On 26 September 2026 we measured the public DNS and HTTPS setup of 100 apex domains run by widely used developer platforms and projects. 78 sent an HSTS header, 61 published IPv6 addresses, and 45 restricted certificate issuance with CAA, but only 15 signed their zone with DNSSEC. Every number below comes from one scripted run, and every row is downloadable.

What we measured and why

Developer platforms are the hosts, registries, and tools that small teams deploy to and depend on. Their public configuration shows which controls are routine among large operators and which are still unusual, and anyone with a resolver and an HTTP client can see it.

For each apex domain we recorded:

  • DNS, from Cloudflare’s DNS-over-HTTPS JSON API: A, AAAA, CAA, NS, DS with the resolver’s AD (authenticated data) flag, HTTPS (type 65), MX, SPF (an apex TXT record starting with v=spf1), and the DMARC policy at _dmarc.<domain>.
  • HTTP: the first response to https://<domain>/ and https://www.<domain>/, up to five redirects followed one at a time, the final host, and the Strict-Transport-Security header on the apex’s first response.
  • TLS: the issuer of the certificate the apex served, and the negotiated TLS version.

We did not enumerate subdomains, test for vulnerabilities, or score anyone. Besides each apex, the only names queried were its www host and its _dmarc policy name.

How the survey was run

The sample

We chose the list by hand: platforms and projects that developers commonly depend on, whose own website lives at the apex or its www host. Products under a parent company’s domain, such as aws.amazon.com or cloud.google.com, are excluded, because that apex describes the parent company. This is a convenience sample, not a random or traffic-ranked one.

Category Domains
Cloud & app hosting (13) vercel.com, netlify.com, heroku.com, render.com, fly.io, railway.com, digitalocean.com, linode.com, vultr.com, hetzner.com, ovhcloud.com, scaleway.com, backblaze.com
DNS, CDN & domains (12) cloudflare.com, fastly.com, akamai.com, bunny.net, gcore.com, dnsimple.com, namecheap.com, porkbun.com, gandi.net, godaddy.com, quad9.net, nextdns.io
Code hosting & CI/CD (12) github.com, gitlab.com, bitbucket.org, codeberg.org, sr.ht, gitea.com, sourcegraph.com, circleci.com, travis-ci.com, buildkite.com, jenkins.io, codecov.io
Package registries (12) npmjs.com, pypi.org, crates.io, rubygems.org, packagist.org, nuget.org, maven.org, hex.pm, pub.dev, cocoapods.org, jsr.io, quay.io
Developer tools & APIs (13) jetbrains.com, postman.com, atlassian.com, linear.app, stripe.com, twilio.com, algolia.com, docker.com, hashicorp.com, tailscale.com, ngrok.com, replit.com, huggingface.co
Databases & backend services (13) supabase.com, planetscale.com, neon.com, mongodb.com, redis.io, cockroachlabs.com, clickhouse.com, upstash.com, turso.tech, convex.dev, prisma.io, postgresql.org, sqlite.org
Observability & security (12) datadoghq.com, sentry.io, newrelic.com, grafana.com, honeycomb.io, pagerduty.com, elastic.co, posthog.com, letsencrypt.org, snyk.io, 1password.com, auth0.com
Languages, frameworks & docs (13) python.org, rust-lang.org, go.dev, nodejs.org, deno.com, bun.sh, typescriptlang.org, php.net, react.dev, vuejs.org, djangoproject.com, kubernetes.io, stackoverflow.com

Tools, timing, and vantage point

  • One run on 26 September 2026, 14:59:55 to 15:11:59 UTC, from a macOS workstation in South Korea. A pilot run earlier that day was used only to fix the script; its results are not published.
  • A Python 3.13.2 script using only the standard library, with OpenSSL 3.6.3. Requests were sequential, with a 0.4-second pause before each, a 15-second timeout, and one retry after a network error.
  • DNS came from https://cloudflare-dns.com/dns-query with accept: application/dns-json and do=1 on every query.
  • HTTP used Python’s urllib (HTTP/1.1) with a User-Agent naming this survey. HTTP and TLS connections resolved names through the workstation’s ISP resolver, not through Cloudflare.
  • Chromium’s HSTS preload list source file was fetched at 15:14:19 UTC to see which of the 100 domains it covers.

