The internet, explained

The internet is made up of independent networks called Autonomous Systems (ASes), each identified by an Autonomous System Number (ASN). Counting ASNs is counting the public networks it is made of. Cloudflare operates AS13335. Google operates AS15169.

Each AS announces the ranges of IP addresses it can reach — its address space. Other networks pass those announcements on, so traffic moves from network to network until it reaches its destination.

An AS decides what it announces and to whom, so any count of networks is a count of what was visible from where it was observed. A company can run more than one — Amazon announces through AS16509 and AS14618 — so an ASN identifies a network, not a company.

Prefixes are written in CIDR notation, such as 203.0.113.0/24. For IPv4, a /24 contains 256 addresses. A /16 contains 65,536. A /25 contains 128. The larger the number after the slash, the smaller and more specific the block.

Prefixes can sit inside one another. A network holding a /16 can announce the whole block, or divide it into smaller prefixes and announce those separately.

Where two announced routes both cover a destination, routers use the more-specific prefix. This is known as longest-prefix matching. It is fundamental to internet routing, and it also explains how a more-specific route can attract traffic away from a legitimate, less-specific one.

An IP prefix normally has one origin AS. A Multi-Origin AS (MOAS) observation occurs when two or more networks announce the same prefix.

That can look suspicious, but it is often legitimate. An organization may deliberately announce the same address space through multiple networks for resilience, for traffic engineering, or during an infrastructure migration.

The important signal is not that multiple origins exist, but how the relationship behaves over time. A pattern that has held for more than 30 days, the threshold our measurement uses, is more likely to represent an intentional operational arrangement. A new origin that appears unexpectedly and then disappears has a different risk profile.

Routing runs on assertion. A network tells its neighbors which prefixes it can reach, they pass that on, and nothing in the protocol asks for proof of entitlement.

The usual method is to announce a more-specific prefix. If the rightful holder announces a /24 and an attacker announces a /25 inside it, the /25 is preferred — not because it is trusted, but because it is more specific.

Traffic then arrives at the wrong network, which can read it, discard it, or forward it on so that the diversion goes unnoticed. Some events last minutes and resemble a configuration error. Others are deliberate and target a single prefix.

The holder of an IP prefix publishes a Route Origin Authorization (ROA): a signed record naming the AS permitted to announce it, and the longest prefix that AS may announce.

A network operator can then validate an announcement against the published ROAs, and gets one of the three results above. Validation is a choice each network makes; nothing in BGP performs it automatically.

Not-found is not a failed check. It means no ROA was published, which is different from a claim that turned out to be false.

Anyone can put your domain in the From line of an email. SPF and DKIM give a receiver two ways to test that claim — one checks the sending server, the other checks a signature — and both only produce a result.

DMARC is where the domain owner says what to do with that result. Its policy tag is the whole of the instruction, and it is the only part of the chain that changes what happens to a message.

BIMI sits on top and depends on everything beneath it: a domain cannot reach it without enforcing DMARC first.

Mail between servers is encrypted opportunistically. The receiving server advertises STARTTLS, the sender takes it up, and the message travels encrypted. The advertisement itself is sent in the clear.

Anyone in the path can remove it. The sending server sees no offer of encryption and delivers in plaintext rather than fail. Neither side is alerted.

MTA-STS publishes the requirement in advance. It has two halves and both are required: a DNS TXT record at _mta-sts naming the current policy version, and a policy file served over HTTPS listing your mail servers and a mode. Only enforce refuses delivery; testing asks senders to report failures while still delivering.

Trust is not partitioned by name. A mistake or a compromise at any one certificate authority produces a certificate for your domain that every browser accepts.

A CAA record is a standing instruction in DNS naming the authorities permitted to issue for you. Since 2017 a CA has been required to check it before issuing, and to refuse where it is not named.

It is checked when a certificate is requested, not when a visitor connects. It does not affect a certificate that already exists; it narrows who could obtain one.

DNS answers arrive with nothing to prove where they came from. Anything able to reply before the real server, or to sit in the path, can supply a different address.

DNSSEC signs the records. A signature is only useful if the key behind it can be trusted, so each zone publishes a fingerprint of its child's key: the root vouches for .com, .com vouches for example.com. A validating resolver checks that chain.

Because it is a chain, it fails as a chain. If a signature expires or a key is rotated without updating the parent, the domain does not revert to unsigned — a validating resolver refuses the answer and returns nothing.

Someone registers a name and builds nothing on it. Rather than leave it dark, they point its nameservers at a parking platform, which serves a placeholder page carrying adverts and often an offer to sell.

The domain is fully alive in DNS. It resolves, it answers queries, and it appears in any count of registered or resolving domains. What it does not have is anyone operating it.

Parked domains often publish more email authentication than real ones. The platform provisions SPF and DMARC from a template across every domain it holds, so the records exist in enormous numbers and say nothing about anyone's security posture.