# AU Domain Observatory — Insight Report

**Date:** 2026-04-24  
**Source manifest:** `data/analysis_manifests/2026-04-24.json`  
**Interpretation layer:** enabled
---

## Executive summary

- Latest panel covers **100** active domains across **14** cohorts.
- Current observatory activity covers **31** observatory events across **24** domains; bootstrap events are tracked separately.
- Top DNS provider is **Amazon Route53** with **20** domains (**20.0%** of the current panel).
- Largest review bucket is **review-required DNSSEC signals** with **7** current review flags.
- Latest-snapshot RDAP collection was temporarily unavailable for **1** domain; these cases are treated as collection-time availability issues rather than missing RDAP support.
- Recent collector export contains **7** terminal runs with a **100.0%** terminal success rate, plus **0** still marked running in the exported delta.
- Top observatory event type is **a_changed** with **21** occurrences in the current exported delta.

---

## Key findings

- The two largest DNS providers, **Amazon Route53** and **Akamai / Edge DNS**, account for **39.0%** of the current panel.
- Among cohorts with at least five domains, **media-watchlist** currently has the highest observatory event rate at **1.0** events per domain.
- There are **7** DNSSEC review-required signals where secure delegation is asserted but no DNSKEY was observed in the latest snapshot.
- RDAP was temporarily unavailable during collection for **1** latest-snapshot domain; these cases are treated as collection-time unavailability rather than evidence that RDAP is absent for the domain.
- Repeated observatory activity is concentrated on **news.com.au**, which produced **3** observatory events across **2** event types in the current window.

---

## Recommended monitoring

- Validate DNSSEC review-required cases individually before treating them as control weaknesses, especially where parent-zone delegation or methodology limits may be involved.
- Track domains with dual-source RDAP 429 outcomes separately from genuine RDAP absence so temporary collection unavailability does not distort posture interpretation.
- Monitor repeated observatory-event domains closely in the next runs: news.com.au, crikey.com.au, homeaffairs.gov.au, qantas.com.au, realestate.com.au.
- Keep bootstrap effects and panel expansion separate from observatory interpretation until the panel stabilises and 30 daily points are available.
- Use terminal-run success rate rather than raw row counts when assessing collector health across mixed running and completed shards.

---

## Current panel posture

- Active domains in current panel: **100**
- Latest snapshot rows analysed: **100**
- Recent event rows analysed: **31**
- Recent collector runs analysed: **7**
- Cohorts represented: **14**

### DNS provider concentration

- **Amazon Route53** — 20 domains (20.0%)
- **Akamai / Edge DNS** — 19 domains (19.0%)
- **Cloudflare** — 11 domains (11.0%)
- **Azure DNS** — 9 domains (9.0%)
- **Organisation-managed / Self-hosted DNS** — 9 domains (9.0%)

### Registrar concentration

- **Corporation Service Company (Aust) Pty Ltd** — 35 domains (35.0%)
- **Domain Directors Pty Ltd trading as Instra** — 12 domains (12.0%)
- **Melbourne IT** — 12 domains (12.0%)
- **Education Services Australia Limited** — 10 domains (10.0%)
- **auDA Internal (9999)** — 8 domains (8.0%)

### RDAP collection availability

- RDAP available in latest snapshot: **99**
- RDAP temporarily unavailable during collection: **1**
- RDAP unavailable / unknown in latest snapshot: **0**

---

## Trust-signal posture

### DNSSEC

- Secure delegation asserted: **13**
- Secure delegation asserted via RDAP: **0**
- DNSKEY observed: **8**

### Email trust signals

- SPF present: **98**
- DMARC present: **98**

### Classification gaps

- None surfaced in the latest snapshot.

### Trust-signal mismatches

- **dnskey_observed_without_secure_delegation_asserted** — 2
- **mx_present_but_no_dmarc** — 1
- **mx_present_but_no_spf** — 1

### Review-required signals

- **secure_delegation_asserted_but_dnskey_not_observed** — 7

---

## Recent observatory activity

- Observatory events in current exported delta: **31**
- Domains affected by observatory events: **24**
- Bootstrap events in current exported delta: **0**

### Observatory event type counts

- **a_changed** — 21
- **aaaa_changed** — 8
- **nameservers_changed** — 1
- **spf_present_changed** — 1

### Repeated same observatory event type on the same domain

- **news.com.au** / **aaaa_changed** — 2 repeats

### Repeated observatory-event domains

- **news.com.au** — 3 observatory events across 2 event types
- **crikey.com.au** — 2 observatory events across 2 event types
- **homeaffairs.gov.au** — 2 observatory events across 2 event types
- **qantas.com.au** — 2 observatory events across 2 event types
- **realestate.com.au** — 2 observatory events across 2 event types
- **theaustralian.com.au** — 2 observatory events across 2 event types

---

## Collector run health

- Runs in exported delta: **7**
- Terminal runs: **7**
- Successful terminal runs: **7**
- Running rows still present: **0**
- Terminal success rate: **100.0%**
- Snapshot rows written: **113**
- Event rows written: **32**
- DNS errors: **0**
- RDAP errors: **1**

---

## Historical readiness

- Available daily points: **30**
- Sufficient history for interpretation: **True**
- Panel start size: **31**
- Panel end size: **100**

Historical depth is sufficient for a guarded interpretation layer over the fixed panel.

---

## Interpretation layer

Interpretation is **enabled** for this run.

Thirty days of daily observation is now available across the fixed 100-domain panel. That does not make this report representative of the full .au namespace, but it does make it possible to say something more disciplined about what appears to be stable, what remains uneven, and where movement is starting to concentrate.

