DNS Statistics 2026: Benchmarks, Trends and 22 Countries

DNS statistics for 2026 show that 82.2% of queries to Cloudflare's 1.1.1.1 resolver are answered from cache, 12.9% arrive encrypted and 14.5% end in NXDOMAIN, a rate lifted by an August spike. TechnologyChecker's DNS probe of 2,423 live domains finds Cloudflare hosting DNS for 15.4% of them and GoDaddy for 14.2%.

Key DNS statistics at a glance (resolver window 27 Aug to 23 Sep 2026, compared with the same dates in 2025):

I'm David Thomson, CTO at TechnologyChecker. I spent five years on crawling and indexing systems in Google Search, and I now run the crawler that sweeps our index of about 30 million live business domains. Every one of those fetches starts with a DNS lookup, so these numbers are the first thing that goes wrong for us when the internet misbehaves.

What are DNS statistics?

DNS statistics are counts and ratios describing how the Domain Name System is used: which record types get asked for, how often lookups fail, how much is served from cache, how queries travel and who runs the servers that answer them. The term covers four different populations, and mixing them up is the most common way these numbers get misread.

• Recursive resolver statistics describe the lookups a resolver performs for its users. Your ISP's resolver, a corporate resolver and a public one such as 1.1.1.1 all produce them.
• Authoritative statistics describe the queries a zone's own nameservers receive. Route 53, Cloudflare DNS or a BIND box in your data centre sees these.
• Public-resolver telemetry is resolver data published at internet scale. Cloudflare Radar's DNS dashboard is the main open source of it, and it's the backbone of the traffic sections below.
• Zone and domain data describes how domains are configured: nameservers, MX records, SPF, DMARC, DNSSEC signing. This is where TechnologyChecker's probe comes in.

Search for "DNS statistics" today and you mostly get vendor manuals: the PowerShell cmdlet that dumps counters from a Windows DNS server, a statistics screen in a load balancer. Useful if you already know what you're looking at. None of them tells you whether 14% NXDOMAIN is normal, and that's the question I kept wanting answered, so this page puts the internet-wide numbers next to each counter.

Which DNS record types do resolvers answer most?

A records still dominate. 65.0% of queries to 1.1.1.1 ask for an IPv4 address and another 20.9% are AAAA lookups for IPv6, so address lookups make up 86% of resolver traffic. Every other record type, HTTPS and MX included, fights over the last 14%.

AAAA gained more share than any other type. It's tempting to read that as IPv6 winning, and it isn't: only 9.0% of queries reached the resolver over IPv6, down from 9.3%. Dual-stack clients ask for both A and AAAA over whatever link they have, so AAAA share tracks IPv6-capable software, not IPv6-connected users.

The HTTPS record (defined in RFC 9460) lets a site advertise HTTP/3 support and connection hints before the first request. Its query share fell 1.4 points in a year. That points in the same direction as the HTTP/3 figures in our HTTP protocol adoption tracker, though I wouldn't claim one causes the other from query shares alone.

ANY queries return every record at a name, which makes them useful for amplification attacks and little else. RFC 8482 lets servers answer them with a minimal response instead. If ANY still shows up in your own resolver logs at more than a fraction of a percent, check where it comes from.

How often do DNS lookups fail?

About one DNS lookup in six comes back without a usable address. Across the 27-day window, 83.2% of 1.1.1.1 responses were NOERROR, 14.5% were NXDOMAIN and 2.1% were SERVFAIL. REFUSED and NOTIMP together were 0.2%.

