network; a vanity name pointing into a provider's network counts as outsourced; a telco's nameserver service counts as a provider even for the telco's own group zones. "Anycast hint" is a property of our provider mapper, not a measurement: the provider is known to run anycast, or the server identity carries a site marker. Multiple addresses are not evidence of anycast, and a hint is not proof of it. Country is the registration country of the prefix. Serial drift is a snapshot.

Two corrections to that mapper since the German note, both applied before any number above was computed. On 13 September we stopped counting nameservers on rented cloud virtual machines (AWS EC2, Azure, Google Cloud, OVH, IONOS) as anycast DNS providers; a machine you rent is your own server, and we checked every affected address from 21 vantage points. On 15 September the same rule went to Hetzner and Host Europe: a nameserver on a Hetzner machine counts as the owner's own unless the name or the reverse DNS says it is Hetzner's DNS service, checked by reverse lookup for all 127 Hetzner addresses in our inventories. Where such a machine sits under a third party's domain, the provider column shows the hosting network's AS handle (AMAZON-02, MICROSOFT-CORP-MSN-AS-BLOCK, HETZNER-AS, OVH), which is a hoster, not a DNS service; in the French list the OVH handle and OVH's DNS product share a name, 4 zones on the product, 8 on customers' machines. Together the two corrections changed some detail in 41 of the 714 non-German zones and the class of 19, all towards self-operated or hybrid, re-derived from the stored answers without a new query. The German list was re-derived on 13 September and the Hetzner rule changes nothing in it; the German note and the TLD note carry their own correction notes.

We do not publish per-zone results. Where a zone's setup looks like a problem rather than a choice, the operator hears it from us first (see anycast.org for the disclosure rules).

What comes next

The six new lists have not been measured yet: the same 1,000 RIPE Atlas probes that priced the German delegation in What the delegation costs are the next step for them. Germany in the breadth, with the same method, is the next note: How German sectors delegate (20 September) covers the 100 largest cities, 93 universities, 80 banks and the 1,000 most popular .de domains.