### Reading of the panel

- The panel now shows a clear split between baseline trust hygiene and more selective infrastructure assurance.
- SPF and DMARC are close to saturation in the current panel, with **98** domains publishing SPF and **98** publishing DMARC in the latest snapshot.
- DNSSEC remains notably less common. Secure delegation is asserted for **13** domains, while DNSKEY is observed for **8** domains.
- In other words: basic email trust signals are widely present, but stronger DNS-layer assurance is still uneven. That gap is one of the more informative governance signals in the panel.

### What matters most

- The most common signals are no longer the most interesting. SPF and DMARC matter operationally, but their value in this report is mainly in exception: which domains fall away from an otherwise strong baseline.
- The more interesting story sits in unevenness and concentration. DNSSEC adoption is patchier, provider dependence is concentrated, and repeated event activity is clustering on a smaller set of domains.
- Repeated observatory activity matters more than isolated events. A domain that reappears across multiple events, or across multiple event types, is usually telling you more than a domain that changes once and disappears.

### Movement over the window

- Over the 30-day window, the largest DNS provider share moved by **-2.6** percentage points.
- Over the same window, the largest registrar share moved by **-0.5** percentage points.
- Repeated-event domains changed by **-3** over the same period.

### Current centres of gravity

- **DNS provider: Amazon Route53** — 20 domains (20.0%)
- **DNS provider: Akamai / Edge DNS** — 19 domains (19.0%)
- **DNS provider: Cloudflare** — 11 domains (11.0%)

- **Registrar: Corporation Service Company (Aust) Pty Ltd** — 35 domains (35.0%)
- **Registrar: Domain Directors Pty Ltd trading as Instra** — 12 domains (12.0%)
- **Registrar: Melbourne IT** — 12 domains (12.0%)

### Persistent activity

- **news.com.au** — 3 observatory events across 2 event types
- **crikey.com.au** — 2 observatory events across 2 event types
- **homeaffairs.gov.au** — 2 observatory events across 2 event types
- **qantas.com.au** — 2 observatory events across 2 event types
- **realestate.com.au** — 2 observatory events across 2 event types

This interpretation remains deliberately narrow. It is evidence from a mixed observatory panel, intended to highlight structural patterns and recurring movement, not to make claims about the entire namespace.


---

## Appendix — Cohort profile

### commercial-watchlist

- Domains: **14**
- RDAP available or temporarily unavailable: **14**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **14**
- Email provider classified: **14**
- SPF present: **14**
- DMARC present: **14**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### critical-infrastructure

- Domains: **25**
- RDAP available or temporarily unavailable: **25**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **25**
- Email provider classified: **23**
- SPF present: **25**
- DMARC present: **25**
- Secure delegation asserted: **9**
- DNSKEY observed: **3**

### education-watchlist

- Domains: **10**
- RDAP available or temporarily unavailable: **10**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **10**
- Email provider classified: **10**
- SPF present: **9**
- DMARC present: **10**
- Secure delegation asserted: **0**
- DNSKEY observed: **1**

### finance-watchlist

- Domains: **8**
- RDAP available or temporarily unavailable: **8**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **8**
- Email provider classified: **7**
- SPF present: **8**
- DMARC present: **8**
- Secure delegation asserted: **1**
- DNSKEY observed: **0**

### founder-surface

- Domains: **1**
- RDAP available or temporarily unavailable: **1**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **1**
- Email provider classified: **1**
- SPF present: **1**
- DMARC present: **1**
- Secure delegation asserted: **1**
- DNSKEY observed: **1**

### healthcare-watchlist

- Domains: **1**
- RDAP available or temporarily unavailable: **1**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **1**
- Email provider classified: **1**
- SPF present: **1**
- DMARC present: **1**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### legal-watchlist

- Domains: **1**
- RDAP available or temporarily unavailable: **1**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **1**
- Email provider classified: **1**
- SPF present: **1**
- DMARC present: **1**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### media-watchlist

- Domains: **8**
- RDAP available or temporarily unavailable: **8**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **8**
- Email provider classified: **8**
- SPF present: **8**
- DMARC present: **8**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### namespace-diversity

- Domains: **1**
- RDAP available or temporarily unavailable: **1**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **1**
- Email provider classified: **1**
- SPF present: **1**
- DMARC present: **1**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### nfp-watchlist

- Domains: **15**
- RDAP available or temporarily unavailable: **15**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **15**
- Email provider classified: **15**
- SPF present: **15**
- DMARC present: **15**
- Secure delegation asserted: **1**
- DNSKEY observed: **2**

### platform-hosted

- Domains: **3**
- RDAP available or temporarily unavailable: **3**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **3**
- Email provider classified: **3**
- SPF present: **3**
- DMARC present: **2**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### saas-watchlist

- Domains: **5**
- RDAP available or temporarily unavailable: **5**
- RDAP temporarily unavailable during collection: **1**
- DNS provider classified: **5**
- Email provider classified: **4**
- SPF present: **5**
- DMARC present: **5**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### smb-watchlist

- Domains: **4**
- RDAP available or temporarily unavailable: **4**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **4**
- Email provider classified: **3**
- SPF present: **3**
- DMARC present: **3**
- Secure delegation asserted: **0**
- DNSKEY observed: **0**

### telecom-watchlist

- Domains: **4**
- RDAP available or temporarily unavailable: **4**
- RDAP temporarily unavailable during collection: **0**
- DNS provider classified: **4**
- Email provider classified: **4**
- SPF present: **4**
- DMARC present: **4**
- Secure delegation asserted: **1**
- DNSKEY observed: **1**


---

Generated automatically by the .auDO insight pipeline. This report is deterministic, reproducible, and based on exported observatory artefacts.