Are we FREE yet?
Europe's digital dependence · read from public DNS and homepages · 2026-09-27
99.6% of the 1,343 European institutions, banks and listed companies we checked hand at least one core service to an American company.
Email, office software, device management, video calls, mail marketing, web analytics, cloud, DDoS protection and DNS. For each organisation we asked the public DNS who answers — the same question every mail server on the internet asks it — read its homepage once, and followed every answer to the company that owns the machine. American companies answer to the CLOUD Act, wherever their data centre stands.
1,343 organisations · scan 15 in all: 53,870 DNS questions · 1,189 homepages read · 842 networks
01 · Layers
Nine layers, and who owns each
Every organisation counts once per layer, coloured by where the company that runs it answers to. Where a layer often runs on several platforms at once — device management, video, marketing, analytics, cloud, DDoS protection — it takes the colour of the one furthest from EU law: an organisation that sends through Mailchimp depends on it, whatever else it uses. Hover a band for the numbers; switch the group above.
02 · Depth
How deep the dependence goes
Every organisation, once, by how many of the nine layers it rents from an American company. Hover a column for who is in it.
layers at American companies, of 9 · median 5
03 · Top tens
The freest, and the most locked in
The ten organisations that rent the fewest layers from American companies, and the ten that rent the most — then the fewest or the most from Big Tech, then the fewest or the most American platforms found in all. Pick a layer to rank on that one: the best run it on a European company, the worst on an American one, Big Tech first. Ties share a rank. Click a name for the evidence.
Everything · 1,343 organisations
Best ten
1,053 rankedFewest layers at American companies
and 1 more share rank 8
Worst ten
1,338 rankedMost layers at American companies
and 1 more share rank 9
04 · Everyone
Every organisation, one square
Each square is an organisation, sorted by who runs the layer you pick. Hover for the evidence, click to open it.
The chart needs JavaScript; the table below has the same numbers.
05 · Providers
The landlords
The companies the most organisations rent a layer from. On device management, video, marketing, analytics, cloud and DDoS protection every platform found counts, so the shares can add up to more than all. A network nobody has named yet is listed as its registration says.
06 · The stack
Who holds which layer
The companies that hold at least one layer for the most organisations, and the share of organisations each holds every layer for. Read across a row for a company's reach, down a column for a layer's landlords.
| Company | Suite | Devices | Video | Marketing | Analytics | Cloud | DDoS | DNS | Any layer | |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft | 55% | 92% | 48% | 54% | 7% | 6% | 15% | 5% | 6% | 95% |
| Amazon | 0.2% | 0.1% | 0.1% | 13% | 0.3% | 24% | 8% | 3% | 37% | |
| 2% | 3% | 0.1% | 32% | 4% | 1% | 36% | ||||
| Intuit (Mailchimp) | 31% | 31% | ||||||||
| Twilio (SendGrid) | 30% | 30% | ||||||||
| Cisco | 3% | 25% | 27% | |||||||
| Cloudflare | 0.2% | 2% | 21% | 9% | 24% | |||||
| Akamai | 2% | 16% | 9% | 20% | ||||||
| Mailjet | 18% | 18% | ||||||||
| Brevo | 11% | 11% | ||||||||
| TransIP | 0.1% | 1% | 9% | 10% | ||||||
| Siteimprove | 10% | 10% |
07 · Countries
Country by country
The share of each country's organisations that rent the layer you pick from an American company. Listed companies count where they are headquartered, banks where they hold their licence; each government and central bank counts for its own country. Click a country for its list.
08 · Cohorts
Index by index, tier by tier
Share of each group with an American company in each layer (the office suite: Microsoft 365 or Google Workspace), and how many layers the median member rents from one. Click a column to sort, a row to see the group.