We set the DO bit because the pilot showed that, without it, Cloudflare’s JSON API does not report the AD flag consistently for signed zones. RFC 6840 (section 5.8) says a validating resolver should set AD only when the query carried the DO or AD bit, so a missing AD on a plain query does not mean validation failed.

Live capture, 26 September 2026 (15:15 UTC). The same A query for three DNSSEC-signed domains from the sample, first without and then with the DO bit:

for d in pypi.org codeberg.org nextdns.io; do
  for q in 'type=A' 'type=A&do=1'; do
    printf '%-13s %-12s ' "$d" "$q"
    curl -s -H 'accept: application/dns-json' \
      "https://cloudflare-dns.com/dns-query?name=$d&$q" | grep -o '"AD":[a-z]*'
    sleep 0.5
  done
done
pypi.org      type=A       "AD":false
pypi.org      type=A&do=1  "AD":true
codeberg.org  type=A       "AD":false
codeberg.org  type=A&do=1  "AD":true
nextdns.io    type=A       "AD":true
nextdns.io    type=A&do=1  "AD":true

Without the DO bit, two of the three signed zones came back "AD":false; with do=1, all three validated. Leaving out do=1 would have undercounted validated zones.

Limitations

  • Convenience sample. With twelve or thirteen domains per category, a gap of one or two domains between categories is noise.
  • Location matters. CDNs answer by region, so addresses, HTTPS records, certificates, and redirects can differ elsewhere. The akamai.com apex, for example, redirected us to https://akamai.com/ko.
  • One resolver, one moment. AD reflects Cloudflare’s validation only, and every value comes from one window of about twelve minutes.
  • A script is not a browser. One apex answered our first request with HTTP 429, so its redirect and HSTS behavior went unobserved. Six more ended in a 403 after a redirect, which we did record.
  • www failures are coarse. Five www hosts did not complete an HTTPS request. We publish that fact but not the reason, because some failure types can look like a dangling DNS record, and we do not publish hints of that kind about other people’s domains.
  • Provider labels are conservative. A DNS provider is named only when nameserver hostnames match a well-known pattern. Nameservers under the domain itself, such as ns3.cloudflare.com for cloudflare.com, count as “other/unknown”, a label that appears for 13 domains.

CAA: restrictive policies list several CAs

47 domains publish a CAA record set at the apex, and 45 of those restrict issuance. The other two publish only a contactemail property, which under RFC 8659 does not limit which CA may issue.

CAA at the apex Domains
No CAA records 53
issue and issuewild 25
issue only 19
issuewild only 1
Only tags that do not restrict issuance (contactemail) 2

The restrictive policies are allow-lists, not pins. Among the 44 domains with issue properties, the median names four identifiers, and only two name exactly one. Eleven of the 25 domains that use both tags give wildcard certificates a different list, and 24 domains add an iodef address for violation reports.

Identifier in CAA, as written Domains naming it
letsencrypt.org 41
digicert.com 29
pki.goog 27
amazon.com 21
sectigo.com 17
comodoca.com 17
globalsign.com 13
ssl.com 11
amazonaws.com 10
awstrust.com 6
amazontrust.com 6

Nine more identifiers appear on one or two domains each, and one domain uses the empty value ;, which forbids issuance for that tag. pki.goog is Google Trust Services’ identifier. AWS Certificate Manager accepts any of four names (amazon.com, amazontrust.com, awstrust.com, amazonaws.com), which is why the Amazon names show up in different combinations.

DNSSEC, IPv6, HTTPS records, and nameservers

DNSSEC: 15 signed zones, all validating

15 domains have a DS record in their parent zone, and all 15 returned "AD":true for their A record with do=1. Twelve use algorithm 13 (ECDSA Curve P-256 with SHA-256) and three use algorithm 8 (RSA/SHA-256). Five of the signed zones use Cloudflare nameservers, three use Route 53, and the other seven are spread across six other nameserver setups.

IPv6 and HTTPS records

61 apex domains return at least one AAAA record.

