Field note
Aggregate provider counts show frequency. Cohort analysis reveals where DNS, mail and registration dependencies cluster across NFP, education and media domains in .auDO's fixed panel.
Overall provider counts show who appears most often. They flatten how different kinds of organisations distribute their public infrastructure across DNS, mail and registration.
Across the fixed 100-domain panel watched by .au Domain Observatory (.auDO), Microsoft leads public mail routing, Amazon and Akamai are prominent in DNS, and CSC leads registration. The aggregate view is useful, but not especially revealing.
The picture changes when the same domains are grouped by cohort.
NFP, education and media domains do not merely favour different suppliers. They combine DNS, mail and registrar services in visibly different ways. The result is three infrastructure fingerprints hidden inside the overall counts.
Those differences matter because domains carry public identity. When their operating layers are delegated across providers, accountability remains with the organisation. A cohort fingerprint helps show where authority appears to be delegated and where dependencies accumulate.
Aggregate counts show frequency. Cohort fingerprints show where dependencies cluster.
| Cohort | DNS | Public mail routing | Registrar |
|---|---|---|---|
| NFP 15 domains |
Cloudflare 5 domains (33.3%) Azure 4 domains (26.7%) |
Microsoft 365 12 domains (80%) |
Melbourne IT 5 domains (33.3%) |
| Education 10 domains |
Self-managed 5 domains (50%) AARNet 3 domains (30%) |
Microsoft 365 4 domains (40%) Mimecast 4 domains (40%) |
Education Services Australia 10 domains (100%) |
| Media 8 domains |
Amazon Route 53 4 domains (50%) Akamai 3 domains (37.5%) |
Google Workspace 4 domains (50%) Proofpoint 3 domains (37.5%) |
CSC 6 domains (75%) |
Latest canonical snapshot from the fixed 100-domain .auDO panel, 29 July 2026. Cohorts are curated observation groups and are not representative samples of their sectors.
The NFP pattern is easy to miss in the aggregate view. Twelve of the 15 domains route public mail through Microsoft 365, while Cloudflare and Azure together operate DNS for nine.
Cloudflare is the standout. NFPs are 15 per cent of the panel, but account for five of Cloudflare's 11 observed domains. Cloudflare appears on 33.3 per cent of NFP domains, compared with 11 per cent of the panel overall - a representation index of 3.03.
In plain English, Cloudflare is about three times as visible in the NFP cohort as it is across the full panel.
Five domains do not describe the Australian charity sector. But this is not one unusual domain bending the result. Within the panel, the NFP cohort has a recognisable Microsoft, Cloudflare and Azure footprint.
The education cohort draws a sharper boundary between layers.
Five of the ten university domains use organisation-managed DNS and another three use AARNet. Public mail routing is far more concentrated: Microsoft 365 and Mimecast each appear on four domains.
All ten registrations sit with Education Services Australia because .edu.au domain names are registered through Education Services Australia. The registrar result reflects the namespace's registration model rather than a provider preference.
The more useful observation is the split: DNS remains comparatively institutional, while mail routing is concentrated in two commercial platforms.
The media cohort has the tightest external footprint.
Seven of the eight domains use Amazon Route 53 or Akamai for DNS. Seven use Google Workspace or Proofpoint for public mail routing. Six are registered through CSC.
No single provider operates every layer. The concentration comes from the same narrow cast appearing repeatedly across the cohort. Compared with the NFP and education domains, the media stack looks more consistently assembled through large external providers.
Public records show arrangement, not intent.
They cannot explain procurement strategy, cost, resilience, technical maturity or why a provider was selected. A service may have been chosen centrally, inherited through acquisition, introduced by a supplier or retained because changing it would be disruptive.
The cohort sizes also matter. Fifteen NFP domains, ten education domains and eight media domains are enough to identify patterns inside this panel, but not enough to generalise across their sectors.
That limitation does not make the patterns meaningless. It defines what can responsibly be said about them.
DNS, mail and registration are operating layers behind an organisation's public identity. A provider appearing in one layer may be unremarkable. The same provider, or the same small group of providers, recurring across a cohort can show where operational dependency is concentrated.
Concentration is not inherently good or bad. Large providers may bring capability, scale and resilience that individual organisations could not reproduce. But delegation does not transfer accountability.
Organisations still need to know which provider carries which part of their public identity, how a failure or change in one layer could affect the others, and who owns recovery when the infrastructure is externally operated.
The three cohorts point to different starting questions. For NFPs, it is the combined dependence on Microsoft mail and Cloudflare or Azure DNS. For universities, it is the boundary between institutionally operated DNS and commercially routed mail. For media organisations, it is the repeated use of a narrow group of external providers across several layers.
That is the practical value of an infrastructure fingerprint: not to judge provider choice, but to make dependency visible enough to govern.
One snapshot is an observation. Repetition turns it into evidence. .auDO can now test whether these fingerprints persist, blur or break as the same 100 domains change over time.
This analysis uses the latest canonical provider matches for the fixed 100-domain .au Domain Observatory panel as at 29 July 2026. Observation date: 29 July 2026.
