{ "report_contract_version": "monthly-observatory-brief/v2", "month": "2026-09", "title": "Monthly Observatory Brief - September 2026", "period_label": "September 2026", "status": "published", "publication": { "status": "published", "prepared_at": "2026-10-02", "published_at": "2026-10-02", "updated_at": "2026-10-13", "update_note": "auDA September 2026 registry context added after initial publication." }, "monthly_readout": [ "A change in visible MX routing coincided with a change in its derived inbound mail-provider association: one structured MX-change row and one supporting provider-association row were recorded for the same panel domain. The observed MX set reduced from two targets to one, and the inferred association changed from two providers to one. This is one linked infrastructure observation, not evidence of a completed service migration or supplier change.", "The panel recorded 31 RDAP status-change rows across 17 domains. Private review found temporary transitions and reversals among the observations. These are bounded registration-layer signals, not claims about registrant conduct.", "At the final September observation, MX evidence was determinate for 98 domains and visible MX was observed for 94. SPF evidence was determinate for 97, comprising 83 single and 14 malformed SPF-record observations. A valid DMARC record was observed for 97 of 98 domains with determinate DMARC evidence." ], "observed_activity": { "status": "qualified", "recorded_event_rows": 949, "affected_domains": 35, "affected_domains_status": "published", "supported_movement_rows": 67, "supported_movement_domains": 22, "routine_or_low_confidence_rows": 882, "routine_or_low_confidence_domains": 26, "legacy_dns_sensitive_event_rows": 0, "note": "Stored activity includes 882 routine A/AAAA address-change rows. The 67 evidence-qualified supported-movement rows across 22 domains constitute a review population, not independent incidents, migrations or failures." }, "cohort_context": { "status": "qualified", "membership_model": "canonical_published_cohorts", "membership_effective_from": "2026-07-01", "overlap_note": "A domain may appear in more than one analytical cohort. Cohort membership totals therefore do not sum to the fixed panel size.", "rows": [ { "id": "government", "title": "Australian government domains", "denominator": 14, "overlapping_membership": false, "recorded_event_rows": 65, "domains_with_recorded_activity": 3, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 4, "supporting_movement_rows": 0, "supported_movement_rows": 4, "domains_with_supported_movement": 2, "routine_or_low_confidence_rows": 61, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "nfp", "title": "Australian not-for-profit domains", "denominator": 16, "overlapping_membership": false, "recorded_event_rows": 46, "domains_with_recorded_activity": 3, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 1, "supporting_movement_rows": 1, "supported_movement_rows": 2, "domains_with_supported_movement": 1, "routine_or_low_confidence_rows": 44, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "education", "title": "Australian higher education domains", "denominator": 10, "overlapping_membership": false, "recorded_event_rows": 26, "domains_with_recorded_activity": 2, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 26, "supporting_movement_rows": 0, "supported_movement_rows": 26, "domains_with_supported_movement": 2, "routine_or_low_confidence_rows": 0, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "media", "title": "Australian media domains", "denominator": 8, "overlapping_membership": false, "recorded_event_rows": 169, "domains_with_recorded_activity": 3, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 8, "supporting_movement_rows": 0, "supported_movement_rows": 8, "domains_with_supported_movement": 2, "routine_or_low_confidence_rows": 161, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "commercial", "title": "Retail and marketplace domains", "denominator": 14, "overlapping_membership": false, "recorded_event_rows": 335, "domains_with_recorded_activity": 9, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 11, "supporting_movement_rows": 0, "supported_movement_rows": 11, "domains_with_supported_movement": 6, "routine_or_low_confidence_rows": 324, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "financial-services", "title": "Financial services domains", "denominator": 