CIPHERCUE
Anthropic's domain verification token is in the public DNS of 3,037 of the 110,962 European domains we queried. OpenAI's is in 1,652. Among them: Spain's data protection authority, which publishes tokens for Anthropic, OpenAI and Mistral; the Banca d'Italia, which publishes Anthropic's and OpenAI's; and France's state digital health agency, which publishes only Anthropic's.
Anthropic's count is higher in each of the eight European countries with more than 1,000 domains in our dataset, by 1.84 to 1 overall. Anyone can check a domain with dig +short TXT.
Both providers use public DNS TXT records to verify domain ownership for organisational identity features, including single sign-on: the provider issues a value and an administrator publishes it at the root of the domain. A published token shows that someone started that process. It does not show that verification finished, that staff use the product, or that any data went to the provider.
The regulators
We checked the primary domains of 34 data protection authorities: every national authority in the EU and EEA, plus the UK, Switzerland, the European Data Protection Supervisor and the European Data Protection Board. One has an Anthropic or OpenAI token. It is Spain's Agencia Española de Protección de Datos (AEPD), and it has both, plus Mistral's. CNIL, the ICO, Ireland's DPC, Germany's BfDI and the other 29 have none of the three.
Central banks show the same pattern on a smaller scale. Of the ECB, the Bundesbank, the Banque de France, the Banco de España, De Nederlandsche Bank and the Banca d'Italia, only the Banca d'Italia publishes either token.
The Agence du Numérique en Santé is the French state agency that publishes the certification framework every host of French health data must meet; its 2024 revision added data sovereignty requirements for hosts and their subcontractors. Its own domain has an Anthropic token and no OpenAI or Mistral record. So does governo.it, the website of the Italian Presidency of the Council of Ministers.
$ dig +short TXT aepd.es
"anthropic-domain-verification-7zdfb7=YFfkYZrB..."
"openai-domain-verification=dv-CwvbooJ5..."
"mistral-domain-verification=ecdb6a97..."
$ dig +short TXT bancaditalia.it
"anthropic-domain-verification-z9958r=Y24kTYrg..."
"openai-domain-verification=dv-VNI0yqJL..."
$ dig +short TXT esante.gouv.fr
"anthropic-domain-verification-59br1c=7Lc4avzQ..."(Token values shortened.) DNS cannot say why the AEPD published tokens for three AI providers when the other 33 authorities published none, or what any of these bodies uses Claude for. A pilot, a procurement evaluation and a production rollout all start with the same TXT record.
It does reveal which providers an administrator has initiated domain verification with, and for Anthropic that has a residency dimension. Anthropic's data residency documentation, which covers its API and Anthropic-managed cloud offerings rather than the claude.ai apps, lists two inference settings: global, under which inference "may run in any available geography", and us. Storage at rest is us only. Through Amazon Bedrock or Google-managed Claude, the region is set by the cloud endpoint instead. A token does not reveal which of these routes an organisation uses.
Comparing Anthropic and OpenAI tokens
The two flows are close enough to count side by side. Both put a TXT record at the domain root, both are set up from an admin console (Claude's Team and Enterprise owners or Console admins; OpenAI's identity console, which covers ChatGPT workspaces and API organisations), and both let only one organisation verify a domain.
Three differences affect the counts. Anthropic issues a new token every time a domain is re-added, and the old one stays in DNS unless someone deletes it: 62 European domains carry two or more Anthropic tokens. OpenAI's setup expires after seven days if it is not completed, which also leaves the record behind. And OpenAI says a verified domain can also back a GPT builder profile for a website, so some OpenAI tokens may come from that workflow rather than from identity setup. Neither company documents every situation in which it asks for verification, so part of the gap may come from onboarding flows rather than customers. The ratio counts published records. It is not market share.
Microsoft Copilot and Google Gemini run inside an existing Microsoft 365 or Google Workspace tenant, so they never appear as a separate record.
By country
| Country | Domains answered | Anthropic | OpenAI | Ratio |
|---|---|---|---|---|
| France | 11,056 | 413 (3.7%) | 162 (1.5%) | 2.55 |
| Spain | 6,333 | 225 (3.6%) | 151 (2.4%) | 1.49 |
| Ireland | 1,664 | 55 (3.3%) | 29 (1.7%) | 1.90 |
| Germany | 29,126 | 877 (3.0%) | 493 (1.7%) | 1.78 |
| United Kingdom | 26,213 | 662 (2.5%) | 303 (1.2%) | 2.18 |
| Netherlands | 13,696 | 310 (2.3%) | 202 (1.5%) | 1.53 |
| Italy | 10,212 | 211 (2.1%) | 156 (1.5%) | 1.35 |
| Poland | 11,755 | 204 (1.7%) | 124 (1.1%) | 1.65 |
| 23 other European countries | 907 | 80 (8.8%) | 32 (3.5%) | 2.50 |
| Europe | 110,962 | 3,037 (2.7%) | 1,652 (1.5%) | 1.84 |
France leads on both the rate and the gap. The 907 domains from the smaller countries are mostly large companies, so their 8.8% is not a national rate. Subsidiaries count once per domain (Allianz has nine Anthropic-verified domains), but collapsing domains that share a name leaves 2,928 Anthropic names against 1,604 OpenAI ones, a ratio of 1.83.
