Infrastructure Concentration Index: How Much of the Web Depends on Cloudflare, AWS, and Google

On November 18, 2025, a database permission change at Cloudflare cascaded into a five-hour global outage. X, ChatGPT, Spotify, and thousands of other services went dark. Three weeks later, it happened again — a WAF configuration change knocked out 28% of Cloudflare's HTTP traffic. Then on February 20, 2026, a BGP withdrawal took down Uber, Wikipedia, and Microsoft Outlook for over six hours. Three major outages in four months from a single company.

We wanted to quantify the actual dependency. How concentrated is the web's infrastructure? We took 1.4 million classified domains from LLMSE's database and cross-referenced three infrastructure layers — web servers, DNS providers, and email providers — to measure overlap, concentration, and single-vendor dependency at a scale no public study has attempted.

The result: the internet is more concentrated than the U.S. antitrust threshold for "highly concentrated markets" — and the overlap data is worse than the market share numbers suggest.

Three Layers, Three Chokepoints

Every website depends on at least three infrastructure services: a web server to serve pages, a DNS provider to resolve the domain name, and an email provider for business communication. These are independent systems — or should be. When a single vendor controls multiple layers for the same domain, a single outage can sever all three.

We analyzed provider data across all three layers:

One name dominates two of three layers. Cloudflare is the largest web server (by response header) and the largest DNS provider in our dataset — by a factor of four over the next competitor.

Web Server Concentration

The top three servers — Cloudflare, nginx, and Apache — handle 73.9% of all sites with a detectable server header. This is a Herfindahl-Hirschman Index (HHI) of 2,047, which the U.S. Department of Justice classifies as a "moderately concentrated" market.

But the web server layer understates the problem. nginx and Apache are open-source software that runs on thousands of independent hosting providers. Cloudflare is a single company operating a single global network. When nginx has a vulnerability, patches roll out across thousands of independent operators over days. When Cloudflare has an outage, 385,000 sites go down simultaneously.

DNS Concentration

DNS is where concentration becomes alarming. Cloudflare controls 40.1% of DNS — four times larger than the second-place provider (GoDaddy at 10.1%). The DNS layer HHI is 2,578, crossing the threshold into a "highly concentrated" market.

The top three DNS providers (Cloudflare, GoDaddy, AWS Route 53) account for 59.1% of all DNS resolution in our dataset. The top five account for 64.6%.

This matters because DNS is the internet's address book. When a DNS provider fails, domains don't just load slowly — they disappear entirely. The October 2025 AWS US-EAST-1 outage demonstrated this: a race condition in DynamoDB's internal DNS management cascaded through EC2, Lambda, and CloudWatch, disrupting approximately 1,000 platforms and causing estimated losses exceeding $500 million.

Email Concentration

Email is a duopoly. Google Workspace and Microsoft 365 together control 65.6% of all email — nearly two-thirds of the web's business communication routed through two companies. The email layer HHI is 2,541, another "highly concentrated" market.

The remaining third is fragmented across dozens of providers: hosting companies (OVH, Namecheap, IONOS, Hostinger), security gateways (Proofpoint, Mimecast, Barracuda), and newer entrants like Cloudflare Email and Zoho Mail. No other provider exceeds 3%.

The Overlap Problem: 202,884 Double-Dependent Domains

Market share numbers tell you how big each provider is. Overlap data tells you how fragile each domain is.

We cross-referenced the three layers at the domain level to find sites depending on the same vendor for multiple critical services:

202,884 domains use Cloudflare for both their web server and DNS. That's 52.7% of all Cloudflare web users and 72.6% of all Cloudflare DNS users. For these domains, a Cloudflare outage doesn't just slow page loads — it makes the domain unresolvable. No DNS, no website, no fallback.

Another 6,297 domains go further: Cloudflare for web serving, DNS, and email. A single outage disables their website, makes their domain unresolvable, and cuts off their email. Triple lock-in.

The Google ecosystem shows a similar but smaller pattern: 8,547 domains use Google Cloud DNS and Google Workspace email together. AWS shows 1,850 domains using Route 53 for DNS and Amazon SES for email.

Concentration by Industry

Cloudflare's penetration varies dramatically by industry. Some sectors are far more dependent than others:

Gambling leads at 69.4% Cloudflare penetration — over two-thirds of the industry behind a single provider. The reason is straightforward: gambling sites are prime targets for DDoS attacks, and Cloudflare's DDoS mitigation is included in its free and low-cost plans. Online casinos and betting platforms adopt Cloudflare not just for CDN performance but for survival against attack traffic.

Shopping (61.4%) and Games (56.3%) follow the same pattern: industries where uptime directly equals revenue and DDoS attacks are common.

Computer & Electronics is the least Cloudflare-dependent at 15.0% — the most technically sophisticated audience is also the most diversified in infrastructure choices. These sites are more likely to self-host on nginx (53,637 domains) than delegate to any CDN.

