# AU Domain Observatory — Insight Report **Date:** 2026-04-23 **Source manifest:** `data/analysis_manifests/2026-04-23.json` **Interpretation layer:** disabled --- ## Executive summary - Latest panel covers **100** active domains across **14** cohorts. - Current observatory activity covers **35** observatory events across **25** domains; bootstrap events are tracked separately. - Top DNS provider is **Amazon Route53** with **20** domains (**20.0%** of the current panel). - Largest review bucket is **review-required DNSSEC signals** with **7** current review flags. - Recent collector export contains **7** terminal runs with a **100.0%** terminal success rate, plus **0** still marked running in the exported delta. - Top observatory event type is **a_changed** with **21** occurrences in the current exported delta. --- ## Key findings - The two largest DNS providers, **Amazon Route53** and **Akamai / Edge DNS**, account for **39.0%** of the current panel. - Among cohorts with at least five domains, **media-watchlist** currently has the highest observatory event rate at **1.0** events per domain. - There are **7** DNSSEC review-required signals where secure delegation is asserted but no DNSKEY was observed in the latest snapshot. - Repeated observatory activity is concentrated on **news.com.au**, which produced **3** observatory events across **3** event types in the current window. - Historical trend language remains suppressed because only **29** daily points are available and the panel has expanded from **31** to **100** domains. --- ## Recommended monitoring - Validate DNSSEC review-required cases individually before treating them as control weaknesses, especially where parent-zone delegation or methodology limits may be involved. - Monitor repeated observatory-event domains closely in the next runs: news.com.au, wsaa.asn.au, crikey.com.au, homeaffairs.gov.au, kmart.com.au. - Keep bootstrap effects and panel expansion separate from observatory interpretation until the panel stabilises and 30 daily points are available. - Use terminal-run success rate rather than raw row counts when assessing collector health across mixed running and completed shards. --- ## Current panel posture - Active domains in current panel: **100** - Latest snapshot rows analysed: **100** - Recent event rows analysed: **35** - Recent collector runs analysed: **7** - Cohorts represented: **14** ### DNS provider concentration - **Amazon Route53** — 20 domains (20.0%) - **Akamai / Edge DNS** — 19 domains (19.0%) - **Cloudflare** — 11 domains (11.0%) - **Azure DNS** — 9 domains (9.0%) - **Organisation-managed / Self-hosted DNS** — 9 domains (9.0%) ### Registrar concentration - **Corporation Service Company (Aust) Pty Ltd** — 36 domains (36.0%) - **Domain Directors Pty Ltd trading as Instra** — 12 domains (12.0%) - **Melbourne IT** — 12 domains (12.0%) - **Education Services Australia Limited** — 10 domains (10.0%) - **auDA Internal (9999)** — 8 domains (8.0%) ### RDAP collection availability - RDAP available in latest snapshot: **100** - RDAP temporarily unavailable during collection: **0** - RDAP unavailable / unknown in latest snapshot: **0** --- ## Trust-signal posture ### DNSSEC - Secure delegation asserted: **13** - Secure delegation asserted via RDAP: **0** - DNSKEY observed: **8** ### Email trust signals - SPF present: **99** - DMARC present: **98** ### Classification gaps - None surfaced in the latest snapshot. ### Trust-signal mismatches - **dnskey_observed_without_secure_delegation_asserted** — 2 - **mx_present_but_no_dmarc** — 1 ### Review-required signals - **secure_delegation_asserted_but_dnskey_not_observed** — 7 --- ## Recent observatory activity - Observatory events in current exported delta: **35** - Domains affected by observatory events: **25** - Bootstrap events in current exported delta: **0** ### Observatory event type counts - **a_changed** — 21 - **aaaa_changed** — 9 - **nameservers_changed** — 3 - **dns_provider_changed** — 1 - **hosting_move_signal** — 1 ### Repeated same observatory event type on the same domain - None surfaced in the current exported delta. ### Repeated observatory-event domains - **news.com.au** — 3 observatory events across 3 event types - **wsaa.asn.au** — 3 observatory events across 3 event types - **crikey.com.au** — 2 observatory events across 2 event types - **homeaffairs.gov.au** — 2 observatory events across 2 event types - **kmart.com.au** — 2 observatory events across 2 event types - **qantas.com.au** — 2 observatory events across 2 event types - **realestate.com.au** — 2 observatory events across 2 event types - **theaustralian.com.au** — 2 observatory events across 2 event types --- ## Collector run health - Runs in exported delta: **7** - Terminal runs: **7** - Successful terminal runs: **7** - Running rows still present: **0** - Terminal success rate: **100.0%** - Snapshot rows written: **113** - Event rows written: **37** - DNS errors: **0** - RDAP errors: **0** --- ## Historical readiness - Available daily points: **29** - Sufficient history for interpretation: **False** - Panel start size: **31** - Panel end size: **100** Trend language is currently suppressed. Reason: **Historical trend language is suppressed because there are fewer than 30 daily observation points.** --- ## Interpretation layer Interpretation is disabled for this run. Reason: **Requires >= 30 days of stable daily history.** --- ## Appendix — Cohort profile ### commercial-watchlist - Domains: **14** - RDAP available or temporarily unavailable: **14** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **14** - Email provider classified: **14** - SPF present: **14** - DMARC present: **14** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### critical-infrastructure - Domains: **25** - RDAP available or temporarily unavailable: **25** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **25** - Email provider classified: **23** - SPF present: **25** - DMARC present: **25** - Secure delegation asserted: **9** - DNSKEY observed: **3** ### education-watchlist - Domains: **10** - RDAP available or temporarily unavailable: **10** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **10** - Email provider classified: **10** - SPF present: **10** - DMARC present: **10** - Secure delegation asserted: **0** - DNSKEY observed: **1** ### finance-watchlist - Domains: **8** - RDAP available or temporarily unavailable: **8** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **8** - Email provider classified: **7** - SPF present: **8** - DMARC present: **8** - Secure delegation asserted: **1** - DNSKEY observed: **0** ### founder-surface - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **1** - DNSKEY observed: **1** ### healthcare-watchlist - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### legal-watchlist - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### media-watchlist - Domains: **8** - RDAP available or temporarily unavailable: **8** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **8** - Email provider classified: **8** - SPF present: **8** - DMARC present: **8** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### namespace-diversity - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### nfp-watchlist - Domains: **15** - RDAP available or temporarily unavailable: **15** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **15** - Email provider classified: **15** - SPF present: **15** - DMARC present: **15** - Secure delegation asserted: **1** - DNSKEY observed: **2** ### platform-hosted - Domains: **3** - RDAP available or temporarily unavailable: **3** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **3** - Email provider classified: **3** - SPF present: **3** - DMARC present: **2** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### saas-watchlist - Domains: **5** - RDAP available or temporarily unavailable: **5** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **5** - Email provider classified: **4** - SPF present: **5** - DMARC present: **5** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### smb-watchlist - Domains: **4** - RDAP available or temporarily unavailable: **4** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **4** - Email provider classified: **3** - SPF present: **3** - DMARC present: **3** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### telecom-watchlist - Domains: **4** - RDAP available or temporarily unavailable: **4** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **4** - Email provider classified: **4** - SPF present: **4** - DMARC present: **4** - Secure delegation asserted: **1** - DNSKEY observed: **1** --- Generated automatically by the .auDO insight pipeline. This report is deterministic, reproducible, and based on exported observatory artefacts.