8, "overlapping_membership": false, "recorded_event_rows": 98, "domains_with_recorded_activity": 5, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 6, "supporting_movement_rows": 0, "supported_movement_rows": 6, "domains_with_supported_movement": 3, "routine_or_low_confidence_rows": 92, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "public-interest", "title": "Public-interest domains", "denominator": 21, "overlapping_membership": true, "recorded_event_rows": 128, "domains_with_recorded_activity": 5, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 6, "supporting_movement_rows": 0, "supported_movement_rows": 6, "domains_with_supported_movement": 3, "routine_or_low_confidence_rows": 122, "legacy_dns_sensitive_not_supported_rows": 0 }, { "id": "software-platforms", "title": "Australian software platforms", "denominator": 5, "overlapping_membership": false, "recorded_event_rows": 33, "domains_with_recorded_activity": 1, "legacy_dns_sensitive_event_rows": 0, "material_movement_rows": 0, "supporting_movement_rows": 0, "supported_movement_rows": 0, "domains_with_supported_movement": 0, "routine_or_low_confidence_rows": 33, "legacy_dns_sensitive_not_supported_rows": 0 } ], "note": "All eight denominators reconcile with the retained published 30 September cohort index. These descriptive analytical lenses are not rankings or sector assessments." }, "month_end_posture": { "status": "qualified", "as_of": "2026-09-30T07:31:47.683147+10:00", "latest_run_date": "2026-09-30", "panel_denominator": 100, "comparison_status": "withheld", "metrics": [ { "id": "dnssec_visible", "label": "DNSSEC visible", "count": 15 }, { "id": "mx_visible", "label": "MX visible", "count": 94 }, { "id": "spf_visible", "label": "SPF visible", "count": 97 }, { "id": "dmarc_visible", "label": "DMARC visible", "count": 97 }, { "id": "dns_provider_classified", "label": "Named DNS-provider association", "count": 69 }, { "id": "email_provider_classified", "label": "Named inbound-mail provider association", "count": 85 }, { "id": "rdap_available", "label": "RDAP available", "count": 99 }, { "id": "registrar_visible", "label": "Registrar visible", "count": 99 } ], "source": "data/state/index.json", "note": "Dated 30 September State output, generated at the end of September collection. Named-provider counts exclude explicit [unclassified] and [unavailable] legacy labels. Month-on-month provider composition comparison is withheld on methodological grounds." }, "supported_movement": { "status": "qualified", "material_movement_rows": 66, "material_movement_domains": 22, "supporting_movement_rows": 1, "supporting_movement_domains": 1, "items": [ { "id": "nameservers_changed", "label": "Nameserver movement", "event_rows": 34, "affected_domains": 4, "evidence_status": "structured" }, { "id": "rdap_status_changed", "label": "Registration-status movement", "event_rows": 31, "affected_domains": 17, "evidence_status": "bounded" }, { "id": "mx_changed", "label": "MX movement", "event_rows": 1, "affected_domains": 1, "evidence_status": "structured" }, { "id": "email_provider_changed", "label": "Email-provider movement", "event_rows": 1, "affected_domains": 1, "evidence_status": "structured" } ], "legacy_dns_sensitive_not_supported_rows": 0, "note": "Supported movement is a reviewed subset of recorded events. The MX and email-provider rows refer to one underlying observed mail-routing transition, not two independent migrations. Repeated nameserver and RDAP rows do not automatically establish independent permanent changes." }, "mail_trust": { "status": "published", "as_of": "2026-09-30", "panel_denominator": 100, "contract_versions": { "item": "mail-posture/v1", "aggregate": "mail-posture-aggregate/v1" }, "mx": { "evidence": { "determinate_count": 98, "indeterminate_count": 2 }, "posture": { "denominator": 98, "visible": 94, "null_mx": 0, "not_observed": 4 } }, "spf": { "evidence": { "determinate_count": 97, "indeterminate_count": 3 }, "posture": { "denominator": 97, "not_observed": 0, "single": 83, "multiple": 0, "malformed": 14 }, "terminal_qualifier": { "denominator": 83, "fail": 41, "softfail": 33, "neutral": 4, "pass": 0, "missing": 5 } }, "dmarc": { "evidence": { "determinate_count": 98, "indeterminate_count": 2 }, "posture": { "denominator": 98, "not_observed": 1, "valid": 97, "multiple": 0, "malformed": 0 }, "policy": { "denominator": 97, "none": 16, "quarantine": 13, "reject": 68 }, "adkim": { "denominator": 97, "relaxed": 92, "strict": 5 }, "aspf": { "denominator": 97, "relaxed": 92, "strict": 5 }, "subdomain_policy": { "denominator": 97, "none": 9, "quarantine": 4, "reject": 18, "inherited": 66 } }, "source": "data/state/mail-trust.json", "note": "Published panel-level Mail trust semantics preserve determinate/indeterminate evidence and do not reconstruct suppressed cohort values. SPF syntax and published DMARC policy are not compliance assessments." }, "auda_context": { "status": "current", "target_month": "2026-09", "registry_month": "2026-09", "source": "auDA Registry Monthly Statistics", "source_url": "https://files.auda.org.au/documents/Registry-Monthly-Stats-September-2026.pdf", "total_names_under_management": 4427175, "total_new_domains": 66140, "panel_per_million": 22.6, "note": "September 2026 auDA Registry Monthly Statistics are included as external namespace context." }, "observation_coverage": { "status": "qualified", "panel_denominator": 100, "observation_days": 30, "collector_runs": 204, "successful_runs": 200, "partial_runs": 4, "failed_runs": 0, "running_runs": 0, "domain_observations_attempted": 3400, "domain_observations_succeeded": 3395, "domain_observations_failed": 5, "snapshot_rows_written": 3395, "actual_snapshot_rows": 3399, "snapshot_write_delta": 4, "event_rows_written": 983, "actual_event_rows": 983, "event_write_delta": 0, "rdap_fallback_count": 0, "dns_error_count": 0, "rdap_error_count": 27, "note": "Four partial collector runs during 13 September Supabase API-key validation recorded five HTTP 504 failed observation attempts. Four failed attempts nevertheless persisted structured snapshots (one extra snapshot per partial run), exactly reconciling the four-row counter delta. The fifth was absent in that attempt; all five affected domains were observed again on the next scheduled day and through month end. Available records show a timeout pattern, not a proven authentication failure. All retained snapshots/events are linked to September runs; no underlying telemetry was rewritten." }, "evidence_quality": { "status": "qualified", "dns_outcome_model": "query_outcomes_v1", "comparison_status": "qualified", "metrics": [ { "id": "structured_dns_snapshots", "label": "Structured DNS snapshots", "value": 3399 }, { "id": "legacy_dns_snapshots", "label": "Legacy/missing DNS-outcome snapshots", "value": 0 }, { "id": "structured_dns_coverage_pct", "label": "Structured DNS snapshot coverage (%)", "value": 100 }, { "id": "observed_domains", "label": "Observed domains", "value": 100 }, { "id": "observatory_event_rows", "label": "Stored observatory event rows", "value": 949 }, { "id": "legacy_dns_sensitive_event_rows", "label": "Legacy DNS-sensitive event rows", "value": 0 }, { "id": "legacy_dns_sensitive_not_supported_rows", "label": "Legacy unsupported DNS-sensitive rows", "value": 0 }, { "id": "unknown_event_rows", "label": "Unknown event rows", "value": 0 } ], "structured_dns_snapshot_rows": 3399, "legacy_dns_snapshot_rows": 0, "structured_dns_domains": 100, "legacy_dns_observation_days": 0, "first_structured_dns_snapshot": "2026-08-31T21:53:26.236583+00:00", "last_legacy_dns_snapshot": null, "observed_domains": 100, "observatory_event_rows": 949, "legacy_dns_sensitive_event_rows": 0, "legacy_dns_sensitive_not_supported_rows": 0, "unknown_event_rows": 0, "note": "Preflight returned ready: all 3,399 retained snapshots have structured DNS outcomes, covering all 100 domains and no unknown event types. Collection telemetry remains separately qualified because of the four partial validation-period runs." }, "provider_context": { "status": "qualified", "as_of": "2026-09-30T07:31:47.683147+10:00", "panel_denominator": 100, "dns": { "status": "qualified", "classified_count": 69, "unclassified_count": 31, "distinct_provider_count": 12, "published_distribution_count": 68, "other_classified_count": 1, "providers": [ { "label": "Amazon Web Services", "count": 20 }, { "label": "Akamai", "count": 18 }, { "label": "Cloudflare", "count": 11 }, { "label": "Microsoft", "count": 10 }, { "label": "UltraDNS", "count": 2 }, { "label": "VentraIP", "count": 2 }, { "label": "DNS Made Easy", "count": 1 }, { "label": "Discount Domain Name Services", "count": 1 }, { "label": "Gandi", "count": 1 }, { "label": "GoDaddy", "count": 1 }, { "label": "ZoneEdit", "count": 1 } ], "source": "data/state/dns-providers.json", "note": "Legacy State provider fields, not a retrospective catalogue 1.5.0 projection. All 100 source fields are