Building for the Load That Never ComesNarrow moat
VeriSign (VRSN) — moat facet
The cost structure is set by the attack that has never come, not by the queries that arrive every second.
VeriSign's infrastructure is built for a day that has not happened.
The .com and .net resolution system handles a normal load measured in the hundreds of billions of queries a day, and is provisioned for many multiples of it, because the events it must survive are not traffic — they are attacks.1 A distributed denial-of-service campaign against the .com nameservers is an attempt to take down a large fraction of global commerce at once, and defending against it means carrying capacity that is idle in every quarter where nothing happens.
This is why the cost of revenues line — about 12% of sales — does not behave like a variable cost.2 Adding a million names costs VeriSign essentially nothing. Adding a threat model costs a great deal. The economics of the business are set by the peak, not the average.
It is also why the barrier to a hypothetical replacement operator is higher than it looks. A competitor could match the software. Matching the capacity, the global anycast footprint, the attack history and the operational muscle memory is a different exercise, and one that a regulator would have to be satisfied about before it moved anything.
None of this, though, is proprietary. It is engineering plus money, and there are companies with more of both. What cannot be bought quickly is the twenty-nine-year record that proves it works.
Query volumes and attack sophistication have both risen every year of the company's life, and the system has absorbed both without an exception. Each year of that is more capability, more operational history and a higher bar for any hypothetical successor.
The .com and .net resolution system is provisioned for many multiples of its normal load, because the events it must survive are attacks rather than traffic. That is why cost of revenues — about 12% of sales — behaves nothing like a variable cost: adding a million names costs almost nothing, adding a threat model costs a great deal. Watch cost of revenues as a share of sales for any unexplained decline.
Source: VeriSign registry services ↗- ReportedVeriSign processes in excess of 600 billion DNS queries a day.Verisign — registry services. VeriSign processes in excess of 600 billion DNS queries a day across the domains it operates and has maintained 100% resolution availability for .com for more than 29 years without interruption. — 2026 · publ. 2026-01-01 · source ↗
- ReportedCost of revenues was 11.8% of revenue in 2025, against 12.3% in 2024 and 13.2% in 2023.VeriSign, Inc., Form 10-K FY2025 — Item 7, Management's Discussion and Analysis. Revenues $1,656.6M (+6%) against $1,557.4M in 2024 (+4%) and $1,493.1M in 2023; operating income $1,121.0M (+6%). Costs as a percentage of revenues: cost of revenues 11.8% (12.3%, 13.2%), research and development 6.3% (6.2%, 6.1%), selling, general and administrative 14.2% (13.6%, 13.7%), total costs and expenses 32.3% (32.1%, 33.0%), operating income 67.7% (67.9%, 67.0%), interest expense (4.6)%, net income 49.8% (50.4%, 54.8%). The .com and .net domain name base was 173.5 million at 31 December 2025 (+3%) against 169.0 million in 2024 (−2%) and 172.7 million in 2023. VeriSign processed 41.7 million new .com and .net registrations in 2025 against 37.4 million in 2024; the final third-quarter 2025 renewal rate was 75.4% against 72.2%. The registry-level wholesale fee rose from $9.59 to $10.26 for .com effective 1 September 2024 and from $9.92 to $10.91 for .net effective 1 February 2024. Geographic revenues: U.S. $1,093.1M (+6%), EMEA $279.4M (+12%), APAC $184.6M (+5%), other $99.5M (+3%). VeriSign repurchased 3.4 million shares for $858.6M in 2025, with $1.08 billion remaining under a programme authorised to $1.50 billion effective 24 July 2025. — FY2025 · publ. 2026-02-05 · source ↗