The NXDOMAIN jump is an August event, not a trend. The weekly series sat around 10 to 11% from April to the end of July, then went to 13.5% in the week of 3 August and 18.0% the week after. It held near 16% for the rest of August and was back to 11.8% by the week of 14 September. The 27-day figure above catches the tail of that surge. A rate that moves seven points in two weeks and drifts back is almost always a handful of noisy sources, not a change in how people browse. The usual NXDOMAIN drivers are:

• software appending search-domain suffixes (api.example.com.corp.local)
• malware and ad-fraud tooling generating random names
• misconfigured devices retrying a retired hostname
• scanners and typos, which are a steady background rather than a spike

My first guess was cloud servers, because a lot of 1.1.1.1's traffic comes from data centres. The network split says no. Home broadband sits right on the global average, and two of the big cloud networks sit below it:

Starlink is the outlier, with close to one answer in four an NXDOMAIN, and 10.5% of its queries are reverse (PTR) lookups against 3.9% overall. Tencent's traffic looks nothing like people at all: 50.8% A, 49.1% AAAA and almost no HTTPS-record queries, which is what a fleet of servers resolving the same backends produces.

Negative answers are cacheable too. Under RFC 2308, the NXDOMAIN cache time comes from the lower of the zone's SOA TTL and its SOA MINIMUM field, so a zone with a tiny SOA minimum pushes repeated misses back to its authoritative servers.

Domains fail at the zone level as well. When we probed our random sample of 2,567 live business domains on 23 September, 66 (2.6%) returned NXDOMAIN and 19 (0.7%) returned SERVFAIL. Those were all domains our crawler had seen serving a website. Registrations lapse and zones break between one scan and the next, so any domain list starts decaying the day it's built.

How much DNS is served from cache?

Most of it. 82.2% of queries to 1.1.1.1 were answered straight from cache in the 2026 window, level with 82.4% a year earlier. The trailing 52-week average is lower, at 79.8%, because the ratio dipped in spring, to 75.2% for April as a whole, before recovering.

A cache hit ratio in the low 80s at this scale is a useful ceiling for anyone running their own resolver. A public resolver serving millions of clients shares cache entries across all of them. A company resolver with a few thousand users will see fewer repeat names and should expect a lower ratio.

Why isn't it higher? Short TTLs. 75.0% of answers carried a TTL of one minute or less, down from 78.3% a year ago.

The TTL a resolver returns is the time remaining in its cache, not the TTL set in the zone file, so a cached one-hour record shows up as anything between zero and 60 minutes. Even allowing for that, most of what users resolve is set to expire quickly. CDNs and load balancers use short TTLs to steer traffic, and they account for a large share of popular names.

My view: if you don't do DNS-based failover on a record, a 60-second TTL buys you nothing except resolver load and slower first lookups. The small shift this year from sub-minute answers towards the 1-to-5-minute bucket may mean some operators have made the same call, though remaining-TTL data can't prove it.

How much DNS traffic is encrypted?

Roughly one query in eight. 12.9% of queries to 1.1.1.1 arrived encrypted in the 2026 window, 6.5% over DNS over HTTPS (DoH) and 6.3% over DNS over TLS (DoT), up from 12.0% a year earlier. Plain UDP still carries 85.1% of queries, and plain TCP 2.0%.

The two protocols swapped places during the year. DoH, standardised in RFC 8484, rose from 5.2% to 6.5%, while DoT, from RFC 7858, slipped from 6.8% to 6.3%. DoH runs inside browsers and apps. DoT is mostly an operating-system setting, which is why it's so uneven by country.

India is DoT-heavy: 22.6% of its 1.1.1.1 queries use DoT against 5.9% DoH. That pattern fits mobile-first traffic, since Android's Private DNS setting uses DoT. South Korea lost 11 points in a year and Japan almost 6, while the UK, Russia and Germany gained 5 to 6.5 points each. The United States sits at 8.2%, below the global figure. A likely reason is the volume of US traffic that reaches 1.1.1.1 from routers and servers, which rarely encrypt DNS.

How many domains use DNSSEC?

11.0% of 1.1.1.1 answers were DNSSEC-validated as secure in the 2026 window, up from 8.1%. Only 0.54% of queries were protected end to end, meaning a DNSSEC-aware client asked and a validated answer came back. Bogus (INVALID) answers stayed at 0.06%.

