One company runs the nameservers, website and mail for one corporate domain in five

A domain that is reachable at all relies on three commercial layers. Nameservers answer for the name; if they stop, nothing on the domain resolves. The website sits behind a content-delivery edge or directly on a hosting network. The mail path takes the domain’s email. Each is a dependency the owner cannot swap quickly. The question that matters is how often they belong to the same company.

The obvious candidate for one operator in all three layers is Cloudflare, which sells nameservers, the edge and mail routing. That triple exists and is tightly correlated. Of corporate domains that route mail through Cloudflare, 84% also use it for nameservers and edge. But it covers 1.2% of corporate domains (1,402,264).

The larger pattern is older and less discussed. For one corporate domain in five (22,975,657), one registrar or host runs all three layers. It answers the nameservers, serves the website and takes the mail. Three named dependencies, one company, one control plane.

The hosting layer is concentrated on its own, too. In the Datazag Observatory, 6 networks carry half of all domains on a network. 228 carry nine in ten (measured 11 October 2026).

Many portfolios treat Cloudflare as the correlated dependency and the host as a detail. They have the two exposures the wrong way round.

The one-company stack is not spread evenly. It is a European pattern, led by hosting companies. In the largest markets, it is a dominant way to run a corporate domain.

For a German book, this is the largest correlated exposure in the dependency picture. Two in five corporate domains get nameservers, website and mailbox from one company. A control-plane event there is not three separate risks that happen to coincide; it is one event with three consequences.

The worldwide mailbox platforms barely appear in this pattern. They run a great deal of corporate mail, but almost none of the nameservers or websites behind it. The most exposed domains sit with hosts that sell the domain, the site and the mailbox as one product.

17.9% of web domains sit behind a content-delivery edge (49,029,025 of 274,472,709). Among them the market is not concentrated in the ordinary sense. It is, for practical purposes, one vendor.

Cloudflare holds more than 85% of the fronted segment in every market over 50,000 websites. Japan and Korea are the exceptions, and it still leads there. What changes by territory is how much of a market is fronted at all. That is 42% of Indonesian websites, against 5.5% of German ones.

Where a domain owner chooses Cloudflare directly, the layers fuse. 83% of websites whose nameservers Cloudflare runs are also served through its edge.

The DNS protocol was built for redundancy, and organizations can buy it from two providers. The population almost never does.

98.86% of operating domains rely on a single nameserver operator. Of the 1.14% that list two, two-thirds come from one website platform. It runs its own nameservers across two providers, so the owner inherits that redundancy rather than choosing it. Domains whose owners chose two providers make up 0.38% of the population at most.

That shapes how a nameserver event belongs in a model. For nearly every domain, either the operator answers or the name does not resolve. If it does not resolve, the website, the mail and every other service on the domain go with it. This is not hypothetical. In October 2016, an attack on the DNS provider Dyn took many major websites offline at once, across unrelated companies.

In several national markets, one operator answers for between a third and a half of all operating domains.

A Canadian or Indian portfolio carries around half of one registrar’s nameserver event. That comes from default settings, not purchasing decisions. In Brazil, the leading nameserver operator is the national registry itself. Its DNS answers for a quarter of the market. That is a sovereign dependency no vendor list would show.

Every figure comes from records the domains themselves publish. Nothing is surveyed, self-reported or inferred from a vendor’s customer list.

A domain’s nameserver records name who answers for it. Its address record shows which network hosts its website. For the major edge networks, that address falls inside ranges the vendors publish. Its mail records name who accepts its mail. We map nameserver hosts to operators with a crosswalk we curate. It merges an operator’s nameservers when they span several domain names. Parked domains and domains held for sale are removed first. The corporate cut is the domains that also publish a working mail server and an SPF record. These are the ones a business runs.

On 10 September 2026, Datazag tracked 408,022,905 domains. 367,238,077 resolved at their latest observation. The other 40,784,828 returned NXDOMAIN, SERVFAIL or a timeout. DNS records were observed from 4 May 2026 to 10 September 2026. Each domain counts once, at its latest observation.

• Domains, not organizations. One organization may hold hundreds of defensive registrations behind one operator: one claim, not hundreds.
• The edge is read from the website’s own address. That sees the largest networks almost completely, but misses some enterprise deployments that front only a www alias. Shares for the smaller edge vendors are floors.
• Registrar-default nameservers count as a dependency, because they are one.
• A small share of nameservers is not yet named. 13.6% of operating domains touch an operator identified only by its domain name. The largest is 0.7% of the population, so nothing of accumulation size is hiding.
• Country-code domains stand in for territory; .com does not. Confirm territorial figures against a book’s own domicile data.
• No change over time. This is one observation per domain. We do not claim movement between operators. The history that would show it is not yet captured in enough detail.