Methodology

What we measure, how, and where it can be wrong.

DNS first

DNS is the layer every visit starts with, so it leads the site. For each hostname we find the authoritative zone that holds it: we walk up from the name (a CNAME'd name lives in its parent zone) towards the company's domain, deepest first, and take the first name that has its own NS records (a delegated subdomain such as aws.example.com), else the domain apex. That zone's nameservers, read over DNS-over-HTTPS and re-checked every scan, map to a DNS provider: AWS Route 53 (awsdns-*), Azure DNS (azure-dns.*), Google Cloud DNS (ns-cloud-*.googledomains.com), Cloudflare DNS (*.ns.cloudflare.com, Foundation DNS), Akamai Edge DNS (*.akam.net, *.akadns.net), NS1/IBM (*.nsone.net), UltraDNS/Vercara (*.ultradns.*), CSC (*.cscdns.net), Oracle Dyn (*.dynect.net), MarkMonitor, F5, Packet Clearing House, Self-hosted or Other. Nameservers with the company's own names (ns1.example.com) are often white-label vendor DNS, so every such nameserver is resolved and classified by the origin ASN of its address first (Route 53 space 205.251.192.0/18 and AS16509, PCH AS42, Akamai, NS1 and so on), and by name only second. Self-hosted means the address is on the company's own network (e.g. Apple AS714, Cisco AS109, Intel AS4983). A zone listing nameservers from several vendors is secondary DNS and its share is split by nameserver count (2 of 4 nameservers = half); different vendors on different zones is split DNS. Both count as multi-provider DNS. DNS share uses the same hostname tiers and traffic weights as Edge share.

Who is tracked

Hyperscalers: AWS (CloudFront, ELB, Global Accelerator, API Gateway, AWS WAF, Route 53), Azure (Front Door, Azure CDN, Traffic Manager, App Service, Azure DNS), Google Cloud (Cloud Load Balancing/CDN, Cloud Armor, Apigee, Cloud DNS). Edge providers: Akamai, Cloudflare, Fastly, F5 (F5 Distributed Cloud, formerly Volterra; BIG-IP and NGINX are recorded as sub-signals) and Vercel (CNAME *.vercel-dns.com, its anycast IPs 76.76.21.0/24 and 216.198.79.0/24, server: Vercel and x-vercel-* headers; Vercel runs partly on AWS, so these beat the AWS ASN) and Imperva (Cloud WAF / CDN, formerly Incapsula: CNAME *.incapdns.net / *.impervadns.net, Imperva's published IP ranges and AS19551; the x-iinfo header and incap_ses / visid_incap cookies only confirm and never decide). For Edge, everything identified but not tracked is Other (Oracle Cloud, Sucuri, Edgio and so on). DNS share names every major DNS vendor separately (NS1, UltraDNS, Dyn, self-hosted and so on). Registrar DNS from CSC (*.cscdns.net, *.cscdns.uk, *.cscudns.com, *.corpnamesvcs.com or CSC's AS19574) and MarkMonitor (ns*.markmonitor.com, *.markmonitor.zone) is matched by nameserver name first, because both brands run part of their service on other operators' networks (UltraDNS, CIRA) and the brand is what the company chose. With no CDN, WAF or cloud front door, a hostname is Self-hosted when its address is on the company's own network (the same own-network ASN list used for DNS), Direct (AWS / Azure / Google Cloud) when it sits straight on a hyperscaler's network with no CDN or front-door product (counted inside that hyperscaler's share as a direct sub-bucket), and Unknown otherwise. Microsoft, Google and Amazon hosts on their own cloud networks are labelled Azure, Google Cloud and AWS, since those networks are the products; their own nameservers show as "Google (own network)" and so on.

