Lab notes · 2026-09-20

How German sectors delegate: cities, universities, banks and the .de top 1,000

How Germany delegates read the delegation of 139 zones that matter in Germany: the DAX-40, the federal government, the states, the broadcasters, the banks and grid operators. That list is deep and narrow. This note goes wide: four more German lists, 1,276 zones, read the same way. The 100 largest cities, each with its official city domain (107 zones). The largest universities and universities of applied sciences (93 zones, 71 and 22). The financial sector below the DAX: 37 savings banks, 9 Landesbanken and the associations and data centres of the savings-bank group, 20 cooperative banks, 14 private and direct banks (80 zones). And the 1,000 most popular .de domains by the Tranco list of 10 September, of which 996 were delegated at the moment we asked. The four lists overlap: 69 of the 93 universities, 15 of the cities and 11 of the bank zones are also in the .de top 1,000, so the 1,276 entries are 1,181 distinct zones. Each list is read on its own.

Plain DNS queries from one server in Germany, late on 11 September: NS from the parent and from the zone itself, A and AAAA of every nameserver, origin AS and registration country of every address, NSID and hostname.bind, SOA serial per address, DS in the parent, DNSKEY at the apex. 28 seconds for the universities, under two minutes for the cities and the banks, 25 minutes for the top 1,000. No RIPE Atlas, no catchment, no load, no latency. As in the German note, we do not name zones.

Four lists, four defaults

Across the four lists, outsourcing runs from 71 % (universities) to 94 % (banks), and the average tells you nothing about any of them. Each sector has its own default, and it shows in every column: who the operators are, whether the nameservers stand in Germany, whether anything looks like anycast, whether the zone is signed, whether IPv6 is there.

The public sector buys from a long tail of regional carriers and municipal IT providers, stays at home and rarely signs. The universities have one operator between them, stay at home too, show no anycast at all and sign more than anyone else. The banks outsource the most, to the group's own IT, and sign the least: 3 zones of 80. The popular .de domains, most of them commercial, sit on the global anycast clouds, and that is where the concentration is: ten operators serve 58 % of them.

Cities: a long tail, mostly at home

95 of the 107 city zones (89 %) have every nameserver at an outside provider, 9 mix their own servers with a provider, and 3 run everything themselves; two of those three do it on rented virtual machines at a hosting company, which counts as their own server (see the method). The provider side is the least concentrated of the four lists: 64 operator labels for 107 zones, only 18 of them with three zones or more. Deutsche Telekom leads with 15 zones (14 %), then IONOS 9, RcodeZero 8, BelWue 6 and GoDaddy 5; the top five together reach 43 zones (40 %). Behind them come regional carriers, the municipal IT providers (ITK Rheinland, KRZN, Komm.ONE, regio iT) under their AS handles, and hosting companies. 12 zones (11 %) run at least one nameserver themselves.

The cities' DNS is domestic: 79 zones (74 %) have every address registered in Germany, and only 34 (32 %) carry an anycast hint, so 65 zones (61 %) stand in one country with no sign of anycast anywhere. At the same time only 40 zones (37 %) sit in a single AS, because a city typically pairs a carrier with a data centre or its own machine. 14 zones (13 %) carry a DS record; one more has a DNSKEY at the apex and no DS in the parent. IPv6: 62 zones (58 %) have an AAAA record for every nameserver, 15 (14 %) have none at all. The 15 zones on Deutsche Telekom all have every address in one country and none of them is signed.

Universities: one operator, at home, signed more than anyone

DFN, the German research network, serves 67 of the 93 zones (72 %), and for 50 of them it is the only operator. BelWue, the research network of Baden-Württemberg, has 13 (14 %), CESNET and LRZ 4 each, ns14/Netzmarkt 2. Only 16 zones have neither DFN nor BelWue among their nameservers. Universities keep more servers of their own than any other list: 27 zones (29 %) run at least one nameserver themselves, mostly alongside DFN, which gives 6 fully self-operated, 21 hybrid and 66 outsourced. The split between universities and universities of applied sciences is small: DFN serves 55 of 71 and 12 of 22, BelWue 6 and 7.

It is the most domestic list and the least anycast: 85 zones (91 %) have every address registered in Germany, 65 (70 %) sit in a single AS, and exactly 2 zones carry any anycast hint. 85 zones (91 %) therefore stand in one country without any sign of anycast. For a university whose users sit in that country, that is defensible, as we said about the state portals in the German note; what it costs a resolver on another continent we measured there and not here. DNSSEC is the highest of the four lists: 23 zones (25 %), 19 of the 71 universities (27 %) and 4 of the 22 universities of applied sciences (18 %); of the 67 DFN zones, 14 are signed. IPv6 is present almost everywhere but rarely complete: 47 zones (51 %) have an AAAA record for every nameserver, and only 2 have none, the lowest share of the four lists.

