Quarterly domain activity reflects both stable patterns and changes across the namespace. In Q1 2026, this was visible in the rankings of leading TLDs, registrars, and MX and NS domains.

In Q2 2026, while many of the topnotchers across NRD registrations, including those likely registered with malicious intent and confirmed malicious, remained the same, we witnessed several ranking changes.

To examine the latest trends, WhoisXML API analyzed 30.0+ million NRDs registered between 1 April and 30 June 2026 as recorded in the Newly Registered Domains (NRDs) Data Feed.

The analysis covered the prevalence of leading gTLDs and ccTLDs and the registrars administering the highest NRD volumes. We also found that 7.6+ million of the quarter’s NRDs were likely registered with malicious intent.

We also took a closer look at 2.8+ billion MX domains and 4.7+ billion NS domains obtained from DNS Database Download to determine the top 5 for both covering the past three months.

Finally, we studied 3.2+ million confirmed malicious domains based on data from the Threat Intelligence Data Feeds to identify the top 5 TLDs in Q2 2026.

Our domain activity trends analysis allowed us uncover the following:

• The top NRD TLD extensions, zooming in on the gTLD and ccTLD extensions as well
• The most popular NRD registrars
• The top TLDs of the NRDs likely registered with malicious intent
• The top MX and NS domains
• The top TLDs of the confirmed malicious domains

Together, these findings provide a data-based view of how new domain registrations, DNS infrastructure, and malicious domain activity were distributed in Q2 2026.

An overview of the key insights from the report is presented below. You may also access the complete Global Domain Activity Report: Q2 2026 here.

New Domain Registration Patterns

In Q2 2026, 30.0+ million NRDs were registered, up 13.1% from the 26.5+ million NRDs seen in Q1 2026.

We learned that 16.1+ million NRDs used the top 5 gTLDs in Q2 2026, while 2.7+ million NRDs sported the top 5 ccTLDs.

We then dissected the data further and discovered that:

• While the top 5 gTLDs this quarter still had the same players as in Q1 2026, only three kept their ranking. The .xyz and .shop gTLDs exchanged places.

  Q2 2026 TOP gTLD	Q2 2026 gTLD VOLUME	Q1 2026 gTLD VOLUME	QoQ RANKING CHANGE
  .com	11,588,825	10,479,458	→ (Unchanged)
  .top	1,575,021	1,000,527	→ (Unchanged)
  .xyz	1,332,646	791,749	↑ from 4 to 3
  .shop	879,245	938,453	↓ from 3 to 4
  .org	776,606	733,219	→ (Unchanged)

• The top 5 ccTLD extensions also remained the same from Q1 to Q2 2026 despite ranking changes for three.

  Q2 2026 TOP ccTLD	Q2 2026 ccTLD VOLUME	Q1 2026 ccTLD VOLUME	QoQ RANKING CHANGE
  .cn	983,659	607,552	→ (Unchanged)
  .uk	478,745	486,710	→ (Unchanged)
  .cc	434,814	329,815	↑ from 5 to 3
  .ru	421,979	450,594	↓ from 3 to 4
  .br	407,748	334,951	↓ from 4 to 5

Check out more NRD-related trends in the report.

How Many of the Q2 2026 NRDs Were Likely Registered with Malicious Intent?

We learned that the 4.5+ million of the NRDs sporting the top 5 TLDs were likely registered with malicious intent.

Global DNS Activity Trends

Our analysis of the top MX and NS domain TLDs revealed that:

• The total number of site owners using the top 5 MX domains increased by 6.8% from 1.3+ billion in Q1 to 1.4+ billion in Q2 2026.
• The total number of site owners using the top 5 NS domains, meanwhile, increased by 18.8% from 1.2+ billion in Q1 to 1.5+ billion in Q2 2026.

The growing concentration around a limited set of MX and NS providers also highlights important dependencies with regard to email and DNS infrastructure.

TLD Topnotchers for the Confirmed Malicious Domains

Finally, we discovered that the total number of confirmed malicious domains sporting the top 5 TLDs dropped by 2.3% from 2.08+ million in Q1 to 2.03+ million in Q2 2026.

Global Domain Activity Report: Q2 2026 provides high-level insights into the domain registrations and DNS activity worldwide. It hopes to shed light on domain and DNS record preferences and usage patterns that can help inform business and cybersecurity decisions.

Don’t hesitate to download the full report or contact us for more information about accessing domain, DNS, and cyber threat intelligence for your organization.