Companies

Tracking 52 large US companies across eight sectors, expanding to the Fortune 500. Technology: Nvidia, Apple, Microsoft, Broadcom, Micron, AMD, Cisco, Palantir, Intel, Lam Research, Applied Materials, Texas Instruments, Oracle, KLA, IBM, Sandisk and Qualcomm. Financials: Berkshire Hathaway, JPMorgan Chase, Visa, Mastercard, Bank of America, Goldman Sachs, Wells Fargo, Morgan Stanley, Citigroup and American Express. Communication: Alphabet, Meta Platforms, Netflix and Verizon. Consumer: Amazon, Walmart, Costco, Tesla, Home Depot, Procter & Gamble, PepsiCo, Coca-Cola, Philip Morris International and McDonald's. Health Care: UnitedHealth Group, Johnson & Johnson, Eli Lilly, Merck and AbbVie. Energy: ExxonMobil and Chevron. Industrials: Caterpillar, GE Aerospace and GE Vernova. Materials: Linde. Sectors are broad market groups (Visa and Mastercard sit in Fortune's Business Services sector but are grouped with Financials here; Alphabet and Meta are grouped under Communication). Companies added in a given week join the totals with their first weekly scan. Each company has a primary domain and, where relevant, major extra domains (for example vmware.com for Broadcom, azure.com, office.com and live.com for Microsoft, webex.com and meraki.com for Cisco, youtube.com for Alphabet, instagram.com and whatsapp.com for Meta, uhc.com and optum.com for UnitedHealth Group, redhat.com for IBM). For banks the primary domain is the customer-facing one (chase.com for JPMorgan Chase, with jpmorganchase.com and jpmorgan.com as extra domains); owned subsidiaries' domains are included (geico.com for Berkshire Hathaway, etrade.com for Morgan Stanley, ml.com for Bank of America, cybersource.com and authorize.net for Visa, samsclub.com for Walmart). Fortune ranks and sector labels are from the 2026 Fortune 500 (Palantir ranks #732 and Sandisk #508 in the Fortune 1000; Linde is not eligible as a non-US company).

Domains and hostname tiers

Companies own many domains. For each company we curate its owned domains (primary domain, product and brand domains such as icloud.com, live.com, office.com, xbox.com, vmware.com, crucial.com, webex.com and splunk.com) and its critical hostnames, each with how we found it: linked from the company's own site, a known brand, investor relations, or Certificate Transparency. The list is in our open data file and every curated host resolved when added. Scan order and weight follow criticality tiers:

• Primary: the primary domain's apex and www.
• Critical: customer-facing and revenue hostnames on any owned domain: login / SSO / identity, account, store / checkout / pay, marketing and brand sites (including other domains' apex and www), support / help / community, developer / API / docs, downloads / updates / static assets.
• Other: remaining public names, counted with a low weight.
• Internal: dev, test, staging, mail, VPN, autodiscover and similar names. Probed and shown, but excluded from headline share.

Hostname discovery

• Curated critical hostnames (above), then a fixed list of key names on the primary domain (apex, www, api, developer, login, auth, sso, account, shop, store, checkout, support, investor relations, careers, docs and more).
• Origins from the Chrome UX Report top-origin lists (CrUX, via the public crux-top-lists dataset), which also tell us which hostnames real Chrome users visit most.
• Certificate Transparency logs via crt.sh, with Cert Spotter as a fallback, refreshed every 4 weeks. We skip wildcard, internal-looking and test/staging names, and sample up to 45 per domain.

Up to 160 hostnames per company are checked each scan, in tier order: primary first, then critical, then other, internal last.

Classification

• DNS: see DNS first above.
• Edge = the front door a visitor's connection reaches first. We follow the CNAME chain (for example edgekey.net is Akamai, cloudfront.net is AWS, azurefd.net is Azure Front Door, fastly.net is Fastly, ves.io is F5 XC). Without a CNAME match we check the address against published IP ranges (AWS, Google Cloud, Cloudflare, Fastly) and its origin ASN and BGP prefix (Team Cymru IP-to-ASN over DNS, cached per /24). The ASN is how Akamai (AS20940, AS16625, AS21342, AS32787 and others), Microsoft (AS8075) and F5 Distributed Cloud (AS35280) addresses are recognised, and it's stored with every observation so changes show up in Edge Moves. Akamai GTM (akadns.net) is DNS load balancing and counts only when nothing else matches. When the load balancer is a hyperscaler's (ELB, Azure, Google LB), that hyperscaler is the front door.
• HTTP headers from one GET per hostname (no redirects followed) confirm or fill in the front door: cf-ray with server: cloudflare, server: AkamaiGHost, x-amz-cf-id, x-azure-ref, via: 1.1 google, Fastly's x-served-by: cache-…, F5 XC's server: volt-adc. When Cloudflare is suspected or the front door is still unknown, we also request /cdn-cgi/trace: a valid Cloudflare trace body (fl=, h=, ip=, colo=, visit_scheme=) is strong Cloudflare evidence and gives the serving data center. Every rule is anchored to an exact header name or the start of a value. Cookies are matched by name only, never by value; an early prototype wrongly flagged Google on a bank's API because a loose pattern matched text inside an Akamai bot-manager cookie. Header signals from a provider that is not the front door are listed as "behind edge" (origin shield, a second CDN, or a WAF behind the edge) and are not counted in share.

