Quarterly Trust Signals Review — Q3 2026

The quarter in perspective

The public signals a domain exposes can help us understand its visible technical arrangements, dependencies and changes over time. They cannot, on their own, tell us whether an organisation is secure or well governed. Across July to September 2026, .auDO followed the same 100 .au domains on all 92 calendar days. Several headline indicators were unchanged at the reporting boundaries, yet other public infrastructure observations moved — sometimes repeatedly. A stable public signal does not necessarily mean nothing changed, and a visible change does not necessarily mean something went wrong. The governance challenge is knowing the difference.

Visible trust posture: what the quarter-end records showed

At the end of July, August and September, DNSSEC was visible for 15 panel domains, DMARC for 97 and mail-routing (MX) records for 94. These are dated positive observations, not evidence that each domain kept the same settings every day. They also tell us about different kinds of public signals, not one combined measure of trust.

The more detailed August and September mail assessments each found 97 valid DMARC records among 98 domains with a conclusive reading. The published DMARC policy mix was also unchanged at those two month ends: 16 with a monitoring-only policy (none), 13 with quarantine and 68 with reject. These settings are publicly visible signals of intended mail handling; they do not establish how well an organisation's email controls work in practice.

The July snapshot remains part of this quarter's picture. Where later, more structured evidence permits closer comparisons, we use it; where methods changed during the quarter, we do not turn differences in measurement into supposed changes in security.

What changed beneath the month-end picture

Month-end counts are a useful starting point, but they do not capture everything happening between reporting dates. Reviewed changes appeared across 34 domains in August and 22 in September. The detailed event-row accounting is in the evidence appendix; a recorded row is not an independent incident or completed migration.

Nameserver answers changed repeatedly among a small number of domains. Changes to registration-status information affected a wider set of domains. These different signals can point to changes worth checking, but their event counts are not directly comparable measures of organisational risk.

In September, a visible change in mail-routing destinations coincided with a change in the inferred inbound mail-provider association for the same domain. That is one observed infrastructure change viewed through two signals, not proof that a provider migration was completed.

What repeated observation revealed

The clearest benefit of following domains over time emerged in their nameserver answers. Among comparable records from 2 August onward, answers changed 75 times between adjacent observations across five domains. Four domains repeatedly returned to an answer seen earlier.

Counting every eligible observation, we found 70 such returns. Using only the last observation of each day, 36 returns remained. Those figures describe two different ways of sampling the same kinds of patterns. They are not 70 migrations or rollbacks.

We compared those 75 observable changes with nameserver information retained from public registration records (RDAP). The registration lists were unchanged across 74 of the comparisons and different in one. That helps interpret the answers, but it does not provide a transaction history or tell us what caused the changes. This is where longitudinal evidence becomes useful: it tells an accountable owner what may deserve explanation without pretending to supply that explanation itself.

Dependencies and different groups of domains

Public registration records also reveal shared dependencies. At September's reporting boundary, registrar names were visible for 99 of the 100 panel domains. Corporation Service Company (Aust) Pty Ltd appeared in 35 of those records, while Domain Directors Pty Ltd trading as Instra and Melbourne IT each appeared in 12. These are concentrations within a deliberately selected panel, not market shares across the .au namespace.

Visible DNS and mail-provider associations also provide a useful view of shared infrastructure. But the methods used to identify providers changed during the quarter. The August and September distributions cannot responsibly be presented as a supplier trend without rechecking them under a common method.

The Observatory also follows government, education, not-for-profit, media, commercial and other overlapping analytical groups. These perspectives may help reveal different patterns, but equal group sizes at month end are not enough to establish like-for-like historical membership. We are not ranking cohorts in this first review.

Why this matters for governance

For a domain owner, the practical question is not simply whether a DNS record changed. It is whether the organisation knows who is accountable for its registrar, DNS and mail services; which external providers can make changes; and how unexpected public differences would be checked.

A visible change is a reason to verify context, not to assume something went wrong. An apparently stable setting can still be misconfigured or poorly understood. Responsible digital trust therefore depends on making public signals observable, linking them to accountable owners and being able to explain significant changes.

That is the contribution of an independent observatory: a reproducible record of what was publicly visible, with clear boundaries around what it can establish.

What we will examine next quarter

This first report establishes a baseline rather than a quarter-on-quarter verdict. The next Quarterly Review can test whether the same signals and observations remain comparable across an additional completed quarter.

Priorities include a version-consistent view of provider associations, a full audit of historical cohort membership before comparisons, and more careful study of which recorded changes persist rather than return to an earlier value. We will continue to separate observed evidence from claims about intent, cause or security outcomes.

What the evidence cannot establish

• This report covers 100 selected .au domains observed throughout the quarter. They are not a representative sample of the entire .au namespace, and the findings are not national market shares or sector benchmarks.
• The quarter covers 1 July to 30 September 2026, but the structured DNS comparisons used for nameserver recurrence and raw mail-record identity start on 2 August. July remains useful for dated posture and registration context, not as a directly comparable structured-DNS month.
• Dated month-end counts are positive observations, not proof that the same individual domains stayed unchanged throughout the quarter. Inconclusive observations are not treated as absence or as stability.
• Nameserver returns, registration-status rows and provider associations do not establish a deliberate migration, delegation transaction, incident, governance failure, compliance result or uninterrupted service state.
• Provider classification rules changed during the period; the historical cohort membership audit is incomplete. Provider trends and comparative cohort rankings are withheld.

Evidence and method

• July 2026 Monthly Observatory Brief
• August 2026 Monthly Observatory Brief
• September 2026 Monthly Observatory Brief
• Observation methodology
• Reviewed Q3 nameserver and RDAP aggregate evidence

How to cite this review

.au Domain Observatory. (2026). Quarterly Trust Signals Review — Q3 2026. https://audo.bryanchetcuti.com/reports/quarterly/2026-q3/

Content available under CC BY 4.0, with attribution.