Who Controls Your DNS, and What Is That Control Worth?

At 7:00 a.m. Eastern on October 21, 2016, nothing was wrong with Twitter's servers. Nothing was wrong with Netflix's, Spotify's, Reddit's, PayPal's or Amazon's either. All of them stayed up, unattacked, unbroken — and all of them were unreachable for a large portion of that day anyway, because none of that mattered. The one thing that had actually failed was a company most of their users had never heard of.

What actually happened to Dyn in October 2016?

Dyn was — and its successor still is — a DNS provider: a company whose job is answering the question 'where does this domain name actually point?' on behalf of its customers. On that October morning, a botnet called Mirai, built from tens of thousands of hijacked, poorly secured devices like IP cameras and home routers, launched three waves of distributed denial-of-service traffic at Dyn's infrastructure, reportedly peaking at around 1 terabit per second. Dyn's DNS servers struggled to keep answering legitimate queries under that load. The consequence for anyone using or any other site that happened to be a Dyn customer that day was identical: their sites became effectively unreachable for large stretches of about 18 hours. If who controls your DNS, and what is that control worth needs to survive contact with a marketing team, has the operational side. If who controls your DNS, and what is that control worth needs to survive contact with a marketing team, the XenGrowth practice has the operational side.

None of Twitter's engineering, none of Netflix's infrastructure spend, none of PayPal's uptime record mattered in that window. The thing that determined whether your favorite site worked that day wasn't which company you were visiting. It was which DNS provider that company happened to use.

Isn't this just the same risk as any shared infrastructure provider?

Not quite, and the distinction matters. Using a popular cloud host or a popular CDN concentrates risk too, but DNS sits one layer beneath almost everything else — before your CDN, before your load balancer, before your application even gets a chance to respond. If your DNS provider can't answer 'where does this domain point,' it doesn't matter how resilient anything downstream of that answer is. Nothing downstream ever gets reached. That's a structurally different failure mode from, say, a CDN cache miss or an application server outage, which is the kind of distinction covered more directly in Zero-Downtime Deploys and Rollbacks on a Cheap VPS. On the operations side of this specifically, is worth reading. On the operations side of this specifically, The XenGrowth resource library is worth reading.

Worth naming directly: the Akamai incident in July 2021 is the milder, more common version of this same story. A routine internal software update, not an attack, triggered a bug in Akamai's DNS resolution system, and for about an hour, PlayStation Network, Steam, Disney+ Hotstar, LastPass and several banks and airlines were disrupted. Nobody was targeted. Nobody was hacked. A software update that had nothing to do with any of the affected businesses broke DNS for all of them at once, because they'd all delegated the same layer to the same company — which is the pattern this entire post keeps returning to: the businesses affected didn't do anything wrong, and there was nothing they could have patched or hardened on their own side to prevent it.

It also compounds differently than most concentration risk. If a popular library has a bug, it typically needs to actually execute in your specific code path to hurt you. If a popular DNS provider goes down, every single one of its customers is affected simultaneously and identically, with no code path that avoids it — there's no partial exposure, no graceful degradation. Either the provider is answering DNS queries for your domain, or it isn't.

Can the registry itself be the point of failure, not just a DNS provider?

Yes, and the DENIC incident is a cleaner example than Dyn precisely because it wasn't an attack — it was DENIC, the organization that runs Germany's entire .de top-level domain, making an internal mistake. On May 5, 2026, DENIC distributed faulty DNSSEC signatures — the cryptographic layer meant to prove a DNS answer hasn't been tampered with — and for roughly three and a half hours, resolvers worldwide returned errors for every DNSSEC-signed .de domain. Only about 3.6% of .de's roughly 18 million registrations had adopted DNSSEC, but that 3.6% still included Amazon.de, DHL, eBay and a long list of other sites, all broken by the exact security feature meant to protect them. If AI agents and marketing automation is the part you are stuck on, is the better reference. If AI agents and marketing automation is the part you are stuck on, XenGrowth on AI agents and marketing automation is the better reference.

