Global observations
DNS, mail, certificate and routing records for hundreds of millions of apex domains, read from public infrastructure and refreshed on a measured schedule.
For accumulation, exposure management and modeling teams
Better accumulation models start with better infrastructure evidence.
Cyber accumulation depends on how organizations share providers. When many of them rely on the same mail platform, DNS provider or cloud, one outage can reach many of them at once.
Datazag supplies independently observed relationships between domains and the applications, email, identity, website platforms, CDNs, hosting and networks behind them.
Enrich your models. Validate technology dependencies. Build history from here.
Test our data against your own portfolio, on your own systems. Your insured lists and model inputs stay with you.
The evidence layer
Observed infrastructure, ready to join to your exposure data.
Technology attribution
Which providers sit behind each domain's mail, DNS, hosting, CDN, website platform and SaaS. Direct links and inferred ones are labeled separately.
History, accruing
Dated snapshots from the start dates below. History builds from here, so a comparison you run today can be reproduced later.
Data you can inspect
Every row carries the record it came from and the time it was observed. You can check any attribution against its source.
Our data describes observable infrastructure relationships. Your models determine criticality, failure scenarios and loss.
Coverage at domain level
329 million apex domains. 329 technology vendors.
Measured across 328,958,320 apex domains.
| Category | What we see | Evidence |
|---|---|---|
| Microsoft 365, mailbox and gateway providers | Observed | |
| Mail (SPF) | Google Workspace | Configured |
| Identity | Okta, Auth0 | Observed |
| CRM and marketing | Salesforce, HubSpot | Observed |
| Collaboration and support | Atlassian, Zendesk, Freshworks | Observed |
| ERP | SAP, where its records are published | Configured |
| DNS, hosting and CDN | Authoritative DNS, hosting networks (ASN) and CDNs | Observed |
| Website platforms | Site builders and app platforms, and the cloud under them | Observed |
Distinguishing observation from inference
A live record pointing at a provider is not the same evidence as a provider named in an SPF record. Every attribution carries its tier, so your model can weight them differently.
The three tiers
- ObservedA live record points at the provider now (CNAME, MX, A).
- ConfiguredThe domain authorizes the provider (SPF include) or has verified with it (TXT token). It may be out of date.
- Needs confirmationAn inferred link we show for you to check.
Look beneath the platform
Many sites run on a platform that runs on someone else's cloud.
About 1 in 3 site-builder and app-platform sites (10.2M of 31.0M with an address) run on Cloudflare, Amazon, Google or Fastly without the site owner choosing that provider. That cloud is a dependency for every site on the platform.
| Platform | Runs on | Apex domains |
|---|---|---|
| Shopify* | Cloudflare | ≥ 3.68M |
| Vercel* | Amazon | ≥ 3.09M |
| Newfold Digital | Oracle | 1.77M |
| SiteGround | 1.43M | |
| Netlify* | Amazon | ≥ 0.43M |
| GitHub Pages | Fastly | 0.43M |
| Jimdo | Cloudflare | 0.38M |
| Duda* | Amazon | ≥ 0.35M |
| Webflow | Cloudflare | 0.28M |
| Webador | 0.23M |
Measured . * Floors; see methodology.
Follow the layers
Domain → service → provider → IP/network → ASN
Each layer is a column you can join on. Reverse-query any of them: name a provider or a network and see every domain that depends on it.
Research
The dependency behind the dependency.
Our published research measures the layers under corporate mail and web. Observed across 112.9 million corporate domains.
2.2% behind a gateway
Email security gateways front a small share of corporate domains. Behind them, the mailbox often sits with Microsoft.
77% of Barracuda domains on Microsoft 365
A gateway and a mailbox platform together. For Mimecast, the share is 52%. Both sit on the mail path, so a disruption at either can affect it.
98.4% with one mail operator
Corporate domains whose mail hosts all belong to one operator. There is no second path.
At least one in five corporate domains use one company for DNS, website and mail.
Concentration
Provider share is not the same as provider risk.
Anyone can count how many domains use a provider. The count matters more when one provider carries two functions. A common provider across DNS and email can create compound exposure. The actual impact depends on the services, infrastructure and failure domain affected. Datazag reports compound exposure as its own finding, so it is not hidden inside two provider shares.
Mailbox provider
Where each domain's mail is hosted.
Email security gateway
The filtering service in front of the mailbox.
Authoritative DNS
Who answers for the domain.
DNSSEC dependency
Whose signing keeps a signed zone resolving.
CDN
Who serves the domain's websites.
Hosting network
The network (ASN) each service runs on.
Certificate authority
Who issues the domain's certificates.
Registrar
Who holds the domain's registration.
Incident exposure
When a provider has an incident, start from the provider. Name it and see which domains on your list depend on it, for DNS, mail or hosting, with the evidence for each.
Scenario testing
Name a provider and an outage, for example "authoritative DNS unavailable for twelve hours". See which insureds depend on it, and for which functions. The result feeds your systemic-scenario and reinsurance reporting.
Exposure, not loss
Datazag reports which policies are exposed and how. It holds no claims or loss data, so pricing the scenario stays with your own models.
This is not hypothetical. In October 2016 an attack on the DNS provider Dyn made many major websites unreachable at the same time, across many unrelated companies.
