ADoX in the Wild
Measuring the deployment of encrypted recursive-to-authoritative DNS (RFC 9539)
Deployment statistics
Last updated: October 6, 2026
As of September 2026, 2 root server operators (H, B), 6 top-level domains (.kg, .cy, .ελ, .arpa, .gr, .lu), and 3,025,690 registered domains support some form of ADoX. This deployment is driven by 4 nameserver IPs at the root level, 14 at the TLD level, and 2,973 NS IPs across registered domains.
Our measurements are performed once per month. We gather a comprehensive list of domains from various sources, including the IANA root zone database of top-level domains, ICANN CZDS, passive DNS, CT logs, and zone transfers. We use zdns to map domain names to NS records, followed by A/AAAA requests to get nameserver IPs. Next, we attempt to establish ADoT and ADoQ connections with each nameserver, disabling certificate validation (as allowed by the RFC 9539). Once we identify the nameservers supporting encryption, we resolve all the domains they are authoritative for over the supported encrypted channel. We define a domain name ADoX-enabled if at least one of its nameservers returns the NOERROR DNS response to our SOA query sent over ADoT or ADoQ.
Below we aggregate biggest ADoX nameservers by their suffix, for example, ns1.one.com, ns2.one.com, and ns3.one.com are represented as *.one.com. Note that a single operator can use multiple suffixes, e.g., wedos.cz and wedos.eu.
| # | Operator | ADoT domains | Operator | ADoQ domains |
|---|---|---|---|---|
| 1. | *.one.com | 1,393,928 | *.one.com | 1,393,928 |
| 2. | *.timeweb.ru | 405,508 | *.hostnet.nl | 386,732 |
| 3. | *.timeweb.org | 405,474 | *.wedos.eu | 241,097 |
| 4. | *.hostnet.nl | 386,732 | *.wedos.com | 240,893 |
| 5. | *.wedos.eu | 273,955 | *.wedos.cz | 240,689 |
| 6. | *.wedos.com | 273,743 | *.g1-dns.one | 80,184 |
| 7. | *.wedos.cz | 273,601 | *.g1-dns.com | 80,183 |
| 8. | *.nazwa.pl | 137,631 | *.antagonist.nl | 42,748 |
| 9. | *.g1-dns.one | 80,184 | *.antagonist.net | 42,748 |
| 10. | *.g1-dns.com | 80,183 | *.jethostns.com | 25,816 |
| 11. | *.antagonist.nl | 42,748 | *.desec.org | 18,381 |
| 12. | *.antagonist.net | 42,748 | *.m-online.net | 7,290 |
| 13. | *.namebay.com | 35,918 | *.agonet.it | 2,966 |
| 14. | *.jethostns.com | 26,238 | *.ipandmore.hosting | 2,529 |
| 15. | *.webhosting.dk | 21,878 | *.ipandmore.net | 2,529 |
| 16. | *.desec.org | 18,376 | *.ipandmore.email | 2,529 |
| 17. | *.prosite.de | 14,927 | *.ipandmore.cloud | 2,529 |
| 18. | *.iq.pl | 14,556 | *.rhx.info | 1,424 |
| 19. | *.glbns.com | 14,241 | *.x4w.net | 1,424 |
| 20. | *.virtualns.net | 9,164 | *.aspnix.com | 1,375 |
The table below shows the highest-ranked ADoX domains according to the Tranco list. As of September 2026, Tranco contains 6,794 ADoT and 2,331 ADoQ domains.
| Rank | ADoT domain | Rank | ADoQ domain |
|---|---|---|---|
| 3. | facebook.com | 73. | root-servers.net |
| 11. | instagram.com | 156. | one.one |
| 13. | fbcdn.net | 795. | no-ip.com |
| 30. | wikipedia.org | 1165. | one.com |
| 32. | whatsapp.net | 2958. | univie.ac.at |
| 55. | whatsapp.com | 3755. | codeberg.org |
| 66. | wa.me | 4010. | bayern.de |
| 73. | root-servers.net | 4933. | wedos.cz |
| 81. | cdninstagram.com | 5259. | freetds.org |
| 126. | cdn77.org | 5376. | eu.org |