SaaS platforms

Many hostnames are run by a SaaS platform: Shopify, Salesforce, Adobe Experience Manager, WordPress VIP, Vercel, Netlify, Zendesk, HubSpot, Workday, Q4 and others. We detect the platform from the CNAME chain or its headers (for example *.myshopify.com or x-shopid) and show it separately. Edge share always goes to the provider in front of the platform, so a Shopify store on Cloudflare counts as "Cloudflare via Shopify".

Market share metrics

• By hostname count: the fraction of live hostnames on each provider. A hostname on two providers counts half to each. Sector and overall numbers pool all live hostnames.
• Traffic-weighted: within a company, each hostname gets a role weight (internal names get zero), split among the live hostnames in that role and scaled by its Chrome UX Report rank bucket. Roles a company doesn't have are redistributed:
  • primary site (primary): 30%
  • login / SSO (critical): 12%
  • account (critical): 6%
  • store / checkout (critical): 12%
  • marketing / brand (critical): 10%
  • support / help (critical): 8%
  • developer / API (critical): 10%
  • downloads / static (critical): 6%
  • other (other): 6%
  • internal / dev (internal): 0%
  Companies are then weighted by traffic for sector and overall numbers: 8 − log10(best CrUX rank bucket), or the Majestic Million domain rank when no CrUX rank exists (minimum 1). We don't use Cloudflare Radar rankings or the default Tranco list, whose licences don't allow commercial use.

Multi-cloud

A company is multi-cloud when its live hostnames use at least two tracked providers across Edge and DNS (for example Akamai Edge plus Route 53 DNS). We also report the stricter 2+ hyperscalers rate.

Edge Moves (change detection)

Each weekly scan is compared with the previous one, using only hostnames that were live in both. We record DNS providers and Edge providers added, dropped or switched, main-site (apex/www) DNS and Edge changes, and companies becoming or no longer being multi-cloud.

Claimed tech

For companies that publish jobs through a documented public job-board API (Greenhouse, Lever or Ashby), we count postings that name a CDN, WAF or DNS product. It's shown separately as "claimed" because a job post isn't proof of use. Workday boards aren't used.

Top websites

A separate cohort from the companies. The list is a consensus rank: a site must appear in the Chrome UX Report's top traffic buckets (real Chrome page loads, CC BY-SA 4.0) and in at least one more commercially usable public list (Majestic Million, CC BY 3.0; Common Crawl web-graph host ranks). Its rank is the median of its ranks across those sources (the CrUX bucket counts at its midpoint), so no single list decides. Per-source ranks are inputs only and are not republished; each site shows how many sources list it. A non-commercial reference ranking is used privately as a cross-check (sites it ranks highly that ours lacks go to a review queue) and is never displayed. For each site we scan the hostname people actually load (the traffic list's origin, plus one same-domain redirect hop such as apex → www) for the edge, and the registrable domain's nameservers for DNS. Nameservers on the same network that serves the site (when that network is not a cloud, CDN or DNS vendor) count as Self-hosted. Adult sites are kept off the public list.

Confidence per label comes from agreement between independent evidence types. Edge: CNAME chain, published IP ranges, BGP origin ASN, /cdn-cgi/trace and HTTP headers. High = three types agree, or two including a CNAME, published range or trace; Medium = one strong type, or two weak ones; Low = ASN-only or header-only. DNS: nameserver names (vendor patterns) and the origin ASN of nameserver addresses. High = every nameserver on one vendor (by name or address, at least two NS); Medium = a vendor with only part of the NS set, or Self-hosted inferred without an address; Low = Other or unknown.

Known limits

• We see only public hostnames; internal apps and private APIs are invisible.
• F5 XC can hide its server header, and BIG-IP behind a CDN often doesn't show, so F5 is undercounted.
• AWS, Azure and Google addresses include plain cloud hosting as well as edge products; the evidence column says which.
• Some sites block or rate-limit automated requests. DNS-based classification still applies; the HTTP column then shows timeout or an error code.
• The scanner runs on Cloudflare Workers. Sites behind Cloudflare see that traffic like any other client, and we classify DNS and CNAME data the same way for every provider.

Being polite

Each scan makes ordinary DNS queries, one GET per hostname and, for some hostnames, one request to /cdn-cgi/trace, with the user agent EdgeFootprintBot/0.1 (+https://edgefootprint.com/methodology). We don't probe ports, bypass protections or follow redirects. To opt a hostname out, use the contact form.

Data sources and licences

• Fortune 500 2026 company names, ranks and sector labels (facts cited from Fortune; the dataset isn't republished).
• Chrome UX Report (CC BY-SA 4.0) via crux-top-lists; Majestic Million (CC BY 3.0).
• crt.sh and Cert Spotter (Certificate Transparency); Team Cymru IP-to-ASN; AWS, Google Cloud, Cloudflare and Fastly published IP ranges.