The Email Duopoly by Industry

Google and Microsoft's combined email dominance varies by sector:

Shopping has the highest Google+Microsoft email penetration at 43.2%. Traditional business sectors (Business & Industry, Finance, Health, Education) cluster around 28-30%. Gambling is the lowest at 6.9% — the industry that most depends on Cloudflare for web infrastructure least depends on mainstream email providers, likely using offshore or privacy-focused alternatives.

The HHI Scorecard

The Herfindahl-Hirschman Index measures market concentration on a 0-10,000 scale. The U.S. DOJ considers markets above 2,500 "highly concentrated." The Internet Society's Pulse project calculated a CDN market HHI of 3,410 for the top 10,000 websites globally as of November 2025.

Our data across 1.4 million domains:

Two of three infrastructure layers exceed the "highly concentrated" threshold. The third is approaching it. Every layer has a single provider controlling 30%+ of the market.

Why This Matters Now

This data lands in a specific context:

Three Cloudflare outages in four months. November 2025 (5 hours), December 2025 (28% of HTTP traffic), February 2026 (6 hours). Cloudflare declared "Code Orange" — a company-wide priority to improve resilience above all other work.

The AWS US-EAST-1 failure. On October 20, 2025, a DynamoDB DNS race condition cascaded through AWS's Virginia region, affecting 30-40% of global workloads and an estimated 1,000 platforms. Estimated losses exceeded $500 million.

EU NIS2 now classifies CDN providers as critical infrastructure. The directive entered force in October 2024 and explicitly names CDN providers, DNS services, and cloud computing as "essential entities" subject to the highest regulatory scrutiny, with penalties up to 10 million euros or 2% of global annual turnover.

Forrester predicts at least two major multi-day hyperscaler outages in 2026, as AWS, Azure, and Google Cloud prioritize AI infrastructure upgrades over aging legacy systems.

The question isn't whether concentration exists — it's whether 202,884 domains with Cloudflare double-dependency understand the risk they carry.

Key Findings

1. Cloudflare is the single largest chokepoint across web and DNS

Cloudflare is the #1 provider in two of three infrastructure layers (web serving and DNS), controlling 31.5% and 40.1% respectively. No other company appears in the top position on more than one layer. The 202,884 domains using Cloudflare for both web and DNS have zero infrastructure diversity — a single point of failure across their two most critical services.

2. The email layer is a duopoly

Google Workspace (37.3%) and Microsoft 365 (28.3%) together control 65.6% of email. This is the most concentrated layer by combined top-two share, though the HHI is slightly lower than DNS because the concentration is split between two providers rather than dominated by one.

3. DDoS-targeted industries are the most concentrated

Gambling (69.4%), Shopping (61.4%), and Games (56.3%) have the highest Cloudflare web penetration. These are industries where DDoS protection is existential, pushing them toward the dominant DDoS mitigation provider — and creating the deepest single-vendor dependency.

4. Technical sophistication correlates with infrastructure diversity

Computer & Electronics (15.0% Cloudflare, 25.9% nginx) is the least concentrated industry, with the most even distribution across providers. The audiences that understand infrastructure best are the least likely to concentrate it.

5. All three layers exceed or approach the "highly concentrated" threshold

DNS (HHI 2,578) and Email (HHI 2,541) are both classified as "highly concentrated" markets. Web servers (HHI 2,047) are moderately concentrated and trending upward. For context, the Internet Society calculated a CDN HHI of 3,410 for the top 10,000 websites — even more concentrated among the most popular sites.

Methodology

This analysis cross-referenced three infrastructure datasets in LLMSE's classification database as of February 25, 2026:

• Web servers (1,221,928 domains): Detected from HTTP response Server headers during classification. Cloudflare, nginx, Apache, and other servers are identified by their response headers. Note: Cloudflare acts as a reverse proxy — sites reporting Cloudflare as their server may run nginx or Apache behind Cloudflare's CDN.
• DNS providers (696,606 domains): Detected by resolving NS records for each domain and matching nameserver hostnames against 1,129 patterns covering 240+ providers.
• Email providers (468,791 domains): Detected by resolving MX records and matching against 370 patterns covering 187 providers.

Cross-referencing was performed by converting all domain identifiers to bare domain format and computing set intersections. The Herfindahl-Hirschman Index was calculated as the sum of squared market shares (as percentages) for the top 10 providers in each layer.

Limitations: Web server detection captures the frontmost server in the response chain — sites behind Cloudflare's CDN report "Cloudflare" even if they run nginx or Apache on origin. This means Cloudflare's web share includes both sites using Cloudflare as their sole server and sites using it as a CDN layer. DNS and email detection requires successful DNS resolution, which may miss domains with expired or misconfigured DNS. Not all 1.4 million classified domains have data on all three layers — web server coverage is deepest, followed by DNS and email.

Explore the Data

Browse infrastructure distributions on LLMSE's technology index: web servers, DNS providers, and mail providers. Check any domain's full infrastructure profile on its domain detail page. The REST API provides programmatic access to all classification and infrastructure data.

This analysis was conducted using LLMSE, which has classified over 1.4 million websites across SEO, EEAT, WCAG accessibility, readability, and GARM brand safety dimensions. All data reflects the database as of February 2026. To analyze your own site, visit llmse.ai/classify.