The same concentration exists across the internet. 6 networks carry half of all domains that sit on a network, and 230 carry nine in ten. Method and caveats →
History and refresh
Build exposure history from today.
Each snapshot is a dated, versioned release. Query any snapshot from the start dates below.
Dependency change analysis
See which providers domains move to and away from, week by week, from the start dates below.
Dated snapshots
Every comparison names the snapshot it used, so a result can be reproduced.
Point-in-time joins
Join your exposure data to the infrastructure as observed on a given date, from the dates below.
Refreshed as often as each thing changes
- Hourly
- Routing and network data.
- Daily
- New, retiring and high-risk domains, and subdomains from new certificates.
- The wider corpus
- Measured record age: median 13 days, 95th percentile 29 days. Measured .
Data evaluation
Evaluate the data on your own systems. Your portfolio stays in your building.
Datazag provides a defined evaluation dataset. Your team queries it with DuckDB on your own computer or server and joins it to your insured lists, entity mappings and exposure data. Nothing you join is sent to Datazag.
For an evaluation, we ship a defined extract for the categories and population you choose.
Ready to talk about licensing? Discuss a data license.
Data elements
What an evaluation contains.
| Element | What it holds | Status |
|---|---|---|
| Apex domain and observation time | The join key, and when each record was read. | Available in evaluation extracts |
| Authoritative DNS provider | Who answers for the domain, from its NS records. | Available in evaluation extracts |
| Mailbox provider and gateway | Who receives the domain's mail, and any filtering service in front. | Available in evaluation extracts |
| Hosting network | IP address, ASN and network operator for the domain's website. | Available in evaluation extracts |
| Website platform and the cloud under it | The site builder or app platform, and the network it runs on. | Available in evaluation extracts |
| SaaS vendors | Each vendor seen for the domain, with its evidence tier. | Available in evaluation extracts |
| Email posture | SPF, DMARC, MTA-STS and DNSSEC, and what each record says. | Available in evaluation extracts |
| Provider-level datasets | Domains per provider and category, as tables of their own. | Design partner |
Technical evaluation
A technical evaluation, not a sales demonstration.
- 1
Select coverage
Choose the categories and the population: a market, a list of domains, or both.
- 2
Query in your environment
Load the evaluation data with DuckDB on your own computer or server and join it to your own data.
- 3
Compare the evidence
Check our attributions against what you already know, record by record.
- 4
Assess integration and licensing
Decide how the data fits your models, and talk to us about a license.
Book Accumulation Snapshot
For insurers and reinsurers: a one-off view of your book
Send the domains for up to 250 insureds. We return provider concentration, the reverse index and each insured's posture, then walk through it with you on a review call.
Show prices inConverted prices are a guide at current exchange rates. We can invoice in your currency.
Founding offer · For insurers
Book Accumulation Snapshot
$7,500One-off fee.
- Up to 250 insureds.
- Provider concentration across mail, DNS, hosting and CDN.
- Reverse index: which insureds depend on a named provider.
- Undeclared estate and email posture per insured, each finding with its evidence.
- Review call included.
- Delivered within 5 working days.
- Fee credited in full against an annual data share signed by March 31, 2027.
3 of 3 places left
Offer ends December 31, 2026.
This is a report: you send us the domains, and we process them under our DPA.
Underwriting, for carriers
The same evidence answers the underwriter’s question about one applicant: what it runs, how it is configured and what it depends on. Reports for a single applicant are bought online.
Assessing individual applicants? Underwriters & MGAs →
Prefer to talk first? Book a 20-minute call
Methodology
Methodology and data availability
What DNS can't see
Most HR and ERP systems, and Microsoft Entra directly. Every Microsoft 365 tenant depends on Entra.
Floors under a CNAME
Platforms seen only through a website CNAME (Shopify, Vercel, Netlify, Duda) are floors. The counts grow as CNAME coverage grows.
Same-company pairs
Where a platform and the cloud under it belong to the same company, the pair is left out of the platform table.
Platforms with their own networks
Platforms that run their own networks, such as Wix and Squarespace, don't show the cloud behind them.
A shared provider is not always a shared failure
Two platforms on the same cloud may run in different regions or services, so one outage need not reach both. The data shows where a dependency exists. Whether it is one failure domain is for your model to decide.
Exposure, not loss
Datazag reports which domains depend on a provider, and for which functions. It holds no claims or loss data, so loss stays with your own models.
Not checked is not clean
Every row carries the time it was observed. A domain we have not checked recently shows as not checked, never as clean.
Domain level
Today we work at domain level. Join our data to your own entity mappings.
Provider-level datasets
Domains per provider and category, as tables of their own, are a design-partner program. Design partners now.
History starts
- Certificate archive
- DNS and email records
- Daily posture
- Weekly SaaS extracts
History accrues from these dates, as dated snapshots. Nothing before them is reconstructed.
Questions
Frequently asked questions
- Can you show which policies depend on a provider?
- Yes, from a list of domains. Name a provider and see which domains depend on it, and for which functions. Datazag reports exposure, not loss: it holds no claims or loss data.
- Does our book leave our building?
- No. You query our data on your own systems and join it to your book there. Nothing you join is sent to Datazag.
- How much history is there?
- Each snapshot is a dated, versioned release. The start date for each layer is listed under methodology and data availability. History accrues from there.