Anycast DNS-Root Sovereignty

A resilience review asks whether a country could still resolve domain names if its transit to the rest of the world went away. The workflow's default input is BR, and Brazil comes back graded LOW — the calmest verdict this workflow issues.

Do I sign that LOW off, and what would tell me I am wrong?

The grade is two counts: root letters present in-country, and distinct BGP origin ASNs hosting them. The first is recorded on every instance. The second is recorded on four of Brazil's sixty-four.

• Whether any of these instances answers a query. The node carries hasIpv4 and hasIpv6 — 64 of 64 true for v4, 58 of 64 for v6 — but no address and no hostname: d.identifiers is empty and d.name is an opaque token (Vp1H7K on Brazil's C-root node). Reachability is not in this graph.
• Anything that needs a traversal. DNS_ROOT_INSTANCE holds zero edges in either direction, re-measured 2026-08-09 by expanding an anchored node both ways, as Graph entities records. Every step is a property read on one node, so the physical, BGP and GeoIP layers this workflow names are columns on the instance rather than joins to the ASN, city or facility that would carry them.
• When any of this was last true. All 1,534 root instances in the graph share a single lastVerifiedAt value. It stamps the load, not the instance.
• What Global and Local commit an operator to. The graph records the label. The announcement policy behind it is not established here.

Brazil returns 64 in-country instances spanning 10 of the 13 root letters — A, B and G are absent — split 33 Global to 31 Local. The grade step returns LOW, with the words Diverse in-country root presence across multiple root letters and hosting ASNs.

The second half of that sentence is the part to check. Four distinct bgpOriginAsn values appear on Brazil's instances, and four is what carries the grade past its single-operator branch. Those four values sit on four nodes. The other 60 carry none, and label-wide only 172 of 1,534 instances carry one. The diversity finding was computed from 4 of the country's 64 instances, and Falsify it is where that ratio changes the answer.

Absence still arrives as a row. KP returns a populated overview reading 0 instances, 0 letters and CRITICAL; the per-instance step for the same country returns 0 rows at HTTP 200. Zero rows is never a verdict — the aggregate is the row that says zero, and the empty set is the detail step agreeing with it.

The grade counts AS numbers. Ask who the numbers belong to.

Brazil's four are AS396658, AS396659, AS396722 and AS396723. Matched against the ASN label by name, all four return autNumAsName VERISIGN-AS and orgName VeriSign Global Registry Services. Distinct operators: one. All four instances are J roots, which Verisign runs.

So the branch reading "not concentrated in a single hosting ASN" passed on four AS numbers belonging to one company. Had the grade counted operators, Brazil would have taken the concentration branch and the verdict would change. That join sits outside the workflow, and it has to: bgpOriginAsn is an integer property, not an edge, so nothing in the run can reach the organization that owns it.

Count operators instead of AS numbers. Collect the country's distinct bgpOriginAsn values, match ASN nodes by that name, count distinct orgName. Brazil returns 1. Any country returning more than 1 has the diversity the grade claims, and the objection is local to Brazil rather than structural.

Then test whether the letter breadth is real or an artefact of two heavily replicated letters. It is not an artefact: F alone holds 31 of Brazil's 64 instances (4 Global, 27 Local) and L holds 16, so two letters carry 47 of 64 — yet exclude both and the country still returns 8 letters across 17 instances. That is a point for the LOW, and it is why the grade is narrow rather than wrong.

The thin edge is the singletons. C, D, H and M hold exactly one in-country instance each, so four of the ten letters behind the grade rest on a single node whose reachability this graph does not record.

Brazil's LOW is earned on root-letter breadth and unearned on operator diversity. Report it as a letter-diversity result and say the hosting-ASN half did not run: 60 of 64 instances have no operator recorded, and the four that do are one operator wearing four AS numbers.

The geographic spread is real but softer than it counts. Brazil's instances carry 36 distinct town strings, and town is unnormalised: Sao Paulo and São Paulo, Ponta Grossa and Ponta Grossa, PR are separate rows. Thirty-six is an upper bound on the number of cities, not the number.

Three findings would overturn this, and each is a query:

• a country whose recorded bgpOriginAsn values resolve to more than one orgName, which makes the concentration branch a working test that Brazil merely fails;
• bgpOriginAsn populated on more of Brazil's 64 by a later load, which would confirm the single-operator read or break it;
• evidence that the 60 unrecorded instances are independently operated, which the coverage note on Infrastructure and supply chain says this plane cannot supply today.

A grade nobody can attack is a grade nobody has checked.