It’s not going to surprise anyone that the UK’s 382 councils are heavily dependent on US-based hyperscalers. In this article, we map the exact dependence via the digital perimeter those councils expose – the mail servers, web front ends and cloud endpoints that appear in a public domain name system (DNS) – and find that more than half their routable infrastructure points to Microsoft, Amazon Web Services (AWS) and Google, with Microsoft the dominant player.
The scan covers 382 local authorities across all four nations: 317 in England, 32 in Scotland, 22 in Wales and 11 in Northern Ireland. We resolved 46,822 DNS records across their 394 principal domains and, for each address, identified the network owner through public registration data. Each record is a signal that points to where a council’s services actually live.
The picture is near-universal dependence. Of the domains studied, 390 of 394 (99%) route at least one record to Microsoft, AWS or Google. Of the records that route to a real destination, 51% sit on one of those three providers. Microsoft alone accounts for 13,473 of the 19,407 records that reach a hyperscaler – roughly seven in 10.
The finding continues a pattern Computer Weekly has mapped across the public sector. Earlier data dives found the same gravitational pull at the NHS, in police forces and across central government. What changes at council level is the reach. Authorities that run everything from council tax portals to children’s services have moved the public face of those services onto the same handful of providers.
How we mapped it
Every council publishes, in its DNS, where its mail goes and which cloud services host its websites. We read only that public record – no internal systems, no authentication.
For each council, we gathered records through encrypted DNS lookups, certificate-transparency logs and a dictionary of common public service subdomains. We then resolved every address to its registered owner using the iptoasn bulk IP-to-ASN database, which maps network ranges to the organisations that hold them. Where an owner is Microsoft, Amazon or Google, the record counts as hyperscaler; Cloudflare and Akamai are treated as content delivery networks, not hyperscalers. Records that resolve to no address are excluded and, because they can only add to the totals, the hyperscaler share is a lower bound.
The Microsoft pull
Microsoft is the centre of gravity. Of the records that touch a hyperscaler, 13,473 are Microsoft, 5,438 Amazon and 496 Google – a ratio of roughly 2.5:1 against AWS and 27:1 against Google. The pull is starkest when councils are ordered by their primary provider. Of 390 councils with a hyperscaler link, 338 lean primarily on Microsoft, 47 on AWS and just five on Google.
The same concentration shows at the sharp end. The London Borough of Hackney reaches 222 distinct hyperscaler addresses across its public estate; Leeds 126, Merton 87, Southwark 84, and Kensington and Chelsea 73.
The range of entanglement is wide. Plymouth City Council’s public DNS fans out across Microsoft, AWS, Google, Capita, Cloudflare and Apple, alongside infrastructure it still runs itself. Maidstone Borough Council, by contrast, routes a clean set of a few subdomains to Microsoft and little else – a reminder that “on the cloud” can mean many things.
Some councils keep a measure of control. Birmingham, Coventry, Warwickshire, Bristol and Plymouth all still hold visible chunks of on-premise infrastructure, even though the bulk of their footprint sits with hyperscalers.
The security twist
The same councils that have concentrated infrastructure on US providers have adopted email anti-spoofing at a rate that puts much of Europe to shame. Our independent check of the councils’ DMARC records found 99.7% publish a policy, with 60% set to reject failing mail outright and a further 36% quarantining it. That is near-total adoption of the control that stops criminals from forging a council’s domain.
Set that against the continent, and the contrast sharpens. In the most recent published measurement of German, Austrian and Swiss municipalities – a peer-reviewed study covering more than 15,000 domains – only 50.7% of German councils published a DMARC record, with the equivalent figure being 37.4% in Austria and 55.5% in Switzerland. Strict enforcement is rare in all three, from 3% to 17%. Having said that, Germany, unlike the UK, keeps its email largely at home. Some 87% of its municipalities use domestic providers, whereas 67% in Austria and 52% in Switzerland run on Microsoft.
Britain, in other words, has strong security but deep dependence. Germany has greater sovereignty but left the controls half-built. Austria and Switzerland have managed the worst of both – concentrated on US cloud and stayed weak on enforcement.
Dependence this deep on a single provider is a resilience question as much as a security one. Strong controls protect mail, but they do not answer what happens to a council’s services if its one supplier stumbles, raises prices or is drawn into a geopolitical dispute.
