vLockinVendor Lockin

Are we FREE yet?

Europe's digital dependence · read from public DNS and homepages · 2026-09-27

99.6% of the 1,343 European institutions, banks and listed companies we checked hand at least one core service to an American company.

Email, office software, device management, video calls, mail marketing, web analytics, cloud, DDoS protection and DNS. For each organisation we asked the public DNS who answers — the same question every mail server on the internet asks it — read its homepage once, and followed every answer to the company that owns the machine. American companies answer to the CLOUD Act, wherever their data centre stands.

Email71%receive their mail through an American company
Office suite95%have a Microsoft 365 or Google Workspace tenant
Device management55%enrol or register their laptops and phones with an American company
Video calls68%use Teams, Webex, Zoom or another American meeting service
Mail marketing56%send newsletters or bulk mail through an American platform
Web analytics42%let an American company count their homepage's visitors
Cloud45%run at least one public server on an American cloud
DDoS protection50%sit behind an American CDN or DDoS shield
DNS40%have their domain's name servers at an American company

1,343 organisations · scan 15 in all: 53,870 DNS questions · 1,189 homepages read · 842 networks

5 of 9layers the median organisation rents from American companies; 1,062 of 1,343 rent 4 or more
1,270 / 1,343organisations rent at least one layer from Microsoft
500 / 522Dutch ministries, agencies, provinces, water boards and municipalities have a Microsoft 365 tenant

01 · Layers

Nine layers, and who owns each

Every organisation counts once per layer, coloured by where the company that runs it answers to. Where a layer often runs on several platforms at once — device management, video, marketing, analytics, cloud, DDoS protection — it takes the colour of the one furthest from EU law: an organisation that sends through Mailchimp depends on it, whatever else it uses. Hover a band for the numbers; switch the group above.

Email71% US
Office suite95% US
Device management55% US
Video calls68% US
Mail marketing56% US
Web analytics42% US
Cloud45% US
DDoS protection50% US
DNS40% US

02 · Depth

How deep the dependence goes

Every organisation, once, by how many of the nine layers it rents from an American company. Hover a column for who is in it.

layers at American companies, of 9 · median 5

7 of 9median, Listed companies
5 of 9median, European banks
4 of 9median, European Union
4 of 9median, Dutch government
6 of 9median, Dutch banks

03 · Top tens

The freest, and the most locked in

The ten organisations that rent the fewest layers from American companies, and the ten that rent the most — then the fewest or the most from Big Tech, then the fewest or the most American platforms found in all. Pick a layer to rank on that one: the best run it on a European company, the worst on an American one, Big Tech first. Ties share a rank. Click a name for the evidence.

Group
Ranked on

Everything · 1,343 organisations

Best ten

1,053 ranked

Fewest layers at American companies

and 1 more share rank 8

Worst ten

1,338 ranked

Most layers at American companies

and 1 more share rank 9

Each strip is one organisation's nine layers, left to right: Email, Office suite, Device management, Video calls, Mail marketing, Web analytics, Cloud, DDoS protection, DNS.

04 · Everyone

Every organisation, one square

Each square is an organisation, sorted by who runs the layer you pick. Hover for the evidence, click to open it.

The chart needs JavaScript; the table below has the same numbers.

05 · Providers

The landlords

The companies the most organisations rent a layer from. On device management, video, marketing, analytics, cloud and DDoS protection every platform found counts, so the shares can add up to more than all. A network nobody has named yet is listed as its registration says.

06 · The stack

Who holds which layer

The companies that hold at least one layer for the most organisations, and the share of organisations each holds every layer for. Read across a row for a company's reach, down a column for a layer's landlords.