The rise wasn't gradual. By calendar month, the validated-secure share sat between 8.0% and 8.3% from January to July 2026, then jumped to 11.8% in August, the same month NXDOMAIN spiked. One explanation fits both: denials for random names under a signed TLD such as .com validate as secure, so a burst of junk lookups can lift both numbers at once. Summary data can't confirm that, so treat it as a hypothesis.

The client side went the other way. Queries from DNSSEC-aware clients fell from 13.2% to 10.0%, so more signed answers are going to clients that don't check them. Our DNSSEC adoption tracker follows these numbers month by month. Its August 2026 figure (11.8% signed) is the same calendar-month number as above; this page's headline 11.0% uses the 27 August to 23 September window instead.

From the zone side, TechnologyChecker's probe finds 8.3% of live business domains signed, with a DS record in the parent zone (±1.1 points at 95% confidence). Only 3.7% publish a CAA record, which restricts which certificate authorities may issue for the domain. Among CAA records, letsencrypt.org is the CA named most often, followed by Google's pki.goog.

What does TechnologyChecker's crawl see in DNS?

Every domain we crawl starts with a DNS lookup, and the answers are detection signals in their own right. TechnologyChecker's crawler reads the nameserver, mail-exchanger and TXT records at the root of each of the 30,287,857 live domains in our index and matches them against 18 nameserver patterns, 39 mail patterns and 134 TXT patterns. That's how we know which mail provider or DNS host a company uses without loading a single web page.

Here's what that looks like on our own domain, resolved on 23 September 2026:

$ dig +short technologychecker.io NS
kirk.ns.cloudflare.com.
tina.ns.cloudflare.com.

$ dig +short technologychecker.io MX
1 smtp.google.com.

$ dig +short technologychecker.io TXT
"v=spf1 include:amazonses.com ~all"
"google-site-verification=..."   (two tokens)

$ dig +short _dmarc.technologychecker.io TXT
"v=DMARC1;p=quarantine;rua=mailto:..."

The MX line is the one I trust most. It has to be right for mail to arrive, so a stale MX record breaks something and gets fixed. TXT verification tokens are the opposite: nothing breaks when they outlive the service, which is why we treat them as history rather than a live install.

Across the whole index, these are the DNS-derived counts on 23 September 2026:

GoDaddy and Microsoft 365 are the two counts we re-checked record by record: the detection agreed with the live lookup on 352 of 356 and 307 of 311 sampled domains. Read the three SPF-include rows as accounts rather than current sending, since an include line usually stays in place after a team stops using the service.

Who hosts the web's DNS?

Two companies. Cloudflare and GoDaddy run the authoritative DNS for 29.6% of live business domains between them, and no other nameserver operator passes 4%. These shares come from TechnologyChecker's NS lookups on a random sample of 2,423 live, resolving domains on 23 September 2026.

A third of live domains use nameservers outside the top 30, mostly local registrars and hosting companies. The part that surprised me is how small the big cloud DNS products are: Route 53, NS1, Google Cloud DNS and Azure DNS add up to 7.6%.

Parking and aftermarket nameservers get their own row because they're a real category, and an annoying one. 3.3% of domains that serve something also delegate DNS to a parking or domain-sale service. For anyone building a prospect list from domains, that bucket is noise worth filtering.

For GoDaddy, where the nameserver and mail-exchanger patterns are unambiguous, we can go beyond the sample. GoDaddy DNS or GoDaddy email appears on 4,616,211 live domains, 15.2% of the 30.29 million in TechnologyChecker's index, and that detection matched the NS probe on 352 of 356 sampled domains. For scale, the Verisign Domain Name Industry Brief counts 401.6 million registered domains at the end of Q2 2026. Only about one in 13 of those runs a live business site we can detect. You can browse operators by footprint in our DNS and domain services category.

How are domains' email DNS records configured?

Google Workspace receives mail for 19.8% of live domains that publish an MX record, and Microsoft 365 for 16.4%. 21.4% of live business domains publish no MX record at all. Those shares come from the same 2,423-domain probe; 1,892 of the domains had an MX record.