| Group | Orgs | Any US | Suite | Devices | Video | Marketing | Analytics | Cloud | DDoS | DNS | Median | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Euronext Amsterdam — AEX | 25 | 100% | 92% | 92% | 56% | 76% | 84% | 60% | 72% | 84% | 76% | 7/9 |
| Euronext Brussels — BEL 20 | 21 | 100% | 71% | 100% | 62% | 71% | 90% | 71% | 33% | 62% | 52% | 6/9 |
| Euronext Paris — CAC 40 | 41 | 100% | 71% | 100% | 54% | 93% | 76% | 59% | 54% | 85% | 59% | 7/9 |
| Euronext Lisbon — PSI | 15 | 100% | 80% | 93% | 53% | 80% | 33% | 80% | 53% | 33% | 33% | 6/9 |
| Euronext Dublin — ISEQ 20 | 20 | 100% | 65% | 100% | 75% | 80% | 85% | 55% | 65% | 75% | 75% | 7/9 |
| Deutsche Börse — DAX | 42 | 100% | 74% | 95% | 48% | 88% | 76% | 45% | 71% | 83% | 69% | 7/9 |
| Wiener Börse — ATX | 22 | 100% | 77% | 100% | 55% | 77% | 64% | 50% | 68% | 45% | 27% | 5/9 |
| Borsa Italiana — FTSE MIB | 41 | 100% | 88% | 100% | 34% | 95% | 66% | 61% | 51% | 61% | 44% | 6/9 |
| BME — IBEX 35 | 35 | 100% | 91% | 100% | 34% | 77% | 66% | 74% | 34% | 71% | 51% | 6/9 |
| Nasdaq Stockholm — OMXS30 | 32 | 100% | 84% | 97% | 66% | 91% | 91% | 66% | 72% | 78% | 59% | 7/9 |
| Nasdaq Copenhagen — OMXC25 | 25 | 100% | 96% | 96% | 84% | 80% | 76% | 68% | 56% | 72% | 68% | 7/9 |
| Nasdaq Helsinki — OMXH25 | 25 | 100% | 96% | 100% | 60% | 84% | 92% | 64% | 80% | 80% | 56% | 7/9 |
| Warsaw Stock Exchange — WIG20 | 20 | 100% | 40% | 95% | 30% | 50% | 15% | 70% | 25% | 45% | 40% | 3/9 |
| Athens Exchange — Large Cap | 20 | 100% | 75% | 90% | 55% | 65% | 60% | 45% | 15% | 95% | 85% | 6/9 |
| Central and Eastern Europe — lead indices | 37 | 100% | 57% | 100% | 62% | 78% | 41% | 49% | 27% | 41% | 46% | 5/9 |
| SIX Swiss Exchange — SMI | 22 | 100% | 77% | 100% | 55% | 86% | 91% | 59% | 50% | 91% | 77% | 7/9 |
| Oslo Børs — OBX | 25 | 100% | 96% | 100% | 64% | 84% | 88% | 64% | 64% | 72% | 48% | 7/9 |
| London Stock Exchange — FTSE 100 | 100 | 100% | 73% | 95% | 65% | 88% | 80% | 61% | 57% | 93% | 82% | 7/9 |
| Europe's systemically important banks | 174 | 99% | 51% | 91% | 40% | 63% | 39% | 52% | 30% | 65% | 57% | 5/9 |
| EU institutions and bodies | 17 | 100% | 59% | 88% | 18% | 76% | 35% | 0% | 53% | 65% | 12% | 4/9 |
| EU agencies and joint undertakings | 51 | 100% | 82% | 96% | 65% | 75% | 51% | 22% | 63% | 57% | 57% | 6/9 |
| Governments of the member states | 27 | 89% | 22% | 70% | 22% | 15% | 15% | 22% | 19% | 37% | 26% | 3/9 |
| National central banks | 27 | 96% | 30% | 93% | 33% | 85% | 22% | 56% | 22% | 67% | 37% | 4/9 |
| Ministries | 12 | 100% | 0% | 83% | 0% | 92% | 33% | 0% | 8% | 92% | 8% | 3/9 |
| Agencies and independent bodies | 137 | 100% | 50% | 87% | 52% | 71% | 47% | 29% | 30% | 51% | 26% | 4/9 |
| Provinces | 12 | 100% | 83% | 100% | 83% | 83% | 67% | 33% | 58% | 42% | 25% | 5/9 |
| Water boards | 21 | 100% | 90% | 100% | 67% | 48% | 43% | 19% | 43% | 33% | 10% | 4/9 |
| Municipalities | 342 | 100% | 82% | 100% | 63% | 47% | 48% | 20% | 44% | 6% | 7% | 4/9 |
| Banks licensed in the Netherlands | 34 | 100% | 88% | 100% | 62% | 76% | 62% | 44% | 41% | 74% | 59% | 6/9 |
09 · Look up
Look up an organisation
Type a name or a domain. You get what DNS said, and what we concluded from it.
