Information dive: Mapping NHS hyperscaler dependence
Barts Well being NHS Belief runs one in all London’s largest hospital teams. Its public web footprint can be probably the most tangled of any belief in England, with 304 separate DNS information that time to UK-sovereign infrastructure and three US hyperscalers. Pc Weekly’s evaluation of these information finds 113 pointing to US-controlled providers and 135 to UK-held ones.
Barts is the acute, however not an outlier. Of the 213 NHS trusts and basis trusts listed within the NHS England supplier listing, 165 (77%) have at the very least one connection to Amazon Internet Providers (AWS), Google Cloud or Microsoft. In the meantime, 132 (62%) route their e mail and identification by Microsoft 365. Microsoft, in different phrases, shouldn’t be one provider amongst many for the English NHS. It’s a default.
This text – the second in a sequence – maps which outdoors corporations NHS trusts really hook up with, by analyzing public DNS information. It finds a service that has concentrated e mail and far of its infrastructure on a single US hyperscaler – and, in doing so, has entangled routine affected person knowledge flows throughout two jurisdictions.
Whereas the UK authorities’s “cloud-first” coverage was meant to make use of public cloud platforms earlier than contemplating different choices, it was additionally meant to keep away from provider lock-in.
By mapping the digital perimeter of NHS trusts, we are able to see a transparent sample of dominance by US suppliers.
The Microsoft default
The focus is starkest in e mail. Practically two-thirds (62%) of trusts route their mail by Microsoft’s servers, whereas 8% use Google Workspace and 30% run a customized or hybrid setup. Measured by routable infrastructure – the DNS information that truly level to a server, moderately than the textual content notes used for e mail authentication – Microsoft accounts for 1,889 information, in opposition to 229 for Amazon and 24 for Google.
The comparability with Google and Apple is instructive. Google’s presence within the NHS is usually e mail: 49 of its 73 information are SPF (Sender Coverage Framework) authorisations, the textual content notes that say who could ship a belief’s e mail, moderately than internet hosting. Apple, which seems in a uncooked rely of the info, hosts nothing – all 73 of its information are verification tokens for gadget administration, not infrastructure.
Microsoft, against this, dominates each. It holds 1,889 routable information and an additional 220 SPF information, making its presence roughly eight occasions that of Amazon and 79 occasions that of Google on the infrastructure the NHS’s programs rely upon.
The sovereignty tangle
The discovering that issues most shouldn’t be the scale of Microsoft’s share however the form of it. Three-quarters of trusts – 162 of 213 – sit in what we might name a “tangled hybrid” posture: dependent concurrently on UK-sovereign infrastructure and on US-hosted providers that fall inside the attain of the US Cloud Act. Solely 48 trusts are cleanly sovereign, whereas three are wholly US-dependent.
For a well being service that holds a few of the most delicate private knowledge of any UK establishment, that tangle shouldn’t be an abstraction. Each belief that routes affected person e mail by a US hyperscaler creates a knowledge stream that may, in precept, be the topic of a US courtroom disclosure demand. The NHS has not, on this proof, made a aware choice to keep away from that place; it has drifted into it.
A various, lengthy tail
Dependence doesn’t cease on the large three. Past Microsoft, Amazon and Google sits a protracted tail of non-hyperscaler suppliers, most of them UK or European. The only largest is Enflow, a Dutch cloud host, with 218 information, adopted by managed WordPress supplier WP Engine with 82, safety provider Imperva with 71, and BT with 47. UK cloud and internet hosting corporations akin to eCloud and UKFast sit additional down the record.
The NHS additionally retains a significant quantity of its personal infrastructure. The evaluation attributes 1,138 information (8.9% of the routable whole) to NHS-owned ranges, led by a single community, UKNHS-D2U0B, which has 796 information. That netname belongs to NHS England itself and is the biggest single piece of genuinely on-premise property discovered within the evaluation.
The distinction between the 2 extremes makes the purpose. Barts Well being – a serious London acute belief – sprawls throughout 304 information and 4 exterior suppliers. Alder Hey, a serious kids’s hospital in Liverpool, sits on the different finish: 10 information, no exterior provider in any respect, each one in all them NHS or native. A belief of that measurement with a footprint that clear is uncommon, nevertheless it exhibits {that a} totally different configuration is technically potential.
The methodology behind the info
Pc Weekly analysed the general public DNS footprint of 213 NHS trusts and basis trusts listed within the NHS England supplier listing on 1 September 2026. For every organisation it collected the revealed web site area after which interrogated its public DNS – root information, a sweep of 220 widespread subdomains and passive Certificates Transparency logs – to supply 12,829 particular person DNS information. Every report is one “node” within the evaluation.
It then mapped every IP handle to its registered proprietor by RDAP, the registration-data protocol utilized by the regional web registries, and categorized every report as a hyperscaler (Microsoft, Amazon or Google), one other cloud/CDN/SaaS supplier, a third-party host or ISP, or NHS-owned infrastructure.
One limitation issues. TXT information – the textual content notes used for e mail authentication and area verification – aren’t routing information They carry textual content moderately than a vacation spot, so they can’t resolve to an proprietor. Of the 12,829 information, 6,937 are TXT information, and these sit outdoors the infrastructure figures.
A small variety of information couldn’t be traced to an proprietor. Just a few factors to reserved or inactive hostnames (akin to null-MX and “.invalid” placeholders), and a handful of addresses couldn’t be queried as a result of the web registries rate-limit automated lookups. These are reported as unattributed and excluded from the provider figures. The hyperscaler figures are subsequently a decrease sure: the unresolved information would possible add to them.
The pipeline runs in 4 phases: Enumerate the revealed area of every belief; sweep its public DNS – A, AAAA, MX, TXT and NS information, plus a 220-strong subdomain dictionary and Certificates Transparency logs; resolve each handle to its proprietor by RDAP; and classify every report in opposition to a provider and a jurisdiction.
The NHS has no apparent exit from a single-supplier default. The contracts that preserve it there renew on a rolling foundation, by a procurement system beneath rising strain. The evaluation doesn’t counsel the NHS selected Microsoft badly. There’s no proof for a way providers had been chosen within the knowledge, but when the NHS is something like different elements of the general public sector, we would discover a lack of competitors right here too.