Across the full index, Microsoft 365 handles mail for 4,051,686 live domains (13.4%), a count that agreed with the sample probe on 307 of 311 domains. Google's full-index count runs low because Google's newer single-MX setup (smtp.google.com) isn't in every detection pattern yet, so the sample share above is the better guide to Google's lead.

Then the authentication records thin out fast:

• SPF: 68.5% of live domains publish one (83.8% of those with MX). 24 domains in the sample publish two SPF records, which makes SPF evaluation fail outright.
• DMARC: 39.3% publish a record. Of those, 64.4% are set to p=none, 19.9% to quarantine and 15.3% to reject.
• Enforcement: only 13.9% of all live domains enforce DMARC with quarantine or reject, and 6.0% reject.

The message-level side of this, meaning how much delivered mail passes DMARC, is tracked in our DMARC adoption statistics.

Where does resolver traffic come from?

Mostly the US, then Brazil, Germany and Singapore, at 23.2%, 8.1%, 7.1% and 5.6% of queries to 1.1.1.1. Singapore more than doubled from 2.2% a year earlier. Brazil dropped 2.8 points.

Country shares hide a lot, though, and the network list shows what. The single largest source network is SpaceX Starlink at 8.97% of all queries, up from 7.67%. That's about seven times Comcast's 1.23%. Tencent's cloud (3.73%) is second, followed by DigitalOcean (2.07%), Hetzner (1.33%), Zenlayer (1.12%), OVH (1.04%), Vultr (1.03%) and Amazon (1.02%). A good share of public-resolver traffic comes from servers, not people, and a cloud region in Singapore shows up as Singaporean traffic.

By top-level domain, .com names account for 62.4% of queries and .net for 11.6%. Reverse lookups under .arpa are 4.3%. The fastest movers:

Radar also publishes a DNS Magnitude score, a 0 to 10 index of how many distinct networks query a TLD rather than how many queries it gets. .com scores 9.98, .net 9.89, .org 9.75 and .io 9.73. A TLD can have high reach and modest volume, so don't read magnitude as traffic share.

AS112 is a separate population entirely. Under RFC 7534, AS112 nodes act as a sink for reverse lookups of private address space and similar queries that shouldn't reach the public DNS. Cloudflare's AS112 data shows 44.1% of this traffic coming from the US, all of it over IPv4 and 99.96% over plain UDP. If your network leaks in-addr.arpa lookups for 10.x or 192.168.x addresses, some of this is yours.

How did DNS change month by month in 2026?

Most of 2026 was flat, and then August happened. Encrypted DNS, cache hits and AAAA lookups drifted up slowly, while NXDOMAIN and DNSSEC-validated answers jumped in a single month. Here's the calendar-month view from Cloudflare Radar, with 2025 alongside where Radar has it:

A few things stand out once you read down the columns:

• NXDOMAIN stayed between 9.9% and 11.4% in every month of 2025 and the first seven months of 2026. August's 15.2% is the only break in 21 months, and Radar carries no annotation explaining it.
• February's 4.9% SERVFAIL is an incident, not a trend. Radar flags an anomalous query flood over TCP on 11 to 13 February 2026, which is why I'd leave that month out of any SERVFAIL baseline.
• Cache hits climbed from a 75.2% low in April to 82.3% in September. That's seven points in five months on a resolver this size, and it lines up in time with the shift in TTLs away from sub-minute answers described above.
• AAAA share hovered around 20 to 22% all year, up from 16.8% in January 2025. IPv6 transport stayed near 9% throughout, so the software asking for IPv6 addresses is growing faster than the networks carrying IPv6.

The encryption story has a twist that a 12-month comparison hides. In January 2025, DoH was only 1.7% of queries and DoT 10.0%. The two swapped over in June and July 2025, when DoH jumped to 4.7% and DoT fell to 6.9%. The encrypted total barely moved, so this looks like the same clients switching protocol rather than new clients encrypting.

How do DNS statistics differ by country?

