DNS Providers
DNS Providers — 5 vendors and operators, each broken down by layer L1 to L7: what they sell at that layer, and which layer is their home turf.
Verisign
Home turf: L7 / OPS
L1 Physical
This layer is explicitly empty — no product or service. The anycast nodes this domain operates are indeed distributed across a large number of sites worldwide, but those sites are other parties' facilities (this site's Equinix and Digital Realty data-centre domains are providers of such space), and it neither owns nor sells physical infrastructure.
L2 Data Link
This layer is explicitly empty — no product or service. This domain offers no link-layer product or service, and its services rest entirely on network connectivity provided by others.
L3 Network
This layer is the technical foundation letting DNS services scale and resist attack, and where the widespread misconception that there are only thirteen root servers gets corrected.
L4 Transport
This layer covers how DNS queries actually travel over the network, and it carries one piece of historical baggage worth knowing. DNS traditionally uses UDP on port 53, because queries and responses are usually small and connectionless UDP avoids handshake overhead.
L5 Session
This layer is explicitly empty — no product or service. DNS queries are stateless question-and-answer exchanges with no session concept to maintain; the EPP interaction between registrar and registry is a stateful connection, but that belongs to the registration plane's application-layer protocol (see L7) and does not constitute a separate session-layer prod…
L6 Presentation
This layer is where DNSSEC sits: what it does is data-origin authentication and integrity signing — letting a resolver verify that a response genuinely came from the domain's authorised holder and was not tampered with in transit — a presentation-layer-natured capability rather than encryption (DNSSEC does not encrypt content, it only signs).
L7 Application
This is this domain's star layer and where the DNS category's core concept sits. First, the difference between registry and registrar, the most easily confused point in the whole resolution chain.
Cross-layer: What to Do About a Dependency You Cannot Buy
This is this domain's second star layer and the most practically useful part of the page, because it answers a concrete question: what can you actually do about a dependency you cannot buy, cannot make redundant and cannot escape?
GoDaddy
Home turf: L7 / OPS
L1 Physical
This layer is explicitly empty — no product or service. This domain neither owns nor sells physical infrastructure; its resolution service runs on nodes leased or built inside others' facilities, which does not constitute a physical-layer product.
L2 Data Link
This layer is explicitly empty — no product or service. This domain offers no link-layer product or service.
L3 Network
The anycast mechanism, and why it delivers both lower latency and attack dispersion, are explained fully at L3 of this site's Verisign domain and are not repeated here. This domain's hosted authoritative resolution likewise runs on anycast infrastructure, but it has no differentiated capability at this layer beyond the generic mechanism and does not market n…
L4 Transport
This layer is explicitly empty — no product or service. DNS transport behaviour (UDP and TCP on port 53, EDNS0 and the large-response trap) is a mechanism common to the whole protocol, explained fully at L4 of this site's Verisign domain, and this domain has no product or differentiated capability of its own at this layer, so it is not double-counted.
L5 Session
This layer is explicitly empty — no product or service. DNS queries are stateless with no session concept to maintain; console login sessions are an application-layer feature of its portal and do not constitute an independent session-layer product.
L6 Presentation
This layer's content is real and practical, covering the two direct connection points between certificates and DNS, and understanding them avoids two frequent classes of incident. The first is issuance validation: obtaining a certificate by domain validation requires adding a validation record in DNS, and automatic renewal repeats that validation periodicall…
L7 Application
This is this domain's star layer, holding its two main businesses. The first is the registrar business: submitting registration and delegation changes to the registry on your behalf (registry-side mechanics at L7 of this site's Verisign domain).
Cross-layer: Account Risk, Asset Governance and Selection
This is this domain's second star layer and the most practically useful part of the page. The core risk should be stated fully: the registrar account is the credential most worth protecting anywhere along the resolution chain, because its privilege is changing delegation, and changing delegation means taking over everything about that domain.
Cloudflare DNS
Home turf: L4 / L7 / OPS
L1 Physical
This layer is explicitly empty — no product or service. Its global edge network does have a physical form, but that belongs to the Cloudflare domain in this site's CDN and edge category (which covers that edge platform's full L1 to L7).
L2 Data Link
This layer is explicitly empty — no product or service. This domain offers no link-layer product under the DNS subject.
L3 Network
The anycast mechanism is explained fully at L3 of this site's Verisign domain and is not repeated here. What deserves singling out for this domain at this layer is that its anycast network carries three roles at once — the same nodes serve as your authoritative DNS, as the landing point for the public resolver 1.1.1.1, and as the edge users actually connect…
L4 Transport
This is one of this domain's star layers, because at this layer it has had a genuine effect on the whole industry: it was early to make encrypted resolution (DoH and DoT) available at large scale, materially pushing that technology from proposal toward default.
L5 Session
This layer is explicitly empty — no product or service. DNS queries themselves are stateless, and the TLS or HTTPS connections encrypted resolution establishes are transport- and presentation-layer mechanisms (see L4 and L6) rather than an independent session-layer product of this domain.
