Global observations
DNS, mail, certificate and routing records for hundreds of millions of apex domains, read from public infrastructure and refreshed on a measured schedule.
For reinsurers, accumulation teams and cyber risk modelers
Better accumulation models start with better infrastructure evidence.
Cyber accumulation depends on how organizations share providers. When many of them rely on the same mail platform, DNS provider or cloud, one outage reaches all of them at once.
Datazag supplies independently observed relationships between domains and the applications, email, identity, website platforms, CDNs, hosting and networks behind them.
Enrich your models. Validate technology dependencies. Build history from here.
The evidence layer
Observed infrastructure, ready to join to your exposure data.
Technology attribution
Which providers sit behind each domain's mail, DNS, hosting, CDN, website platform and SaaS. Direct links and inferred ones are labeled separately.
History, accruing
Dated snapshots from the start dates below. History builds from here, so a comparison you run today can be reproduced later.
Data you can inspect
Every row carries the record it came from and the time it was observed. You can check any attribution against its source.
Our data describes observable infrastructure relationships. Your models determine criticality, failure scenarios and loss.
Coverage at domain level
329 million apex domains. 329 technology vendors.
Measured across 328,958,320 apex domains.
| Category | What we see | Evidence |
|---|---|---|
| Microsoft 365, mailbox and gateway providers | Observed | |
| Mail (SPF) | Google Workspace | Configured |
| Identity | Okta, Auth0 | Observed |
| CRM and marketing | Salesforce, HubSpot | Observed |
| Collaboration and support | Atlassian, Zendesk, Freshworks | Observed |
| ERP | SAP, where its records are published | Configured |
| DNS, hosting and CDN | Authoritative DNS, hosting networks (ASN) and CDNs | Observed |
| Website platforms | Site builders and app platforms, and the cloud under them | Observed |
What DNS can’t see: most HR and ERP systems, and Microsoft Entra directly. Every Microsoft 365 tenant depends on Entra.
Distinguishing observation from inference
A live record pointing at a provider is not the same evidence as a provider named in an SPF record. Every attribution carries its tier, so your model can weight them differently.
The three tiers
- ObservedA live record points at the provider now (CNAME, MX, A).
- ConfiguredThe domain authorizes the provider (SPF include) or has verified with it (TXT token). It may be out of date.
- Needs confirmationAn inferred link we show for you to check.
Look beneath the platform
Many sites run on a platform that runs on someone else's cloud.
About 1 in 3 site-builder and app-platform sites (10.2M of 31.0M with an address) run on Cloudflare, Amazon, Google or Fastly without the site owner choosing that provider. An outage at the cloud reaches every site on the platform.
| Platform | Runs on | Apex domains |
|---|---|---|
| Shopify* | Cloudflare | ≥ 3.68M |
| Vercel* | Amazon | ≥ 3.09M |
| Newfold Digital | Oracle | 1.77M |
| SiteGround | 1.43M | |
| Netlify* | Amazon | ≥ 0.43M |
| GitHub Pages | Fastly | 0.43M |
| Jimdo | Cloudflare | 0.38M |
| Duda* | Amazon | ≥ 0.35M |
| Webflow | Cloudflare | 0.28M |
| Webador | 0.23M |
Measured . * Platforms seen only through a website CNAME (Shopify, Vercel, Netlify, Duda) are floors while CNAME coverage grows. Same-company pairs are left out.
A shared provider is not always a shared failure
Two platforms on the same cloud may run in different regions or services, so one outage need not reach both. The table shows where a dependency exists. Whether it is one failure domain is for your model to decide.
Platforms that run their own networks, such as Wix and Squarespace, don’t show the cloud behind them.
Follow the layers
Domain → service → provider → IP/network → ASN
Each layer is a column you can join on. Reverse-query any of them: name a provider or a network and see every domain that depends on it.
Research
The dependency behind the dependency.
Our published research measures the layers under corporate mail and web. Observed across 112.9 million corporate domains.
2.2% behind a gateway
Email security gateways front a small share of corporate domains. Behind them, the mailbox often sits with Microsoft.
77% of Barracuda domains on Microsoft 365
A gateway and a mailbox platform together. For Mimecast, the share is 52%. An outage at either removes the mail path.
98.4% with one mail operator
Corporate domains whose mail hosts all belong to one operator. There is no second path.
At least one in five corporate domains use one company for DNS, website and mail.
Concentration
Provider share is not the same as provider risk.
Anyone can count how many domains use a provider. The count matters more when one provider carries two functions: one company for DNS and mail is one failure that removes both. Datazag reports that compound exposure as its own finding, so it is not hidden inside two provider shares.
Mailbox provider
Where each domain's mail is hosted.
Email security gateway
The filtering service in front of the mailbox.
Authoritative DNS
Who answers for the domain.
DNSSEC dependency
Whose signing keeps a signed zone resolving.
CDN
Who serves the domain's websites.
Hosting network
The network (ASN) each service runs on.
Certificate authority
Who issues the domain's certificates.