CompanyEmailSuiteDevicesVideoMarketingAnalyticsCloudDDoSDNSAny layer
Microsoft55%92%48%54%7%6%15%5%6%95%
Amazon0.2%0.1%0.1%13%0.3%24%8%3%37%
Google2%3%0.1%32%4%1%36%
Intuit (Mailchimp)31%31%
Twilio (SendGrid)30%30%
Cisco3%25%27%
Cloudflare0.2%2%21%9%24%
Akamai2%16%9%20%
Mailjet18%18%
Brevo11%11%
TransIP0.1%1%9%10%
Siteimprove10%10%
0%100% · share of the organisations whose layer the company holds

07 · Countries

Country by country

The share of each country's organisations that rent the layer you pick from an American company. Listed companies count where they are headquartered, banks where they hold their licence; each government and central bank counts for its own country. Click a country for its list.

08 · Cohorts

Index by index, tier by tier

Share of each group with an American company in each layer (the office suite: Microsoft 365 or Google Workspace), and how many layers the median member rents from one. Click a column to sort, a row to see the group.

GroupOrgsAny USEmailSuiteDevicesVideoMarketingAnalyticsCloudDDoSDNSMedian
Euronext Amsterdam — AEX25100%92%92%56%76%84%60%72%84%76%7/9
Euronext Brussels — BEL 2021100%71%100%62%71%90%71%33%62%52%6/9
Euronext Paris — CAC 4041100%71%100%54%93%76%59%54%85%59%7/9
Euronext Lisbon — PSI15100%80%93%53%80%33%80%53%33%33%6/9
Euronext Dublin — ISEQ 2020100%65%100%75%80%85%55%65%75%75%7/9
Deutsche Börse — DAX42100%74%95%48%88%76%45%71%83%69%7/9
Wiener Börse — ATX22100%77%100%55%77%64%50%68%45%27%5/9
Borsa Italiana — FTSE MIB41100%88%100%34%95%66%61%51%61%44%6/9
BME — IBEX 3535100%91%100%34%77%66%74%34%71%51%6/9
Nasdaq Stockholm — OMXS3032100%84%97%66%91%91%66%72%78%59%7/9
Nasdaq Copenhagen — OMXC2525100%96%96%84%80%76%68%56%72%68%7/9
Nasdaq Helsinki — OMXH2525100%96%100%60%84%92%64%80%80%56%7/9
Warsaw Stock Exchange — WIG2020100%40%95%30%50%15%70%25%45%40%3/9
Athens Exchange — Large Cap20100%75%90%55%65%60%45%15%95%85%6/9
Central and Eastern Europe — lead indices37100%57%100%62%78%41%49%27%41%46%5/9
SIX Swiss Exchange — SMI22100%77%100%55%86%91%59%50%91%77%7/9
Oslo Børs — OBX25100%96%100%64%84%88%64%64%72%48%7/9
London Stock Exchange — FTSE 100100100%73%95%65%88%80%61%57%93%82%7/9
Europe's systemically important banks17499%51%91%40%63%39%52%30%65%57%5/9
EU institutions and bodies17100%59%88%18%76%35%0%53%65%12%4/9
EU agencies and joint undertakings51100%82%96%65%75%51%22%63%57%57%6/9
Governments of the member states2789%22%70%22%15%15%22%19%37%26%3/9
National central banks2796%30%93%33%85%22%56%22%67%37%4/9
Ministries12100%0%83%0%92%33%0%8%92%8%3/9
Agencies and independent bodies137100%50%87%52%71%47%29%30%51%26%4/9
Provinces12100%83%100%83%83%67%33%58%42%25%5/9
Water boards21100%90%100%67%48%43%19%43%33%10%4/9
Municipalities342100%82%100%63%47%48%20%44%6%7%4/9
Banks licensed in the Netherlands34100%88%100%62%76%62%44%41%74%59%6/9

09 · Look up

Look up an organisation

Type a name or a domain. You get what DNS said, and what we concluded from it.

Try

10 · The long tail

What else the records give away

Services ask their customers to prove a domain by publishing a record in it, and the records stay. These are the ones seen most beyond the nine layers, from e-signatures to certificates and design tools.