L6 Presentation
This layer holds two items. First, DNSSEC: it offers one-click signing at the base tier and generates the trust record needing submission to the parent registry, with mechanics, the trust chain and the frequent 'DS out of step during key rollover' incident all at L6 of this site's Verisign domain and not repeated here; only one practical point is stressed —…
L7 Application
This is this domain's star layer, because all four of its roles land here. First, at-cost registration: selling domains at the registry's wholesale cost without markup, a clear outlier in a market that earns on the gap between low first-year and high renewal pricing (contrast this site's GoDaddy domain) — but one precondition must be known first: registering…
Cross-layer: Concentration Assessment and Tier Boundaries
This is this domain's second star layer, addressing the most substantive question about this company on this page: putting registration, authoritative resolution, recursive resolution, traffic proxying and security all with one provider brings real convenience and real concentration. Three items.
Quad9
Home turf: L7 / OPS
L1 Physical
This layer is explicitly empty — no product or service. It owns no physical infrastructure: its anycast nodes come largely from sites provided free or at low cost by non-profit partners, and that collaborative model is itself why it can operate at extremely low cost (mechanism at L3), but it does not constitute a physical-layer product of its own.
L2 Data Link
This layer is explicitly empty — no product or service. This domain offers no link-layer product.
L3 Network
The anycast mechanism is explained fully at L3 of this site's Verisign domain and is not repeated here. What deserves singling out for this domain at this layer is that its anycast coverage was obtained through collaboration rather than capital investment: nodes come largely from sites provided by non-profit partners, including the class of organisation that…
L4 Transport
DNS's base transport behaviour is at L4 of this site's Verisign domain; the full technical detail of encrypted resolution (DoT on dedicated port 853, DoH on 443 and indistinguishable from web traffic) and its implications for enterprise control are at L4 of this site's Cloudflare DNS domain, and the mechanics are generic so they are not repeated here.
L5 Session
This layer is explicitly empty — no product or service. DNS queries are stateless, and the TLS or HTTPS connections encrypted resolution establishes are transport-layer mechanisms (see L4).
L6 Presentation
This layer holds a difference in role, opposite to this category's other domains, worth singling out: this site's Verisign, GoDaddy and Cloudflare DNS domains all act as signers on DNSSEC (signing zones), whereas this domain acts as a validator — it validates DNSSEC on returned answers by default and withholds the answer if validation fails.
L7 Application
This is this domain's star layer and its substance. It is a free public recursive resolver, and what distinguishes it from other public resolvers is its default behaviour: it blocks known malicious domains by default.
Cross-layer: Governance, Jurisdiction, the Litigation and Enterprise Limits
This is this domain's second star layer and where the page's real value lies — because the other four domains in this category are companies and only this one is a non-profit foundation, what it can show is precisely what commercial vendors' pages cannot: governance, jurisdiction and legal exposure. Two items.
Infoblox
Home turf: L3 / L7 / OPS
L1 Physical
This layer records its deployment forms and one frequently violated availability discipline. It comes in three forms: physical appliances; virtual appliances (data plane local, more robust in branch and network-constrained environments); and a cloud management platform (centrally managing each site's configuration from the cloud, with a lower operational bur…
L2 Data Link
This layer is explicitly empty — no product or service. This domain offers no link-layer product, and its services rest on existing network connectivity.
L3 Network
This is one of this domain's star layers and its structural distinction within this category: the other four domains manage only names, so their content concentrates at L7, whereas only this domain also manages addresses — and address assignment (DHCP) and address space management (IPAM) are themselves network-layer matters.
L4 Transport
This layer is explicitly empty — no product or service. DNS transport behaviour (UDP and TCP on port 53, EDNS0 and the large-response trap) is a mechanism common to the whole protocol, explained fully at L4 of this site's Verisign domain, and this domain has no product or differentiated capability of its own at this layer.
L5 Session
This layer is explicitly empty — no product or service. Neither DNS queries nor DHCP exchanges constitute application sessions requiring maintenance; login sessions on the platform's management interface are its own administrative feature rather than an independent session-layer product.
L6 Presentation
This layer is explicitly empty — no product or service. This domain has no encryption or signing capability as a standalone product line. Stated honestly: its platform can enable DNSSEC signing for internal zones, but the real benefit of enabling DNSSEC in an internal environment is limited (internal resolution paths are controlled and the attack surface dif…
L7 Application
This is this domain's star layer, holding two items. The first is internal resolution itself, where what most needs explaining is coexistence with directory services: in an environment with a Microsoft domain, domain controllers are also DNS servers (domain logon, group policy and in-domain service discovery all depend on them), and that path is not chosen b…
Cross-layer: Licensing Basis, Device Lifecycle and Backup Recovery
This is this domain's second star layer, with three things specific to this class of platform that easily go wrong in budgets and operations. First, billing by managed object count rather than by query volume — entirely different from the other four domains in this category: managed objects grow naturally with your network, so licence cost rises alongside de…