22 publish an HTTPS record (RFC 9460) at the apex. 21 are in ServiceMode, which carries connection hints such as alpn protocols and address hints; nine of them list h3. One, akamai.com, uses AliasMode (0 www.akamai.com.edgekey.net.), which points the apex at another name much as a CNAME would.

HTTPS records cluster on one provider: 17 of the 27 domains on Cloudflare nameservers publish one, against 5 of the other 73. Cloudflare documents that it generates HTTPS records automatically for proxied hostnames. We did not check which hostnames are proxied, so the cluster is consistent with that default rather than proof of it.

Who runs the nameservers

DNS provider, from NS hostnames Domains using it
Amazon Route 53 33
Cloudflare 27
Google Cloud DNS 7
Akamai Edge DNS 5
NS1 4
Azure DNS 3
Other/unknown 13

UltraDNS, bunny.net, DNSimple, and Namecheap appear twice each, and nine more providers once each. Nine domains mix nameservers under more than one label, so the counts overlap. One domain returned no NS records at its apex.

HSTS: a common header, fewer preload-ready ones

78 apex domains sent Strict-Transport-Security on their first HTTPS response.

What the apex’s first HTTPS response sent Domains
max-age + includeSubDomains + preload 35
max-age only 31
max-age + includeSubDomains 7
max-age + preload 5
No header 22

One year (max-age=31536000) was the most common value (42 domains), then two years (63072000, 25). Nine sent a value between one day and one year, one sent ten years, and one sent max-age=0, which tells browsers to forget the policy.

31 headers meet the preload list’s minimum: a max-age of at least one year, plus includeSubDomains and preload. Of the nine other headers with preload, four have a max-age under a year and five lack includeSubDomains.

Headers and list membership do not line up. Chromium’s list covers 34 of the 100 domains: 29 through their own entries, and five (go.dev, pub.dev, react.dev, convex.dev, linear.app) because the whole .dev and .app suffixes are preloaded. 27 of the 40 domains that send preload are on the list, and 7 listed domains leave preload out of the header on the apex’s first response.

On www-canonical sites the apex redirect matters. Of the 38 apexes that redirect to www, 27 sent HSTS on that redirect and 13 included includeSubDomains there. Across all 100, six domains sent no header on the apex’s first response but did on the final page. Why that first response matters is covered in HSTS, includeSubDomains, and preload.

Canonical host and certificates

Apex or www

Where https://<apex>/ ended up Domains
Stayed on the apex; www redirects to the apex 51
Stayed on the apex; the www request failed 4
Redirected to www 38
Redirected to another subdomain, such as about. 3
Apex and www both answered without redirecting 3
Undetermined (429 on the first request) 1

Of the 38 redirects to www, 34 used 301, three used 308, and one used 302. Five apexes that “stayed on the apex” redirected to a path on the same host, such as a language or landing page. Overall, 54 apexes answered without a redirect, 42 needed one, and four needed two. The trade-offs are in www vs apex canonical redirects.

Certificate issuers and TLS versions

Issuer organization of the apex certificate Domains
Let’s Encrypt 43
Google Trust Services 19
Amazon 12
DigiCert Inc 11
Sectigo Limited 7
GlobalSign nv-sa 4
Microsoft Corporation 2
Certainly 1
Gandi SAS 1

95 servers negotiated TLS 1.3 with our client and 5 negotiated TLS 1.2. These are the certificates served to our vantage point; a CDN can serve a different one in another region.

Email authentication: SPF and DMARC

98 domains have MX records. 96 publish SPF: 54 end in ~all, 39 in -all, two delegate with redirect=, and one has no all term.

DMARC policy (p=) Domains
reject 49
quarantine 28
none 16
No DMARC record 7

35 records set a separate subdomain policy (sp=). 47 still carry pct, 45 of them as pct=100; RFC 9989, published in May 2026 to replace RFC 7489, removed pct in favor of a t= testing flag.

