Cisco Umbrella

Websitehttps://umbrella.cisco.com/blog/cisco-umbrella-1-million
CategoryDomain Rankings

The Cisco Umbrella Popularity List ranks the top one million domains by the volume of DNS queries observed across Cisco's global network of DNS resolvers. Formerly known as the OpenDNS Popularity List, it measures which domains real users and systems are actually looking up in DNS, providing a direct signal of active internet usage. We use Cisco Umbrella data as one of several domain popularity signals on domain and DNS lookup pages across robtex.com and dns.ninja.

Source:Cisco Umbrella

What is Cisco Umbrella?

Cisco Umbrella (originally OpenDNS, acquired by Cisco in 2015) operates one of the largest recursive DNS resolver networks in the world. Millions of users, enterprises, and devices route their DNS queries through Umbrella's resolvers, either directly or through Cisco's enterprise security products.

The Umbrella Popularity List is derived from this massive stream of DNS query data. It ranks domains by the number of unique client IPs that query each domain over a rolling 24-hour period. This methodology means the list reflects actual demand -- every entry represents a domain that real clients on the internet are actively trying to reach.

Key characteristics of the Umbrella list:

  • Query-based, not crawl-based - Measures what users and systems are requesting, not what a web crawler finds
  • Includes non-web domains - Captures DNS queries for email servers, API endpoints, IoT device backends, software update servers, and other non-browser services that never appear in web-focused rankings
  • Enterprise-weighted - Cisco's resolver network is heavily used by enterprise customers, so the list tends to reflect business and infrastructure usage patterns alongside consumer browsing
  • Unique client counting - Ranking is based on unique requesting IPs, not raw query volume, which prevents a single misconfigured server from inflating a domain's rank

This makes Umbrella particularly valuable for understanding the operational internet -- not just which websites people visit, but which domains the infrastructure of the internet depends on.

How We Use This Data

On robtex.com and dns.ninja, we display the Cisco Umbrella rank as one of five domain popularity signals on domain and DNS lookup pages. When you look up a domain, you can see its Umbrella rank alongside its position in Majestic Million, Tranco, Chrome UX Report, and Cloudflare Radar.

The DNS-query perspective from Umbrella captures a dimension of domain importance that link-based or browser-based rankings miss. Domains likepool.ntp.org,ocsp.digicert.com, orapi.github.comhandle enormous volumes of automated queries but would not appear in a ranking based on human browsing activity. Umbrella surfaces these operationally critical domains.

A domain ranking highly in Umbrella but not in browser-based lists likely serves infrastructure or API functions. Conversely, a domain ranking highly in browser lists but not in Umbrella may primarily be accessed through apps or platforms that use their own DNS resolution rather than Cisco's resolvers.

FAQ

Why does Umbrella sometimes rank infrastructure domains higher than popular websites?
Umbrella measures DNS queries, not page views. Domains like certificate authorities (OCSP responders), CDN endpoints, analytics services, and software update servers receive DNS queries from virtually every device on the internet, often multiple times per day. A domain likeocsp.pki.googmay outrank well-known websites simply because it handles certificate validation for billions of HTTPS connections.
How does the Cisco Umbrella list differ from the Cloudflare Radar domain ranking?
Both are DNS-based, but they observe different populations. Umbrella's resolvers are heavily used by enterprises through Cisco's security products, while Cloudflare's 1.1.1.1 resolver skews toward privacy-conscious individual users. The overlap is substantial for major domains, but the rankings diverge for niche enterprise services (higher in Umbrella) versus consumer-oriented sites (potentially higher in Cloudflare).
Does a domain's absence from the Umbrella list mean it has no traffic?
No. The list only captures the top one million domains out of hundreds of millions on the internet. A domain might have significant traffic but still fall outside the top million. Additionally, Umbrella only sees queries routed through its own resolver network. Domains primarily accessed by users on other DNS resolvers (Google Public DNS, ISP resolvers, local resolvers) may be underrepresented.