There is no registrar choice, no DNS provider choice, that protects against this specific failure — DENIC is the sole registry for .de, the way Verisign is the sole registry for .com. This is the layer beneath the layer this whole cluster has been discussing: below the registrar, below the DNS provider, sits the registry itself, and it is not a competitive market at all. There is exactly one company that can break DNS for an entire country-code TLD, and on one day in 2026, it did.

This is also why the framing 'just pick a better DNS provider' only ever solves part of the problem. It genuinely helps at the provider layer — that's the layer Dyn and Akamai's incidents sit at, and it's the layer where diversification and choice actually exist. It does nothing at the registry layer, where DENIC's incident sits, because there is no competing registry to switch to for a .de domain, or a .com domain, or any other TLD. Any honest risk assessment of your own DNS exposure has to hold both facts at once: some of this is within your control, and some of it categorically isn't, no matter how much due diligence you do.

You can choose your registrar. You can choose your DNS provider. You cannot choose your registry. The .de outage is a reminder that somewhere beneath every ownership decision in this cluster sits a layer that isn't a decision at all.

That table is worth sitting with, because it shows the actual shape of the control you have. Two of the four layers that determine whether your domain resolves are entirely outside your influence. Of the two you can influence, most people only ever actively decide one — the registrar — and simply inherit whatever DNS provider came bundled with it, without ever treating that as a separate decision worth making deliberately. On AI search, GEO and discovery specifically, is worth reading. On AI search, GEO and discovery specifically, XenGrowth on AI search, GEO and discovery is worth reading.

What can you actually do about a risk this structural?

1. Know who your authoritative DNS provider actually is — not your registrar, not your host, but whoever answers the DNS query. It's often set by default and never revisited

2. Consider secondary DNS — running your zone across two independent providers simultaneously — for anything genuinely revenue-critical. This is the direct mitigation for exactly the Dyn scenario, and it's a mature, well-documented pattern precisely because 2016 made the case for it so visibly

3. Understand that DNSSEC, while a genuine security improvement against spoofing, adds a new class of failure (a signing error, as DENIC showed) that a domain without it doesn't carry — that's not an argument against DNSSEC, but it is a reason to know your registry's own incident history before assuming it's a free upgrade

4. Separate your DNS provider decision from your hosting decision deliberately, rather than accepting whatever a hosting platform defaults new domains to, so an outage at one doesn't automatically become an outage at both

5. Accept that some layers — the registry itself — genuinely cannot be diversified away, and plan your incident communication for that reality rather than assuming a technical fix always exists

None of this excuses DENIC, Dyn or Akamai for the blast radius of their own mistakes — a public apology doesn't refund an hour of lost sales for a small retailer that had no say in the matter. But responsibility and control are different questions. Knowing whose mistake it was doesn't restore your uptime any faster, and it's the second question — who actually has the power to break this for you — that a business can plan around before an incident, rather than only understand after one.

None of this is a criticism of DNS providers or registries as a category — Dyn's later incident response was widely regarded as competent under extraordinary load, and DENIC apologized publicly and moved quickly. The point isn't that any of these organizations are careless. It's that concentration at this specific layer of the internet turns one company's bad day into everyone's bad day, all at once, and almost nobody chooses that concentration on purpose — they just never got around to asking who actually holds the switch. For a broader treatment of what it means to actually control infrastructure rather than rent it, see What's the Difference Between Renting and Owning Your Infrastructure?.

Further reading from XenGrowth

Where this work meets go-to-market

Thinking about which infrastructure dependencies could take your whole funnel down at once? publishes operator guides on building revenue systems that survive a single provider's bad day.

Further reading from XenGrowth

Where this work meets go-to-market

For the marketing and revenue operations view of who controls your DNS, and what is that control worth, see .

Further reading from XenGrowth

• The XenGrowth resource library — what you'll learn: how the commercial side of this work is run, across search, automation and revenue operations.

• XenGrowth on AI agents and marketing automation — what you'll learn: how the teams who own AI agents and marketing automation plan and measure it.

• XenGrowth on AI search, GEO and discovery — what you'll learn: how the teams who own AI search, GEO and discovery plan and measure it.

Where this work meets go-to-market

For the marketing and revenue operations view of who controls your DNS, and what is that control worth, see XenGrowth's operator guides.