Registrar
Who holds the domain's registration.
Incident exposure
When a provider has an incident, start from the provider. Name it and see which domains on your list depend on it, for DNS, mail or hosting, with the evidence for each.
Scenario testing
Name a provider and an outage, for example "authoritative DNS unavailable for twelve hours". See which insureds lose which functions. The result feeds your systemic-scenario and reinsurance reporting.
Exposure, not loss
Datazag reports which policies are exposed and how. It holds no claims or loss data, so pricing the scenario stays with your own models.
This is not hypothetical. In October 2016 an attack on the DNS provider Dyn made many major websites unreachable at the same time, across many unrelated companies.
The same concentration exists across the internet. 6 networks carry half of all domains that sit on a network, and 230 carry nine in ten. Method and caveats →
For reinsurers and portfolio teams
Start with one book.
Send the domains for up to 250 insureds. We return provider concentration, the reverse index and each insured's posture, then walk through it with you on a review call.
Show prices inConverted prices are a guide at current exchange rates. We can invoice in your currency.
Founding offer · For insurers
Book Accumulation Snapshot
$7,500One-off fee.
- Up to 250 insureds.
- Provider concentration across mail, DNS, hosting and CDN.
- Reverse index: which insureds depend on a named provider.
- Undeclared estate and email posture per insured, each finding with its evidence.
- Review call included.
- Delivered within 5 working days.
- Fee credited in full against an annual data share signed by March 31, 2027.
3 of 3 places left
Offer ends December 31, 2026.
History and refresh
Build exposure history from today.
Dependency change analysis
See which providers domains move to and away from, week by week, from the start dates below.
Dated snapshots
Every comparison names the snapshot it used, so a result can be reproduced.
Point-in-time joins
Join your exposure data to the infrastructure as observed on a given date, from the dates below.
History starts
- Certificate archive
- DNS and email records
- Daily posture
- Weekly SaaS extracts
History accrues from these dates, as dated snapshots.
Refreshed as often as each thing changes
- Hourly
- Routing and network data.
- Daily
- New, retiring and high-risk domains, and subdomains from new certificates.
- The wider corpus
- Measured record age: median 13 days, 95th percentile 29 days. Measured .
Every row carries the time it was observed. A domain we have not checked recently shows as not checked, never as clean.
Data evaluation
Evaluate the data on your own systems. Your portfolio stays in your building.
Datazag provides a defined evaluation dataset. Your team queries it with DuckDB on your own computer or server and joins it to your insured lists, entity mappings and exposure data. Nothing you join is sent to Datazag.
For an evaluation, we ship a defined extract for the categories and population you choose.
Provider-level datasets are a design-partner program. Design partners now. Discuss a data license.
Data elements
What an evaluation contains.
| Element | What it holds | Status |
|---|---|---|
| Apex domain and observation time | The join key, and when each record was read. | Available in evaluation extracts |
| Authoritative DNS provider | Who answers for the domain, from its NS records. | Available in evaluation extracts |
| Mailbox provider and gateway | Who receives the domain's mail, and any filtering service in front. | Available in evaluation extracts |
| Hosting network | IP address, ASN and network operator for the domain's website. | Available in evaluation extracts |
| Website platform and the cloud under it | The site builder or app platform, and the network it runs on. | Available in evaluation extracts |
| SaaS vendors | Each vendor seen for the domain, with its evidence tier. | Available in evaluation extracts |
| Email posture | SPF, DMARC, MTA-STS and DNSSEC, and what each record says. | Available in evaluation extracts |
| Provider-level datasets | Domains per provider and category, as tables of their own. | Design partner |
Technical evaluation
A technical evaluation, not a sales demonstration.
- 1
Select coverage
Choose the categories and the population: a market, a list of domains, or both.
- 2
Query in your environment
Load the evaluation data with DuckDB on your own computer or server and join it to your own data.
- 3
Compare the evidence
Check our attributions against what you already know, record by record.
- 4
Assess integration and licensing
Decide how the data fits your models, and talk to us about a license.
Underwriting, for carriers
The same evidence answers the underwriter’s question about one applicant: what it runs, how it is configured and what it depends on. Reports for a single applicant are bought online.
Assessing individual applicants? Underwriters & MGAs →
Prefer to talk first? Book a 20-minute call
Questions
Frequently asked questions
- Can you show which policies are exposed when a provider fails?
- Yes, from a list of domains. Name a provider and see which domains depend on it, and for which functions. Datazag reports exposure, not loss: it holds no claims or loss data.
- Does our book leave our building?
- Not on the data route: you query our data on your own systems and join it to your book there, so nothing you join is sent to Datazag. A report is different: you send us the domains, and Datazag processes them under the data-processing agreement.
- How much history is there?
- The certificate archive starts on 23 July 2026, DNS and email records on 1 August 2026, daily posture on 20 August 2026 and weekly SaaS extracts on 29 September 2026. History accrues from there, as dated snapshots.
- Can you map domains to companies and subsidiaries?
- Today we work at domain level. Join our data to your own entity mappings.