Cloudflare launches comprehensive TLD tracking on Radar platform

Cloudflare announced the launch of comprehensive top-level domain insights on its Radar platform on October 27, 2025. The new feature provides detailed analytics for over 1,400 TLDs, based on aggregated data from the company's 1.1.1.1 public DNS resolver and other services.

According to the announcement, the TLD pages introduce DNS Magnitude as the primary ranking metric. This measurement system differs from simple query counting by incorporating the number of unique client networks querying each domain. The formula calculates the natural logarithm of unique networks querying a TLD divided by all unique networks, multiplied by 10, resulting in scores between 0 and 10.

"Instead of simply counting the total number of DNS queries, DNS Magnitude incorporates a sense of how many unique clients send queries to domains within the TLD," the company stated in its blog post. The approach addresses situations where small numbers of sources generate large query volumes, providing more accurate visibility measurements.

The announcement revealed that .su, the Soviet Union's legacy TLD from 1990, currently ranks first in DNS Magnitude. Data from the seven-day measurement period shows the domain receives queries from more unique networks than other TLDs, despite not leading in single-day unique network counts. Analysis indicates the top hostnames within .su primarily associate with a popular online world-building game, with over half of queries originating from the United States, Germany, and Brazil.

Traditional stalwarts maintain strong positions in the rankings. The .com TLD accounts for more than 60% of queries to 1.1.1.1, followed by .net, .arpa (an infrastructure TLD), and .org. The expansion of Cloudflare Radar's capabilities represents significant development since the platform's 2020 launch.

ICANN reportedly plans to retire .su in 2030, following decades of declining use after the USSR's dissolution. Individual republics adopted their own country code TLDs after becoming independent nations.

The platform now categorizes TLDs into five distinct types. Generic TLDs (gTLD) like .com and .info serve general purposes. Generic restricted TLDs (grTLD) such as .name limit registration to specific communities. Country code TLDs (ccTLD) like .uk and .jp represent individual countries or territories. Infrastructure TLDs (iTLD) including .arpa support technical operations. Sponsored TLDs (sTLD) such as .edu and .gov operate under specific organizational oversight.

Each TLD page displays comprehensive technical information including creation dates, management entities, and nameserver listings. The .land TLD, created on November 8, 2013, operates under Binky Moon, LLC management with six designated nameservers. Its ranking places it at #420 with a DNS magnitude of 5.992.

DNS query volume data reveals geographic distribution patterns. For .land domains, Germany accounts for 28.6% of queries, followed by the United States at 15.9% and Singapore at 9.7%. Query type breakdowns show A records comprising 62.7% of requests, AAAA records at 25.9%, and various other record types totaling 11.4%.

Certificate issuance volume provides another activity metric. The platform tracks total certificates issued over selected periods, with distribution across certificate authorities. Internet Security Research Group issued 3,900 certificates for .land domains in the measured seven-day period, while Google Trust Services LLC issued 1,000 and Sectigo issued 400.

The announcement detailed DNSSEC support verification through Delegation Signer records in the root zone. The system parses records to identify associated DNSSEC algorithms. For .land, RSA/SHA-256 provides the security algorithm. RDAP (Registration Data Access Protocol) support appears when TLDs list in the IANA RDAP bootstrap file, offering standardized methods for querying domain contact and nameserver information.

Cloudflare Registrar integration enables direct domain registration for supported TLDs. As of the announcement date, the registrar supports over 400 TLDs with no add-on fees beyond base costs. The 1.1.1.1 resolver's reputation for speedpositions Cloudflare uniquely for DNS analysis, processing approximately 6 million DNS requests per second.

The platform's data sources extend beyond DNS queries. Certificate Transparency logs monitored by Cloudflare provide insights into TLS/SSL certificate issuance patterns. Individual TLD pages display line charts showing certificate volumes over time, plus distribution charts depicting issuance across top certificate authorities. This supplements email security data introduced in March 2024, which highlighted TLDs associated with malicious and spam email based on From: header analysis.

WHOIS information completes each TLD's profile. Creation dates, last update timestamps, and nameserver configurations appear in dedicated cards. The .land TLD received its last update on October 7, 2025, maintaining six nameservers distributed across v0n0.nic.land through v2n1.nic.land designations.

The system supports both punycode (A-Label/ASCII-Label) and internationalized domain name (IDN) (U-Label/UNICODE-Label) representations. The South Korean TLD .kr appears as 한국 in U-Label format and xn--3e0b707e in A-Label format. Search functionality and API access accommodate both representations, enabling comprehensive coverage of non-ASCII TLDs.

Cloudflare aggregates individual client IP addresses into subnet groupings, termed "networks" for magnitude calculations. This methodology accounts for organizational IP blocks that might generate numerous queries from multiple addresses, providing more accurate reach measurements than raw query counts.

The magnitude metric originated from work by nic.at, the Austrian domain registry operator. The approach estimates domain visibility across the Internet by balancing query volume against source diversity. Higher values approaching 10 indicate queries from broader network ranges, suggesting greater global visibility and potentially higher name collision likelihood.