Patterns worth noting

  1. DNSSEC is the outlier. 78 domains send HSTS, 77 enforce DMARC, and 45 restrict issuance with CAA, but only 15 sign their zone. Each of the others is a single header or record the site’s team publishes; DNSSEC also needs the DNS provider to sign the zone and the parent registry to publish a DS record.
  2. Platform defaults show up in the data. Most HTTPS records sit on Cloudflare nameservers (17 of 22), which matches a documented automatic feature rather than 17 separate decisions.
  3. CAA is an allow-list. Only two domains name a single identifier, and Let’s Encrypt appears in 41 of the 45 restrictive policies.
  4. Preload is a list, not a header. 13 of the 40 domains that send preload are not on Chromium’s list, and 7 listed domains do not send it on the apex’s first response. Browsers act on the list entry.
  5. Email policy is mostly enforced. 77 of 100 publish p=quarantine or p=reject; 7 publish no DMARC record.

By category

Read this table as description, not ranking: each row covers only twelve or thirteen domains.

Category Domains Restrictive CAA DNSSEC IPv6 HTTPS record HSTS on apex DMARC reject
Cloud & app hosting 13 7 1 9 2 8 8
DNS, CDN & domains 12 6 4 9 4 9 6
Code hosting & CI/CD 12 8 1 8 2 10 5
Package registries 12 5 2 9 4 10 5
Developer tools & APIs 13 6 1 7 4 10 10
Databases & backend services 13 3 2 4 2 9 6
Observability & security 12 6 3 6 0 11 5
Languages, frameworks & docs 13 4 1 9 4 11 4

What a small team can copy

  • CAA: name every CA your hosting, CDN, and certificate tooling may use (a median of four here), not just the one on today’s certificate. Build the records with the CAA record generator and confirm what resolvers return with the DNS lookup tool.
  • DNSSEC: if your DNS provider can sign the zone, the remaining step is usually a DS record at your registrar; read DNSSEC for site owners first. Our lookup tool sets the DO bit on every query for the reason shown in the capture above, so its AD flag reflects validation.
  • HSTS: send the header on the apex’s own response, including its redirect to www, and ramp max-age up in stages with includeSubDomains before you add preload.
  • Canonical host: pick the apex or www and answer the other with one permanent redirect, as 37 of the 38 www-canonical sites did with 301 or 308.
  • DMARC: start at p=none with aggregate reports, then move to quarantine or reject once your legitimate mail passes, where 77 of these domains already are.

Download the data

developer-domains-2026-09.csv has one row per domain: 100 rows, 54 columns, UTF-8, comma-separated. Cells with several values, such as addresses, nameservers, and CAA identifiers, separate them with spaces. A failed lookup or request is written as error: …, never left blank or guessed.

Columns Contents
domain, category, measured_at_utc The apex, its category, and when its measurement started (UTC)
a_records, a_count, aaaa_records, aaaa_count, ipv6 Apex addresses returned by Cloudflare’s resolver
ns_hosts, dns_provider Nameserver hostnames and the provider label derived from them
ds_present, ds_algorithms, ad_flag DS record at the parent, its algorithm numbers, and AD on the A answer (with do=1)
caa_present, caa_policy, caa_issue, caa_issuewild, caa_iodef, caa_tags The CAA record set, summarized, with issuer identifiers as written
https_rr_present, https_rr_mode, https_rr_alpn, https_rr The apex HTTPS record: mode, alpn, and raw record data
mx_present, mx_null, spf_present, spf_record_count, spf_all Mail exchangers, null MX, and the SPF record’s all term
dmarc_present, dmarc_p, dmarc_sp, dmarc_pct Parsed DMARC tags only; report addresses are not stored
apex_first_status, apex_first_location, apex_redirect_chain, apex_final_url, apex_final_host, apex_final_status What https://<apex>/ returned, hop by hop
www_first_status, www_first_location, www_final_host, www_final_status, canonical_host The same for https://www.<apex>/, plus the combined classification
hsts_header, hsts_max_age, hsts_include_subdomains, hsts_preload, hsts_final_header HSTS on the apex’s first response (raw and parsed) and on the final response
tls_issuer_org, tls_issuer_cn, tls_not_after, tls_version, tls_peer_ip Issuer and expiry of the apex certificate, TLS version, and the address we connected to
errors Every failure recorded for the row

The script that produced the file is published too: dev-domain-survey-2026-09.py (Python 3, standard library only, with the domain list and every request described above). You can also repeat the measurement with any HTTP client. Either way, expect the location-dependent columns (addresses, HTTPS records, certificates, and redirects) to differ from ours.