Banks: two halves, two defaults, three signed zones

75 of the 80 bank zones (94 %) are fully outsourced, 3 hybrid, 2 self-operated: the highest outsourcing share of the four lists. It is also the list with the fewest signed zones: 3 of 80 (3.8 %) carry a DS record, two of the 37 savings banks and one in the Landesbank group; 0 of the 20 cooperative banks, 0 of the 14 private and direct banks. And it is the list with the least IPv6: 46 zones (58 %) have no IPv6 nameserver at all, 30 (38 %) are complete. Finanz Informatik, the IT provider of the savings-bank group, serves 34 zones (42.5 %), InterNetX 26, IONOS 15, RcodeZero 13, Akamai 6. Only 19 zones (24 %) sit in a single AS, the lowest of the four lists, because the savings-bank setup spreads a zone over two Finanz Informatik networks and InterNetX.

The list splits in two. The 37 savings banks are all outsourced, 31 of them to Finanz Informatik, 24 of those with InterNetX as the second operator; 35 have every address registered in Germany, 2 carry an anycast hint, 34 have no IPv6 nameserver, 2 are signed. All 34 Finanz Informatik zones in the list are without an IPv6 nameserver. The 20 cooperative banks are the mirror image: 13 on IONOS and 12 on RcodeZero, 15 with an anycast hint, 17 with IPv6 on every nameserver, 4 with every address in one country, and none signed. The 14 private and direct banks look like the DAX: Akamai 6, 9 with an anycast hint, 5 complete on IPv6, 5 without any, none signed. One half of German retail banking stands in Germany, in the group's own data centres, without IPv6 and without anycast; the other half sits on two anycast providers with IPv6. Neither half signs.

The .de top 1,000: ten operators, 58 %

996 of the 1,000 most popular .de domains were delegated when we asked. 808 (81 %) have every nameserver at an outside provider, 90 (9 %) are hybrid, 98 (10 %) fully self-operated; 168 zones (16.9 %) run at least one nameserver themselves, the largest such group in any of our lists and the most varied, from broadcasters and research institutes to hosting companies and dynamic-DNS services. The operators: Cloudflare 121 zones (12.1 %), AWS Route 53 108, DFN 105, Deutsche Telekom 55, ns14/Netzmarkt 48, Akamai 45, IONOS 44, RcodeZero 28, Hetzner 25, noris network 25. DFN's third place is the universities again: 69 of the 93 are in the top 1,000, with research institutes and public bodies behind them.

Concentration, counted as zones with at least one nameserver at one of the N largest operators: the top three serve 334 zones (33.5 %), the top five 435 (43.7 %), the top ten 578 (58 %), the top twenty 711 (71.4 %). 725 zones (72.8 %) have every nameserver at exactly one operator; 910 (91 %) have at least one nameserver at an outside operator, spread over more than 200 operator labels. 531 zones (53 %) carry an anycast hint, the highest share of the four lists; 545 (55 %) sit in a single AS, 588 (59 %) have every address registered in one country, and 397 (39.9 %) have every address in one country and no anycast hint anywhere. 135 zones (13.6 %) carry a DS record; 13 more have a DNSKEY at the apex without a DS in the parent. 698 zones (70 %) have IPv6 on every nameserver, 104 (10 %) on none.

Signing and IPv6 differ by operator. Of the 121 Cloudflare zones all 121 have IPv6 on every nameserver and 18 carry a DS; of the 108 on Route 53, 106 and 2; of the 105 on DFN, 33 and 26; of the 55 on Deutsche Telekom, 19 and 10; of the 48 on ns14/Netzmarkt, 39 and 0. A DS record is the customer's decision, not the operator's, but the customers of each operator decide alike.

DNSSEC: a quarter, a seventh, a twenty-fifth

23 of 93 university zones (25 %), 135 of 996 popular .de zones (14 %), 14 of 107 city zones (13 %), 3 of 80 bank zones (3.8 %). The 139 zones of the German note sit at 24 %. Inside the lists: universities proper 27 %, universities of applied sciences 18 %; savings banks 5 %, Landesbanken and associations 1 of 9, cooperative banks and private banks 0. Fourteen zones across the four lists carry a DNSKEY at the apex without a DS in the parent: signed, and no resolver can tell.