According to ICANN definitions, name collisions occur when private namespace resolution attempts query public DNS systems. Overlapping administrative boundaries between private and public namespaces can produce unintended or harmful results. ICANN's planned .home delegation could create significant issues for users operating .home domains within local networks. ICANN has consistently emphasized DNS security through initiatives including DNSSEC deployment recommendations.

The DNS page expansion includes "Top-level domain distribution" sections, featuring line charts showing query distribution across the top 10 TLDs and tables extending rankings to 100 positions. This extends previous ccTLD-specific query volume data to encompass all delegated TLDs.

TLD managers receive external perspectives on query responsiveness through the platform. Site owners and developers gain insights into potential performance impacts from associated TLD nameserver operations when evaluating registration options. Cloudflare processes billions of daily queries to these nameservers, positioning the company to analyze performance patterns.

The company plans to add nameserver performance insights to TLD pages in 2026. These additions will provide TLD managers with external query responsiveness perspectives while giving developers and site owners performance impact assessments for domain registration decisions.

API access enables programmatic data retrieval. Radar's Data Explorer and AI Assistant support interactive exploration of TLD datasets. Charts and graphs offer download functionality for sharing, plus embedding capabilities for blog posts, websites, and dashboards.

Non-delegated TLDs appear in DNS Magnitude rankings but lack dedicated pages. The distinction separates officially assigned and active root zone TLDs from those not currently part of public DNS. Status columns indicate delegation states alongside type classifications, management entities, and magnitude values.

The paginated ranking table displays the top 2,500 TLDs. Each entry links to dedicated pages for delegated domains, providing access to detailed analytics and technical specifications. The ranking updates based on ongoing query analysis from 1.1.1.1 resolver traffic.

Response code analysis supplements query type breakdowns. The platform categorizes DNS responses, providing visibility into successful resolutions versus various error conditions. This data helps identify potential configuration issues or attack patterns affecting specific TLDs.

DNSSEC validation status appears in query breakdowns. The metric shows what percentage of queries receive cryptographically verified responses, indicating security posture across TLD zones. Higher DNSSEC validation rates suggest stronger security implementations by TLD operators.

Cloudflare's network scale provides representative Internet traffic perspectives. The company handles over 60 million HTTP requests per second globally, with approximately 70% received over TCP connections and 30% utilizing QUIC/UDP protocols. This massive infrastructure enables comprehensive observation of network behaviors.

TLD policy links appear in detail cards, directing users to registry policies governing domain registration and management. For .land, the policy URL points to identity.digital/policies, the policy framework operated by the registry manager. These policies typically specify registration requirements, acceptable use guidelines, and dispute resolution procedures.

IANA's Root Zone Database serves as the authoritative source for TLD lists and management details. The database maintains delegation records, including type classifications and operator information. Cloudflare derives TLD information from this database, ensuring accuracy in platform displays.

The timing coincides with ICANN's announced expansion plans. As of October 2025, over 1,400 valid TLDs appear in ICANN's registry, with further expansion expected beginning April 2026. The planned expansion will introduce additional naming options for organizations and individuals seeking domain registrations.

Certificate authority distribution patterns reveal security infrastructure preferences. For .land, Internet Security Research Group dominates issuance with 67% of certificates, while Google Trust Services accounts for 17%, Sectigo for 7%, and GoDaddy for 5%. These distributions indicate which certificate authorities TLD users favor for securing web traffic.

Geographic query patterns expose regional usage concentrations. Beyond the top three countries for .land (Germany, United States, Singapore), Canada contributes 7.4% of queries, Netherlands 5.2%, and Brazil 3.5%. The distribution continues through 20 listed countries, with remaining regions collectively accounting for the balance.

Choropleth maps visualize geographic distributions through color-coded country representations. Darker shades indicate higher query percentages, enabling quick identification of primary usage regions. The interactive maps support detailed examination of country-specific data through hover interactions and click-through functionality.

Time series charts display activity trends over selectable periods. Users can examine one-hour, 24-hour, seven-day, and 30-day windows, revealing usage patterns and identifying anomalies. The annotations feature enables marking significant events that may correlate with traffic changes.

The DNS query volume section includes toggleable views for worldwide queries versus previous period comparisons. This enables trend analysis, showing whether TLD activity increases, decreases, or remains stable. Pattern recognition helps identify seasonal variations or emerging usage trends.

Record type distributions provide protocol implementation insights. High A record percentages indicate predominantly IPv4 usage, while substantial AAAA record volumes suggest IPv6 adoption. NS record queries reflect nameserver lookups, and SRV records indicate service discovery implementations.

The announcement emphasized Cloudflare's commitment to Internet transparency and measurement. "Building on this, today we are launching a new TLD page on Radar that, based on aggregated data from multiple Cloudflare services, provides insights into TLD popularity, activity, and security," the company stated.