UK academia: 44 of 433 domains
The highest rate in the data is on .ac.uk. Of the 433 academic domains in our dataset that answered, 44 (10.2%) publish an Anthropic token and 15 an OpenAI one. That is nearly four times the European rate. They include LSE, Edinburgh, Bristol, Bath, York, Nottingham and Queen Mary, and also sector bodies and research institutes that use the suffix: Jisc, Universities UK, the QAA, the Francis Crick Institute, the Wellcome Sanger Institute and UK Biobank. Other UK public-sector suffixes are far lower: 10 of 582 .gov.uk domains and 1 of 168 .nhs.uk domains.
Other vendors' tokens on the same domains
Anthropic is one entry in a longer list. On the same European domains, 22.9% publish a Microsoft 365 token, 9.3% a Meta one, 7.6% Apple's, 4.3% Atlassian's and 1.3% DocuSign's. Anthropic, at 2.7%, sits between Atlassian and DocuSign. 2,088 of the domains carry ten or more verification strings.
There are reasons for these records to stay. Mistral's documentation warns that removing its record can break SSO and other enterprise access for the domain, OpenAI says a completed verification does not expire, and Anthropic's re-add behaviour leaves old tokens behind. A domain's TXT records can become a public list of the vendors its administrators have started verification with, whether or not those relationships are still active. That is useful for reconnaissance: a phishing email that names a vendor the target has actually configured is more convincing than one that guesses.
Some of the history is noise. Five Irish media sites (Evoke, Extra.ie, Everymum, Business Plus and Rollercoaster) publish the string anthropic-domain-verification=true. Anthropic's flow never issues that value; we excluded them from every count above.
Method note
Population: every domain in CipherCue's dataset on 3 November 2026, deduplicated by apex domain and excluding entities that have opted out of observation, 130,636 domains in total. Country is the country recorded for each entity in our data. Europe means the EU 27 plus the UK, Norway, Switzerland, Iceland and Liechtenstein.
Query: one TXT lookup on the apex of each domain using Node.js dns.promises.resolveTxt, spread across the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9 at about 50 queries a second, between 00:06 and 00:50 UTC. 126,050 domains answered, with records or an empty answer. 4,586 did not (3,142 NXDOMAIN, 1,187 timeouts, 224 SERVFAIL, 33 invalid names) and are excluded from every denominator. Answers from recursive resolvers can be cached for up to the record's TTL, so a record added or removed shortly before the sweep may be missed or still counted. We did not record TTLs.
Matching: a domain has an Anthropic token if any TXT string begins with anthropic-domain-verification- (the documented format, with its random suffix) and an OpenAI token if any begins with openai-domain-verification=. Seven European domains publish strings that start anthropic-domain-verification= instead, five of them with the value true; they do not match the documented format and are excluded. Other vendors' tokens are matched on their published prefixes (MS=ms, atlassian-domain-verification=, apple-domain-verification=, facebook-domain-verification=, docusign=). Mistral documents two formats, a root record and a mistral-verify= record at _mistral-verification.<domain>. The sweep queried only the root, so this article makes no population-level claim about Mistral; the Mistral entries for named institutions reflect manual checks of both formats.
Institutional checks: the 34 data protection authority domains, six central bank domains and the named institutions were queried by hand with dig on 3 November 2026, independently of the dataset. German state-level data protection authorities were not included. Domain-suffix figures (.ac.uk, .gov.uk, .nhs.uk) cover only domains in our dataset, not every domain under those suffixes.
Limits
CipherCue's dataset is not a random sample. It leans towards organisations with a visible web and email presence, its country mix reflects how the dataset was built, and the smaller countries are represented mainly by large companies. Shares describe this dataset, not the European economy. A published token does not establish a completed verification, an active account, usage, or data transfer, and the counts are neither a floor nor a ceiling for adoption.
Sources
CipherCue DNS TXT lookups, 3 November 2026. Anthropic, Setting up single sign-on for Claude and Claude Console. Anthropic, Data residency. OpenAI, Verifying your domain for OpenAI Identity and Login and authentication FAQ and domain verification. Mistral AI, Verify your domain and Configure SSO and domain verification. Agence du Numérique en Santé, HDS certification framework press release. All accessed 3 November 2026.