A lot more than the global averages suggest. NXDOMAIN ranges from 4.2% of Singapore's 1.1.1.1 responses to 49.9% of Ukraine's, and IPv6 transport from 0.3% in Singapore to 18.0% in Canada. The table covers the 20 countries sending the most queries to 1.1.1.1 over 27 August to 23 September 2026, plus South Korea and Turkey:

Ukraine and Argentina are the numbers I'd want explained before quoting them anywhere. Half of Ukraine's answers are NXDOMAIN, and both countries also have very high cache-hit ratios (91.5% and 92.3%) and very low AAAA shares. That combination usually means a small set of clients asking for the same non-existent names over and over, which caches well and says little about ordinary users. Russia's 24.3% NXDOMAIN comes with the highest SERVFAIL in the table (5.5%), and I'd expect filtering to be part of that picture.

Singapore, China and Hong Kong look like server traffic. Singapore sends 5.6% of all 1.1.1.1 queries, yet only 0.7% of its queries are HTTPS records, 2.0% come from DNSSEC-aware clients and 0.3% arrive over IPv6. Browsers ask for HTTPS records all the time, so a country where almost nothing does is mostly machines. It's the same pattern as the Tencent network above, and it's the likelier reason Singapore's share more than doubled in a year.

India stands out for DNSSEC-aware clients (26.3%, against 10.0% globally) as well as for DoT. North America leads on IPv6 transport: Canada 18.0%, Mexico 16.4% and the US 14.2%, while most of Europe sits in single digits.

How to benchmark your own DNS against these numbers

Put your resolver or zone counters next to the references below and look hard at anything far outside them. These are reference points taken from one very large public resolver, not service-level targets. A corporate resolver won't look like an ISP resolver, and neither looks like an authoritative server. That's fine.

The response-time figures come from Cloudflare's Internet Quality Index, which estimates DNS response time from speed-test measurements. They describe what end users experience, not how fast 1.1.1.1 itself answers. The median went up 3.3 ms on the year while the 75th percentile improved by 2.6 ms, so the slowest quarter of users got slightly faster.

You probably have the counters already. Each of these pulls response codes and cache hits from a common resolver:

unbound-control stats_noreset | grep -E "total.num.queries|total.num.cachehits|num.answer.rcode"

rndc stats   # appends counters to named.stats in named's working directory
grep -E "NXDOMAIN|SERVFAIL|queries resulted" named.stats

curl -s http://localhost:9153/metrics | grep -E "coredns_dns_responses_total|coredns_cache_(hits|misses)_total"

Get-DnsServerStatistics -ComputerName "dns01"

Managed DNS (Route 53, Cloudflare, Google Cloud DNS) exposes the same numbers through query logging or the provider's analytics view.

Then compare them in four steps:

Methodology

Resolver data (Cloudflare Radar). All traffic, response, caching, encryption, DNSSEC, country, network and TLD figures describe queries received by Cloudflare's 1.1.1.1 public resolver. We pulled them from the Radar API on 23 September 2026 for the window 27 August to 23 September 2026 (27 days), because Radar's standard 28-day preset returned errors on DNS endpoints that day. Year-on-year comparisons use the same calendar dates in 2025. Trailing figures cover the 52 weeks to 21 September 2026. That period contains seven Radar-flagged DNS events, including request floods and the 18 November 2025 Cloudflare service degradation. Radar's weekly query-volume index sits near its 52-week high, but floods fall inside that period, so this page makes no claim about overall DNS growth.

Monthly, country and network breakdowns. Monthly figures are calendar-month summaries from the same Radar endpoints (September covers 1 to 22 September in both years). Country and network figures use the 27 August to 23 September 2026 window, filtered by Radar's location and ASN parameters. Radar annotations in the period: an anomalous TCP query flood on 11 to 13 February 2026, and an IP geolocation provider change on 4 June 2025.

AS112 and IQI. AS112 figures cover the AS112 nodes Cloudflare observes, not the global AS112 system. IQI response times are Cloudflare's end-user quality estimates.