Location data for users accessing the platform shows Frankfurt am Main, Hesse, Germany as an example reference point. The system incorporates user location naturally for location-dependent queries without explicit location references, improving relevance for geographic-specific information requests.

The development builds on February 2025's DNS-related insights addition to Radar. Those insights stemmed from 1.1.1.1 Public DNS Resolver traffic analysis, establishing the foundation for expanded TLD tracking capabilities. The progression demonstrates Cloudflare's systematic platform enhancement approach.

Email security metrics from March 2024 highlighted "Most abused TLDs" through analysis of sending domain TLDs extracted from From: headers. This email-based perspective complemented web traffic analysis, though the October announcement focuses exclusively on DNS and certificate data rather than email patterns.

Certificate Coverage sections visualize pre-certificate distribution across top TLDs. These insights emerged during 2025's Birthday Week when Cloudflare introduced Certificate Transparency insights. The CT log monitoring provides different TLD activity perspectives compared to email metrics, focusing on domains actively securing web traffic.

The platform enables users to identify trending domains beyond just popular ones. Algorithmic calculations determine trend status, helping users discover emerging domains before they reach mainstream adoption. This supports both research applications and business intelligence gathering.

Technical infrastructure requirements appear in TLD detail cards. Nameserver specifications, DNSSEC algorithms, and RDAP endpoints provide necessary information for technical users managing domains or researching DNS implementations. The comprehensive technical data supports both casual research and detailed technical analysis.

Social media integration encourages community engagement. The announcement directs users to tag @CloudflareRadar on X, noc.social/@cloudflareradar on Mastodon, and radar.cloudflare.com on Bluesky when sharing TLD charts and graphs. Email contact options support questions, comments, and data suggestions.

The expansion represents significant development in Internet measurement tools. TLD-specific insights enable registry operators, domain registrars, developers, and researchers to understand domain ecosystem dynamics. The free platform access democratizes data previously available only through expensive commercial services or limited academic access.

Domain registration decisions benefit from performance and security insights. Organizations evaluating TLD options can examine query patterns, certificate issuance rates, and geographic distributions before committing to specific domains. This information supports informed decision-making for branding and infrastructure choices.

Timeline

• November 8, 2013 - .land TLD created under Binky Moon, LLC management
• 1990 - .su TLD delegated for Soviet Union
• February 2019 - ICANN calls for full DNSSEC deployment across unsecured domains
• September 2020 - Cloudflare Radar platform launches
• March 2024 - Cloudflare introduces "Most abused TLDs" metric on Email Security page
• September 2024 - Cloudflare launches TCP connection anomaly dashboard on Radar
• January 2025 - Google Registry announces .channel domain launch
• February 2025 - Cloudflare adds DNS-related insights to Radar from 1.1.1.1 resolver analysis
• October 7, 2025 - .land TLD receives last update
• October 27, 2025 - Cloudflare announces comprehensive TLD insights on Radar platform
• April 2026 - ICANN expansion expected to begin, adding additional TLDs
• 2026 - Cloudflare plans to add nameserver performance insights to TLD pages
• 2030 - ICANN reportedly plans to retire .su TLD

Five Ws Summary

Who: Cloudflare announced the launch through blog post authors André Jesus and David Belson. The feature impacts TLD managers, domain registrars, developers, site owners, and Internet researchers. Binky Moon, LLC manages the .land TLD example highlighted in the announcement.

What: Cloudflare launched comprehensive top-level domain insights on its Radar platform, providing analytics for over 1,400 TLDs. The feature introduces DNS Magnitude as a ranking metric, based on unique client networks querying each domain rather than raw query counts. Individual TLD pages display DNS query volumes, geographic distributions, certificate issuance data, WHOIS information, DNSSEC support, and RDAP availability. The platform supports over 400 TLDs through Cloudflare Registrar for direct domain registration.

When: The announcement occurred on October 27, 2025. The development builds on Cloudflare Radar's 2020 launch and February 2025's addition of DNS-related insights. Cloudflare plans to add nameserver performance metrics in 2026. The .land TLD referenced as an example was created November 8, 2013, and last updated October 7, 2025.

Where: The insights derive from Cloudflare's 1.1.1.1 public DNS resolver, which processes approximately 6 million DNS requests per second globally. Certificate Transparency data comes from CT logs monitored by Cloudflare. Geographic distribution analysis for .land shows Germany leading with 28.6% of queries, followed by the United States at 15.9% and Singapore at 9.7%. The data encompasses global Internet traffic patterns observed across Cloudflare's network infrastructure.

Why: The launch addresses the need for transparent TLD visibility and performance metrics. According to the announcement, DNS Magnitude provides more accurate reach measurements than simple query counting, as small numbers of sources can generate large query volumes. The feature gives TLD managers external perspectives on query responsiveness while helping developers and site owners understand potential performance impacts of TLD nameserver operations. The timing coincides with ICANN's planned expansion beginning April 2026, which will add additional TLDs to the existing 1,400+ domains. The platform democratizes access to TLD analytics previously available only through expensive commercial services or limited academic resources.