10 · The long tail
What else the records give away
Services ask their customers to prove a domain by publishing a record in it, and the records stay. These are the ones seen most beyond the nine layers, from e-signatures to certificates and design tools.
11 · Method
How this was measured
What we ask
For each organisation's mail domain: MX, NS (walking up to the zone that has them), TXT and SPF with its includes, _dmarc, the names Microsoft and Google tenants publish — autodiscover, selector1._domainkey, lyncdiscover, _sipfederationtls._tcp — the names Windows and phones look up to enrol with device management and register with a directory, enterpriseenrollment and enterpriseregistration, beside a name nobody uses that gives a wildcard away, and the DKIM selectors bulk-mail platforms sign with: Mailchimp's, SendGrid's, Brevo's, Mailjet's, Mandrill's, Salesforce Marketing Cloud's. For the website: A and AAAA and the CNAME chain behind them.
Every address met is looked up in Team Cymru's IP-to-ASN service, over DNS too. All 53,870 questions went to public resolvers run in Europe: DNS4EU, the EU's own, and Quad9, a Swiss non-profit.
What we read
Analytics live in a page, not in DNS, so each homepage was fetched once, as a browser's first visit without running its scripts: 1,189 of 1,336 answered with a page. We keep what it refers to — the scripts, frames, images and forms it loads, the addresses in its inline code, the hosts it links to — and look up the organisation's own hostnames it names, up to twelve, so the cloud layer sees more than the website.
How we decide
Email is whoever the lowest-preference MX host belongs to, a filtering gateway included: it reads every message first. Office suite is a Microsoft 365, Google Workspace or other tenant proven by at least one of its records. Device management is where the laptops and phones enrol and register — Intune and Entra ID, Workspace ONE, MobileIron, Citrix — and the device-management services the domain has proved itself to, such as Jamf; an enrolment server the organisation runs itself counts where it runs. Video calls are Teams' discovery and federation records and the meeting services' domain proofs. Mail marketing is a newsletter or bulk-mail platform the domain lets send in its name — SPF, DKIM or a domain proof — or a sign-up form on the homepage. Web analytics is the analytics and tracking the homepage loads. Cloud is where the organisation's public hostnames run, the website's, the bare domain's and the ones its homepage names. DDoS protection is the CDN, DDoS shield or web firewall in front of them. DNS is the company most of the zone's name servers belong to.
Device management, video, marketing, analytics, cloud and DDoS protection often run on several platforms at once. Each is kept, and the layer counts as American when any of them is. 766 rules name the companies; anything unnamed falls back to the network's own registration, so every answer has an owner and a country.
Why the owner, not the data centre
The US CLOUD Act (2018) lets American authorities compel a US provider to hand over data in its possession, custody or control — including data stored in Frankfurt or Amsterdam, and including its foreign subsidiaries. So a provider counts as American if it is headquartered in the US or owned from there, and Big Tech means Microsoft, Alphabet, Amazon, Apple and Meta.
What DNS and a homepage cannot see
DNS shows the front door. A mail gateway can sit in front of mailboxes elsewhere; a CDN hides the servers behind it; a tenant can exist and hold little; Teams leaves a record only when discovery or federation is set up; devices enrolled by invitation, or through Apple's and Google's own programmes, leave none. A homepage can refuse a visitor it takes for a robot (we count those pages as unread, not as clean), load its trackers only after consent through code we do not run, or say nothing about the rest of the site. We report what the records prove and name the record, per organisation, under Look up. Absence of a record is not proof of absence of a service.
Who is included
The constituents of eighteen European stock indices; the banks the supervisors of the EU and EEA, the UK and Switzerland designate as systemically important (O-SIIs), less the European arms of American banks, and every bank licensed in the Netherlands in DNB's register; the EU's institutions and agencies and the heads of government and central banks of its 27 members; and every Dutch ministry, agency, province, water board and municipality in organisaties.overheid.nl. An organisation in two groups counts once.
How the top tens rank
On every layer: first the number of layers at American companies, then how many of them at Big Tech, then how many American platforms were found in all; the best need at least one layer at a European company, the worst at least one at an American one. On one layer: the best run it on a European company (the EU first), the worst on an American one (Big Tech first, then the most American platforms on that layer), and each then ranks as on every layer. Organisations still tied share a rank.
Corrections
If a verdict is wrong, the record that caused it is on the organisation's card. Tell us at hello@dopecode.com and it will be fixed in the rules, not by hand.