Domain data (TechnologyChecker). Our index held 30,287,857 live business domains on 23 September 2026. For the nameserver, MX, SPF, DMARC, DNSSEC and CAA figures, we drew a deterministic random sample of 2,567 of them and resolved NS, MX, apex TXT, _dmarc TXT, DS and CAA records the same day. We excluded 85 domains that returned NXDOMAIN or SERVFAIL and 38 platform subdomains (sites on shared hosting domains), leaving 2,423 resolving domains. Margins at 95% confidence are about ±1.4 points at 15%, ±1.1 at 8% and ±0.8 at 4%. Full-index counts appear only where a detection pattern agreed with the probe on nearly every sampled domain (GoDaddy and Microsoft 365).

Limits. One resolver is not the internet: as the network table shows, a large share of 1.1.1.1's traffic comes from satellite and cloud networks, so its mix differs from an ISP resolver's. Our sample covers domains running a detectable website, not all registered domains. Provider shares from the sample carry the margins shown and shouldn't be read to the decimal.

Frequently asked questions

What are some examples of DNS statistics?

Common examples include the query-type mix (65% A, 21% AAAA at 1.1.1.1), response codes (NXDOMAIN, SERVFAIL), cache hit ratio, answer TTLs, encrypted-transport share, DNSSEC validation rates and nameserver market share. Operators also track queries per second and response latency on their own servers.

What are the four most common types of DNS records?

By resolver query volume in 2026, the four most requested types are A (IPv4 address), AAAA (IPv6 address), HTTPS (service binding for HTTP/3 and connection hints) and PTR (reverse lookup). By what domains configure, NS, MX, TXT and CNAME are the everyday records alongside A and AAAA.

What is a good DNS response time?

Cloudflare's Internet Quality Index puts the median DNS response time for end users at 56.5 ms, with the fastest quarter under 34 ms and the slowest quarter above 94 ms. A cached answer from a nearby resolver usually arrives in single-digit milliseconds; uncached lookups that go to distant authoritative servers take longer.

What is a typical DNS cache hit ratio?

A very large shared resolver answers about 80 to 82% of queries from cache. Smaller resolvers serving one office or company typically see lower ratios because fewer clients repeat the same names. Low TTLs cap the ratio too, since three-quarters of answers expire within a minute.

How common are DNS lookup failures in 2026?

At 1.1.1.1, 2.1% of responses were SERVFAIL and 14.5% NXDOMAIN in the 27 days to 23 September 2026, a window inflated by an August NXDOMAIN surge (the 52-week average is 11.5%). SERVFAIL is closer to a true failure rate. Most NXDOMAIN answers are software asking for names that don't exist rather than users hitting broken sites.

What share of DNS queries use DoH or DoT encryption?

12.9% of queries to 1.1.1.1 were encrypted in September 2026: 6.5% DNS over HTTPS and 6.3% DNS over TLS. Encrypted share ranges from 3.8% in China to 28.5% in India among the large countries we checked.

What does a DNS test check?

A DNS test usually checks whether a name resolves, which nameservers answer, how long the answer takes, which records are published (A, MX, TXT) and whether DNSSEC validates. Speed tests compare resolver latency; configuration tests look for missing SPF or DMARC, lame delegations and mismatched nameservers.

How do I view my DNS records?

Run dig example.com NS, dig example.com MX or dig TXT _dmarc.example.com on macOS or Linux, or nslookup -type=MX example.com on Windows. Your DNS provider's dashboard shows the full zone. To see which DNS, email and hosting providers any domain uses, look it up on TechnologyChecker.

Which public DNS resolver is fastest in 2026?

It depends on where you are. Resolver speed is dominated by the distance to the nearest server and by whether the answer is cached, so rankings change between cities and networks. Test from your own location over several days rather than trusting a single global ranking.

How do DNS failure rates affect SaaS application uptime?

Every API call and page load starts with a lookup, so a SERVFAIL on your domain looks like an outage to the user even when your servers are fine. Monitor resolution of your own hostnames from several external resolvers, keep TTLs long enough to ride out a short authoritative outage, and use more than one DNS provider for critical zones.

Update history