populated, but 31 explicitly say [unclassified]. The top-12 publication list displays 68 named associations and omits one additional named label." }, "email": { "status": "qualified", "classified_count": 85, "unclassified_count": 15, "unavailable_count": 2, "distinct_provider_count": 6, "provider_denominator": 100, "published_distribution_count": 85, "other_classified_count": 0, "providers": [ { "label": "Microsoft", "count": 41 }, { "label": "Proofpoint", "count": 18 }, { "label": "Google", "count": 11 }, { "label": "Mimecast", "count": 11 }, { "label": "Cisco", "count": 3 }, { "label": "Atmail", "count": 1 } ], "source": "data/state/email-providers.json", "note": "The established State classification yields 85 named inferred inbound-provider associations. The remaining 15 comprise 13 domains outside the populated provider distribution and two explicit [unavailable] labels; separate unavailable_count retains that breakdown. This does not establish the complete mail backend or any supplier relationship." }, "registrar": { "status": "qualified", "visible_count": 99, "unavailable_count": 1, "distinct_visible_name_count": 12, "providers": [ { "label": "Corporation Service Company (Aust) Pty Ltd", "count": 35 }, { "label": "Domain Directors Pty Ltd trading as Instra", "count": 12 }, { "label": "Melbourne IT", "count": 12 }, { "label": "Education Services Australia Limited", "count": 10 }, { "label": "auDA Internal (9999)", "count": 8 }, { "label": "Department of Finance", "count": 6 }, { "label": "Synergy Wholesale Accreditations Pty Ltd", "count": 6 }, { "label": "Web Address Registration Pty Ltd", "count": 4 }, { "label": "Discount Domain Name Services Pty Ltd", "count": 2 }, { "label": "GoDaddy.com LLC trading as GoDaddy.com", "count": 2 }, { "label": "GoDaddy Online Services Cayman Islands Ltd", "count": 1 }, { "label": "MarkMonitor Corporate Services Inc", "count": 1 } ], "source": "data/state/registrars.json", "note": "Registrar identity is source-supplied visible registration metadata, not an aggregate estimate of any registrar's market share." }, "window_note": "Dated State provider distributions are month-end posture; their rolling-window movement context is not an exact calendar-month total. August snapshots lack pinned Provider Resolution metadata. September adopted catalogue 1.2.0 on 8 September, 1.3.0 on 9 September and 1.5.0 from 10 September; matcher remained provider-resolution-v1. The separately persisted versioned Provider Resolution projection is not the same as the legacy State provider field-derived distribution.", "note": "Provider association percentages describe the fixed .auDO panel only. In the compact classification table, unclassified/unavailable includes both missing and explicitly unavailable cases. August-to-September provider distribution comparisons are withheld because of classification-method provenance." }, "limitations": [ "The 100-domain fixed panel and curated, sometimes overlapping cohort lenses are not representative of the entire .au namespace and do not support ranking, benchmarking, whole-sector conclusions, scoring, risk ratings or compliance assessments.", "Recorded rows reflect observed evidence. Repeated entries and routine A/AAAA churn are not automatically independent migrations, incidents or persistent configuration changes.", "Four partial validation-period runs, five HTTP 504 failed attempts and four additionally persisted structured snapshots remain explicitly recorded. Successful subsequent observations do not change those historical run statuses.", "Month-end State, Mail trust, provider and cohort context is frozen to the retained 30 September generated publication, rather than the current live October State.", "Current State provider distributions use established classification fields; separately versioned Provider Resolution was adopted during September. Unqualified August-to-September provider composition comparisons are withheld.", "Public MX, SPF, DMARC, DNSSEC and registration evidence does not establish private systems, internal intent, contractual providers, service resilience, incidents or compliance.", "Mail trust indeterminate evidence is not treated as absence; cohort-level suppression is retained without complementary reconstruction.", "auDA September 2026 registry context was added after initial publication; registry statistics are external namespace context only and do not make the fixed panel a namespace sample." ] }