# .auDO daily report — 2026-04-29 **Panel:** 100 .au domains across 14 cohorts **Events in current delta:** 34 **Interpretation layer:** enabled **Source manifest:** `data/analysis_manifests/2026-04-29.json` --- ## Today’s reading The fixed .auDO panel now has enough observation history to support cautious interpretation. This report separates visible signals from interpretation, using repeated behaviour, persistence, and concentration as the basis for commentary. The report should be read as an observation of this panel, not as a claim about the whole .au namespace. --- ## Signals observed ### Panel posture - Active domains observed: **100** - Latest snapshot rows analysed: **100** - Cohorts represented: **14** - Recent observatory events: **34** - Recent collector runs analysed: **7** ### Trust-signal posture - SPF present: **99** - DMARC present: **98** - Secure delegation asserted: **13** - DNSKEY observed: **8** ### Activity in the current delta - Observatory events: **34** - Domains affected by observatory events: **25** - Bootstrap events: **0** #### Event types - **a_changed** — 24 - **aaaa_changed** — 8 - **rdap_status_changed** — 1 - **nameservers_changed** — 1 --- ## Interpretation ### What the signals suggest - Basic email trust signals are now close to baseline behaviour in this panel. SPF and DMARC are useful mainly by exception: where they are absent, weak, or inconsistent. - DNSSEC remains a more selective assurance signal. The difference between secure delegation assertions and visible DNSKEY material remains one of the more useful visibility gaps. - Infrastructure concentration remains relevant. DNS providers and registrars are not just operational details; they shape dependency, resilience, and change visibility. - Repeated activity matters more than isolated movement. Domains that appear repeatedly across event types are better candidates for follow-up than one-off changes. ### Movement over the observation window - Largest DNS provider share movement: **0.0** percentage points - Largest registrar share movement: **0.0** percentage points - Repeated-event domain movement: **3** ### Current centres of gravity - **DNS provider:** Amazon Route53 — 20 domains (20.0%) - **DNS provider:** Akamai / Edge DNS — 19 domains (19.0%) - **DNS provider:** Cloudflare — 11 domains (11.0%) - **Registrar:** Corporation Service Company (Aust) Pty Ltd — 35 domains (35.0%) - **Registrar:** Domain Directors Pty Ltd trading as Instra — 12 domains (12.0%) - **Registrar:** Melbourne IT — 12 domains (12.0%) --- ## Better questions This report is intended to raise better questions, not provide final conclusions. - Which trust signals are now baseline expectations across the panel? - Which controls are asserted but not visibly verifiable? - Which domains or cohorts repeatedly generate observable activity? - Which infrastructure dependencies are becoming centres of gravity? - Which apparent changes are meaningful, and which are routine operational movement? --- ## Follow-up candidates ### Trust-signal mismatches - **dnskey_observed_without_secure_delegation_asserted** — 2 - **mx_present_but_no_dmarc** — 1 ### Classification gaps - No classification gaps were surfaced in the latest snapshot. ### Repeated activity - **crikey.com.au** — 2 observatory events across 2 event types - **homeaffairs.gov.au** — 2 observatory events across 2 event types - **kmart.com.au** — 2 observatory events across 2 event types - **news.com.au** — 2 observatory events across 2 event types - **officeworks.com.au** — 2 observatory events across 2 event types --- ## Evidence snapshot ### RDAP availability - RDAP available in latest snapshot: **99** - RDAP temporarily unavailable during collection: **1** - RDAP unavailable / unknown in latest snapshot: **0** ### Collector run health - Runs in exported delta: **7** - Terminal runs: **7** - Successful terminal runs: **7** - Running rows still present: **0** - Terminal success rate: **100.0%** - DNS errors: **0** - RDAP errors: **1** ### Historical readiness - Available daily points: **30** - Sufficient history for interpretation: **True** - Panel start size: **100** - Panel end size: **100** Historical depth is sufficient for guarded interpretation over the fixed panel. --- ## Appendix — cohort profile ### commercial-watchlist - Domains: **14** - RDAP available or temporarily unavailable: **14** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **14** - Email provider classified: **14** - SPF present: **14** - DMARC present: **14** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### critical-infrastructure - Domains: **25** - RDAP available or temporarily unavailable: **25** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **25** - Email provider classified: **23** - SPF present: **25** - DMARC present: **25** - Secure delegation asserted: **9** - DNSKEY observed: **3** ### education-watchlist - Domains: **10** - RDAP available or temporarily unavailable: **10** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **10** - Email provider classified: **10** - SPF present: **10** - DMARC present: **10** - Secure delegation asserted: **0** - DNSKEY observed: **1** ### finance-watchlist - Domains: **8** - RDAP available or temporarily unavailable: **8** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **8** - Email provider classified: **7** - SPF present: **8** - DMARC present: **8** - Secure delegation asserted: **1** - DNSKEY observed: **0** ### founder-surface - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **1** - DNSKEY observed: **1** ### healthcare-watchlist - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### legal-watchlist - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### media-watchlist - Domains: **8** - RDAP available or temporarily unavailable: **8** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **8** - Email provider classified: **8** - SPF present: **8** - DMARC present: **8** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### namespace-diversity - Domains: **1** - RDAP available or temporarily unavailable: **1** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **1** - Email provider classified: **1** - SPF present: **1** - DMARC present: **1** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### nfp-watchlist - Domains: **15** - RDAP available or temporarily unavailable: **15** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **15** - Email provider classified: **15** - SPF present: **15** - DMARC present: **15** - Secure delegation asserted: **1** - DNSKEY observed: **2** ### platform-hosted - Domains: **3** - RDAP available or temporarily unavailable: **3** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **3** - Email provider classified: **3** - SPF present: **3** - DMARC present: **2** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### saas-watchlist - Domains: **5** - RDAP available or temporarily unavailable: **5** - RDAP temporarily unavailable during collection: **1** - DNS provider classified: **5** - Email provider classified: **4** - SPF present: **5** - DMARC present: **5** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### smb-watchlist - Domains: **4** - RDAP available or temporarily unavailable: **4** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **4** - Email provider classified: **3** - SPF present: **3** - DMARC present: **3** - Secure delegation asserted: **0** - DNSKEY observed: **0** ### telecom-watchlist - Domains: **4** - RDAP available or temporarily unavailable: **4** - RDAP temporarily unavailable during collection: **0** - DNS provider classified: **4** - Email provider classified: **4** - SPF present: **4** - DMARC present: **4** - Secure delegation asserted: **1** - DNSKEY observed: **1** --- Generated automatically by the .auDO insight pipeline. This report is deterministic, reproducible, and based on exported observatory artefacts.