11 · Method

How this was measured

What we ask

For each organisation's mail domain: MX, NS (walking up to the zone that has them), TXT and SPF with its includes, _dmarc, the names Microsoft and Google tenants publish — autodiscover, selector1._domainkey, lyncdiscover, _sipfederationtls._tcp — the names Windows and phones look up to enrol with device management and register with a directory, enterpriseenrollment and enterpriseregistration, beside a name nobody uses that gives a wildcard away, and the DKIM selectors bulk-mail platforms sign with: Mailchimp's, SendGrid's, Brevo's, Mailjet's, Mandrill's, Salesforce Marketing Cloud's. For the website: A and AAAA and the CNAME chain behind them.

Every address met is looked up in Team Cymru's IP-to-ASN service, over DNS too. All 53,870 questions went to public resolvers run in Europe: DNS4EU, the EU's own, and Quad9, a Swiss non-profit.

What we read

Analytics live in a page, not in DNS, so each homepage was fetched once, as a browser's first visit without running its scripts: 1,189 of 1,336 answered with a page. We keep what it refers to — the scripts, frames, images and forms it loads, the addresses in its inline code, the hosts it links to — and look up the organisation's own hostnames it names, up to twelve, so the cloud layer sees more than the website.

How we decide

Email is whoever the lowest-preference MX host belongs to, a filtering gateway included: it reads every message first. Office suite is a Microsoft 365, Google Workspace or other tenant proven by at least one of its records. Device management is where the laptops and phones enrol and register — Intune and Entra ID, Workspace ONE, MobileIron, Citrix — and the device-management services the domain has proved itself to, such as Jamf; an enrolment server the organisation runs itself counts where it runs. Video calls are Teams' discovery and federation records and the meeting services' domain proofs. Mail marketing is a newsletter or bulk-mail platform the domain lets send in its name — SPF, DKIM or a domain proof — or a sign-up form on the homepage. Web analytics is the analytics and tracking the homepage loads. Cloud is where the organisation's public hostnames run, the website's, the bare domain's and the ones its homepage names. DDoS protection is the CDN, DDoS shield or web firewall in front of them. DNS is the company most of the zone's name servers belong to.

Device management, video, marketing, analytics, cloud and DDoS protection often run on several platforms at once. Each is kept, and the layer counts as American when any of them is. 766 rules name the companies; anything unnamed falls back to the network's own registration, so every answer has an owner and a country.

Why the owner, not the data centre

The US CLOUD Act (2018) lets American authorities compel a US provider to hand over data in its possession, custody or control — including data stored in Frankfurt or Amsterdam, and including its foreign subsidiaries. So a provider counts as American if it is headquartered in the US or owned from there, and Big Tech means Microsoft, Alphabet, Amazon, Apple and Meta.

What DNS and a homepage cannot see

DNS shows the front door. A mail gateway can sit in front of mailboxes elsewhere; a CDN hides the servers behind it; a tenant can exist and hold little; Teams leaves a record only when discovery or federation is set up; devices enrolled by invitation, or through Apple's and Google's own programmes, leave none. A homepage can refuse a visitor it takes for a robot (we count those pages as unread, not as clean), load its trackers only after consent through code we do not run, or say nothing about the rest of the site. We report what the records prove and name the record, per organisation, under Look up. Absence of a record is not proof of absence of a service.

Who is included

The constituents of eighteen European stock indices; the banks the supervisors of the EU and EEA, the UK and Switzerland designate as systemically important (O-SIIs), less the European arms of American banks, and every bank licensed in the Netherlands in DNB's register; the EU's institutions and agencies and the heads of government and central banks of its 27 members; and every Dutch ministry, agency, province, water board and municipality in organisaties.overheid.nl. An organisation in two groups counts once.

How the top tens rank

On every layer: first the number of layers at American companies, then how many of them at Big Tech, then how many American platforms were found in all; the best need at least one layer at a European company, the worst at least one at an American one. On one layer: the best run it on a European company (the EU first), the worst on an American one (Big Tech first, then the most American platforms on that layer), and each then ranks as on every layer. Organisations still tied share a rank.

Corrections

If a verdict is wrong, the record that caused it is on the organisation's card. Tell us at hello@dopecode.com and it will be fixed in the rules, not by hand.