IPv6

The order is the reverse of DNSSEC in one place and the same in another. Zones with no IPv6 nameserver at all: banks 46 of 80 (58 %), cities 15 of 107 (14 %), popular .de 104 of 996 (10 %), universities 2 of 93 (2 %). Zones with IPv6 on every nameserver: popular .de 70 %, cities 58 %, universities 51 %, banks 38 %. The universities are almost never without IPv6 and rarely complete, because DFN's addresses carry it and a university's own second or third server often does not. Mixed is fine for reachability. None is a statement, in 2026, for zones whose websites carry IPv6.

Small things that were not supposed to be there

32 of the 1,276 entries (2.5 %) list a different set of nameservers in the parent than in the zone itself: 2 cities, 2 universities, 3 banks, 25 in the top 1,000. Usually a leftover from a provider change and harmless until the old provider drops the zone. 24 zones answered with different SOA serials from different addresses at the moment we asked, 3 universities and 21 popular .de zones; we asked once, so it is a note, not a finding. No zone in the four lists delegates to a single nameserver. Zones have between 2 and 10 nameservers, median 3, in the bank list median 4.

Method, so you can check it

Everything here comes from queries anyone can repeat with dig, exactly as in the German note: NS at the parent and at the apex, A/AAAA for each nameserver name, origin AS and country from Team Cymru's DNS lookup, NSID and CH TXT hostname.bind/id.server plus SOA directly at each address (UDP, 3 s timeout, one retry), DS at the parent, DNSKEY at the apex. Three lists are hand-curated from public sources, the largest cities by population with their official city domains, the largest universities, and the savings banks, cooperative banks, Landesbanken and private banks; second domains of the same house were reduced to the canonical one, and one bank domain without a delegation was replaced. The fourth list is mechanical: all .de names in the Tranco list of 10 September, the first 1,000 by rank, which reaches to about rank 46,500 of the whole list; four of them had no delegation in .de at the moment of the run and were skipped. Tranco measures popularity, not importance, and carries dynamic-DNS, tracking and parking domains next to newspapers and ministries.

"Self-operated" means the AS name carries the zone's own name, or the nameserver sits under the zone's own domain and not in a known DNS provider's network; a vanity name pointing into a provider's network counts as outsourced; a virtual machine rented from a cloud or hosting provider counts as the owner's own server. Operators are counted per zone (a zone with servers at two operators counts for both) and folded where one company appears under two AS names (IONOS and its anycast network, the two Finanz Informatik networks, InterNetX, BelWue, CESNET, noris network, LRZ). Where a nameserver is a contractor's machine in a hosting network, the operator column shows the hosting network's AS handle; those handles are hosters, not DNS services, and appear in no ranking. "Anycast hint" is a property of our operator table, not a measurement: the operator is known to run anycast, or the server identity carries a site marker. It is a statement about an operator, not about an address; multiple addresses are not evidence of anycast, and a hint is not proof of it. Country is the registration country of the prefix. Serial drift is a snapshot.

The numbers above are a re-derivation of the 11 September answers with two corrections to that operator table, without a new query. On 13 September we stopped counting nameservers on rented cloud virtual machines (AWS EC2, Azure, Google Cloud, OVH, IONOS) as anycast DNS services and checked every affected address from 21 vantage points; 62 addresses in these four lists turned out to be single machines. On 15 September the same rule went to Hetzner and Host Europe: a nameserver on a Hetzner machine counts as the owner's own unless the name or the reverse DNS says it is Hetzner's DNS service, checked by reverse lookup for all 127 Hetzner addresses in our inventories, of which 12 are Hetzner's DNS and 115 are customers' servers. Together the two corrections changed some detail in 101 of the 1,276 entries and the class of 39, all towards self-operated or hybrid; in the top 1,000, Hetzner as an operator went from 76 zones to 25, and the share of zones with an anycast hint from 56 % to 53 %. The German note and the TLD note carry their own correction notes; the same inventory for six more European lists is in How Europe delegates.

We do not publish per-zone results. Where a zone's setup looks like a problem rather than a choice, the operator hears it from us first (see anycast.org for the disclosure rules).

What comes next

The 85 university, 65 city and 49 bank zones that stand in one country without any sign of anycast are the candidates for the measurement we ran on the 139 zones of the German note, 1,000 RIPE Atlas probes weighted by population, in What the delegation costs. The same reading for six more European lists is in How Europe delegates.