Who Really Runs the Internet's DNS?
By Lucian — builder & engineer, LK Forge
Before your browser can load a site it asks that site's nameservers for the address — so whoever runs those nameservers quietly holds up the web. We looked up the live NS records for the 1000 most-visited domains and grouped them by operator. The short version: Amazon alone runs DNS for more than one in five, five US cloud companies run more than half, and most sites keep no independent backup at all.
A handful of companies, most of the web
Of the 1000 domains, 994 returned nameserver records. Attributing each to the company that operates the majority of its nameservers, the market is strikingly top-heavy.
Key finding: Amazon runs DNS for 22.1% of the top 1000 sites — the single biggest operator. The top three (Amazon, Cloudflare, Akamai) reach 43.6%, and five US cloud giants together operate DNS for 54.4% of the busiest sites on the web.
The fragile part: no backup
DNS was designed to be redundant — you can list nameservers from two independent providers so that if one is knocked offline, the other still answers. Most top sites don't. 83.7% run every nameserver with a single operator, and only 16.3% spread across two or more for redundancy.
In October 2016 a DDoS attack on the DNS provider Dyn took Twitter, Spotify, Reddit and Netflix offline in a single afternoon — not because those sites failed, but because the one company answering their DNS did. A decade later, the setup that made that possible is still the norm at the top of the web. A single operator is simpler and usually fine; it's a single point of failure on the day it isn't.
About the sample
These are the 1000 most-visited domains, which skew toward large, well-resourced operators — the long tail of the web has far more registrar-bundled and self-hosted DNS. We count sites per operator, not traffic; a traffic-weighted view would concentrate even further, since the very biggest sites cluster on the biggest operators. About 12% of sites use niche providers or in-house setups we didn't map by name — many are additional self-hosters, so the commercial-concentration figures here are conservative.
Reproduce this
Everything comes from scripts/crawl-dns-concentration.mjs — the Tranco top 1,000 list plus plain
NS lookups over DNS-over-HTTPS, no auth and no proprietary data. DNS delegation changes over time, so a
re-run may move a point or two; that's expected. The core of each lookup is one call:
// NS records over DNS-over-HTTPS
const r = await fetch(`https://dns.google/resolve?name=${domain}&type=NS`,
{ headers: { accept: 'application/dns-json' } })
const ns = (await r.json()).Answer
.filter(a => a.type === 2) // NS
.map(a => a.data.toLowerCase()) // such as ns-1283.awsdns-32.org -> AmazonMap each nameserver's domain to its operator, attribute each site to the majority operator, and you'll get the same shape of result.
Check who runs any domain's DNS
Do it yourself in the browser: the DNS lookup pulls any domain's live NS
records — read the nameserver hostnames and you'll see who operates them (an awsdns suffix is
Amazon, ns.cloudflare.com is Cloudflare, and so on). The IP lookup
then geolocates the addresses behind it.
More network tools
- DNS Lookup — NS, MX, TXT, A, CNAME and more for any domain.
- IP Address Lookup — geolocate any IPv4 or IPv6, with reverse DNS.
- All the network tools — DNS, IP, SMTP, ping and subnet.