Lab notes · 2026-09-12

How the TLDs delegate: 1,438 zones, two operators on half of them, 87 without DNSSEC

Yesterday we read the delegation of 139 zones that matter in Germany. The same script, pointed one level up, reads every top-level domain there is. The root lists 1,438 delegated TLDs: 309 country codes, 23 generic TLDs from before 2013, and 1,106 from the 2013 round. For each one we asked the root for the nameserver set, asked the zone itself, resolved every nameserver to its addresses, looked up the origin AS and registration country of each address, and checked for a DS record in the root. Plain DNS from one server in Germany, five and a half minutes, no probes, no credits.

The picture is different from the German one, and in one respect it is the opposite. German zones are outsourced because their owners do not want to run DNS. TLDs are outsourced because a handful of companies built the registry business, and running nameservers for a few hundred TLDs each is what that business is.

Who runs the nameservers

1,258 TLDs (87 %) have every nameserver at an outside operator. 156 (11 %) mix the registry's own servers with an operator. 24 (2 %) run everything under their own name. The groups could hardly differ more. Among country codes, almost half are hybrid: a national registry keeps its own servers and adds a commercial or community operator for reach. Among the new generics, 99 % are fully outsourced, and that is by design: most of them are one product line of a registry service provider, and the nameservers came with the contract.

Stacked bars per group showing the share of TLDs whose nameservers are run by the registry itself, mixed, or by an outside operator — Registry's own nameservers, hybrid, and outside operator, per group. Country codes: 47 % hybrid. New generics: 99 % outsourced.

The concentration is the headline. Identity Digital serves nameservers for 479 TLDs, a third of everything. UltraDNS serves 347, a quarter. Together the ten largest operators hold 70 % of all operator slots; 164 distinct operators share the rest. 1,050 TLDs (73 %) rely on a single operator, and 264 (18 %) have every nameserver address in a single autonomous system. Nearly all of those are brand TLDs sitting on one anycast cloud. That is not fragile in the way a single rack is fragile, but it does mean one BGP mistake at one operator is visible in a quarter of the new generic namespace at once.

Horizontal bars of the twenty operators serving the most TLDs, in descending order — The twenty operators serving the most TLDs. A TLD with nameservers at two operators counts for both.

The country codes look healthier on this axis and it is worth saying why. Only 3 % of them have every address in one AS, and only 24 % depend on a single operator. Many national registries pair their own servers with PCH, Netnod, RIPE NCC, AfriNIC or a neighbouring registry, so the zone survives any one of them going dark. That pattern, own servers plus a second operator on different infrastructure, is exactly what we would tell a bank or a ministry to do. Most ccTLDs already do it.

Grouped bars per group showing the share of TLDs with a DS record in the root, all nameservers with IPv6, all addresses in one AS, and a single operator — Per group: share of TLDs with a DS record in the root, every nameserver with IPv6, every address in one AS, a single operator.

DNSSEC: every generic, but 87 country codes are missing

1,351 TLDs (94 %) have a DS record in the root. Every one of the 1,129 generic TLDs is signed and linked, because ICANN's contracts require it. The 87 without a DS are all country codes, 28 % of that group. Some are small islands with a handful of domains. Others are not: the ccTLDs of the United Arab Emirates, Egypt, Pakistan and Qatar have no DS in the root, and neither does .gb, which is reserved and essentially empty but still delegated. Eleven TLDs carry a DNSKEY at the apex without a DS in the parent, so the zone is signed but the chain of trust stops at the root. For those, DNSSEC is switched on and does nothing.

IPv6: 83 % complete, 16 with nothing

1,198 TLDs (83 %) have an AAAA record for every nameserver. Generic TLDs are at 91 % and 92 %; country codes at 51 %. Sixteen TLDs have no nameserver with an IPv6 address at all, and they are all country codes or internationalised country codes. A resolver on an IPv6-only network cannot reach those zones without a translation layer. In 2026 the root servers themselves have been dual-stack for over a decade; a TLD without any IPv6 nameserver is a decision someone keeps making every year.

Small things that were not supposed to be there

Twelve TLDs list a different set of nameservers in the root than in the zone itself. Fourteen delegate to only two nameservers, the minimum the root accepts. And 121 TLDs (8 %) had their nameservers disagree about the zone serial at the moment we asked, including three of the largest zones on the internet. For a zone that changes every few seconds that is normal propagation and no finding. For a zone that changes daily it is a nameserver that has stopped taking transfers, and the only way to tell the two apart is to look again an hour later. We do, and that is a separate note.

Method, so you can check it

The TLD list is IANA's, the group of each TLD comes from the root zone database. For every TLD: NS from a root server and from the zone's own first responding address, A and AAAA for each nameserver name, origin AS and registration country from Team Cymru's DNS lookup, NSID and CH TXT hostname.bind/id.server plus SOA directly at each address (UDP, 3 s timeout, one retry), DS at the root, DNSKEY at the apex. "Registry's own nameservers" means the nameserver names carry the TLD's own label and the addresses do not sit in the network of an operator that sells DNS to other registries; a.nic.de counts as DENIC's own, a.gtld-servers.net counts as an outside operator even though Verisign is both registry and operator. Which operator is the registry of which TLD is a hand-maintained table; operators missing from it count as outside everywhere. Anycast cannot be measured from one vantage point, so "one AS" says nothing about how many sites there are. The country is where the prefix is registered. Serial drift is a snapshot.

Everything in this note is in the root zone and readable by anyone. We name TLDs where the fact is a matter of public record (a missing DS, no IPv6 nameserver). We do not name TLDs for findings that look like a fault rather than a choice; those operators hear it from us first (see anycast.org for the disclosure rules).

What comes next

This inventory now runs every week. The interesting numbers are not the ones above but the differences: which TLD changes operator, which one gains or loses a DS, which nameserver stops following the serial. The first diff comes with the second run.

Correction, 13 September 2026

Same classifier error as in the German note: nameservers on rented cloud virtual machines counted as an outside anycast operator, and unicast nodes of one anycast operator counted as anycast. We verified every affected address from 21 vantage points and re-derived the numbers without a new query. 49 TLDs change in some detail; the headline numbers move by a percentage point or less: 1,258 TLDs (87 %) fully outsourced instead of 1,261 (88 %), 156 hybrid instead of 159, 24 self-operated instead of 18, 1,050 (73 %) on a single operator instead of 1,055. Among country codes, 47 % are hybrid and 24 % depend on a single operator. Identity Digital, UltraDNS, the DNSSEC and the IPv6 counts are unchanged. Text and charts above show the corrected numbers.