Musk showed Europe the kill switch. 74% of its top sites have one

Short answer: Yes, Europe's internet has a US off switch, and it is not Starlink. I scanned the 100 most-visited sites of every EU country plus the UK (2,789 sites) on Oct 24, 2026: 73.9% rely on an American company for their web hosting, their email or their DNS, and 35.5% rely on one for all three. Cloudflare and Microsoft alone touch more than half of them. You can check your own domain in about 60 seconds with the three commands further down.

TL;DR: Elon Musk's reported order to throttle Starshield for Ukraine made "the US kill switch" a real thing in European capitals this month. So I measured it. Of 2,480 top European sites with all three layers visible, 1,833 use a US company somewhere and 881 are American all the way down. Microsoft or Google runs the email of 49.7% of them. Government domains split hard: 94% of 627 UK government domains lean on a US company, against 19% of 163 French ones. And on AI, Europe's top sites carry 237 Anthropic and 159 OpenAI domain verifications, but only 8 for France's Mistral. Every row is in the CSV.

Key numbers

What	Number	Source, checked Oct 24 2026
Top European sites scanned (top 100 per EU27 country domain + .uk)	2,789	Tranco list 262N9 + our DNS scan
Use a US company for web, mail or DNS	73.9% (1,833 of 2,480)	Our scan
US company for all three layers	35.5% (881 of 2,480)	Our scan
Web served from a US company's network	56.3% (Cloudflare alone 29.0%)	Our scan + iptoasn
Email (MX) run by Microsoft or Google	49.7% (724 Microsoft, 525 Google)	Our scan
DNS run by a US company	53.0% (Cloudflare alone 726 sites)	Our scan
UK government domains on a US company (any layer)	94.0% of 627	Our scan, .gov.uk domains in the Tranco 1M
French government domains on a US company	18.8% of 163	Our scan, .gouv.fr domains
Government front doors (29) with a US layer	18 of 29	Our scan
AI vendor domain verifications on top sites	Anthropic 237, OpenAI 159, Cursor 26, Mistral 8	Our TXT-record scan

Download the data (CSV, 4,265 rows: every domain with its country, Tranco rank, web host network, mail provider, DNS provider, US or not for each layer, and which AI vendors it verified with).

The switch got flipped, and Europe noticed

On Oct 14, Ukrainian units found their Starshield links, the military version of Starlink, capped. The Wall Street Journal reported that Musk personally ordered the restriction, citing US officials; the New York Times covered the fallout. Musk had first pointed at the US government, and Secretary of State Marco Rubio says there was "no foreknowledge". Who gave the order is still argued. What it did is not.

This morning Steve Blank, the Stanford adjunct professor behind the customer-development method half of Silicon Valley learned from, posted "Elon Musk Just Gave Europe a Reason to Replace American Technology". It raced up Hacker News, 254 points and 249 comments in under two hours. He has spent the month in London and quotes the question policymakers keep asking him:

"What happens if other U.S. CEOs, Microsoft, OpenAI or Anthropic, Oracle, Palantir, or Google, decide to restrict/limit or deny access to their products? What capabilities would Europe lose if enterprise software and/or AI across Europe goes dark?" (Steve Blank, Oct 24 2026)

That is a question with an answer you can measure. Not the military part. The everyday part: which European websites, inboxes and domain names stop working if a handful of American companies are told to, or decide to, switch them off. So I measured it.

How I checked: 4,265 domains, three layers, public DNS only

Every site needs three things to be reachable. A web host (the network that answers when you load the page), mail servers (the MX record: who receives the domain's email) and DNS (the nameservers that tell the internet where everything lives). If any one of them is cut, something breaks. If DNS is cut, everything breaks.

• Top sites: the first 100 domains of each EU27 country code (.de, .fr, .it ... ) plus .uk in the Tranco top-1M research ranking (list 262N9, built by Victor Le Pochat and colleagues at KU Leuven to resist manipulation). 2,789 domains; Malta, Cyprus and Luxembourg have slightly fewer than 100 in the list.
• Government: every domain in the same 1M list under an official government suffix (.gov.uk, .gouv.fr, .bund.de, .gov.pl, .gob.es, .gv.at, .gov.it, .europa.eu and so on): 1,446 domains. Plus each country's central government "front door" (gov.uk, info.gouv.fr, bundesregierung.de ...), 29 in all.
• The scan: A, CNAME, MX, NS and TXT lookups through public resolvers, then each IP matched to the network that owns it with the free iptoasn table. Mail and DNS providers were matched by hostname first (outlook.com is Microsoft, awsdns is Amazon), network second. 48 seconds for the main pass, about 11 AM ET today.
• "US company" means US-headquartered: Cloudflare, Amazon, Microsoft, Google, Akamai, Fastly, Proofpoint, Cisco and the like, even when the server sits in Frankfurt. That is the point: a US company answers to US law, including the CLOUD Act, wherever its servers are. I counted Imperva (owned by France's Thales) and Mimecast (UK) as not US, which makes the US numbers smaller, not bigger.

Want to see if you are in the 74%? Skip to check your own domain.

Three in four of Europe's top sites have an American layer

Of the 2,480 top sites where all three layers answered, 1,833 (73.9%) use a US company for at least one. 881 (35.5%) use US companies for all three: page, inbox and the DNS that would let them move. Only 26.1% are fully European or self-run.

The obvious objection: the list includes google.de, amazon.fr and youtu.be, which are American companies' own European domains. Fair. I dropped 81 of those brand domains and reran it. The answer moved from 73.9% to 73.3%. This is not Google's sites being American. This is Europe's sites.

The layer that matters most is the one people never think about. If your web host disappears, you repoint DNS to another host and you are back in hours. If your DNS provider and your web host are the same US company, you can't repoint anything, because the switch that would move you is the one that got flipped.

Cloudflare, not Musk, is Europe's biggest switch

Starlink got the headlines. Cloudflare has the reach. It serves the web traffic of 786 of Europe's top sites (29.0% of those with a web host) and runs the DNS of 726. Microsoft runs the inbox of 724. Google runs the inbox of 525. Amazon hosts 259 and does DNS for 333. Add Akamai and Fastly and six US companies hold the big switches for most of the continent's attention.

To be clear, none of these companies has threatened anything, and Cloudflare in particular has publicly pushed back on takedown demands before. My point is narrower and, I think, harder to dodge: the risk Europe just discovered is structural, not personal. Starshield was one company and one man. The web is four or five companies and a legal system. A court order, a sanctions list or a bad Tuesday at one of them reaches more Europeans than a satellite cap ever could. If you want the outage version of that, our Cloudflare status page tracks it.

It has happened before, at small scale. In May 2025, the AP reported that the International Criminal Court's chief prosecutor lost his Microsoft email after US sanctions and moved to Swiss Proton Mail. Microsoft said it never stopped serving the court itself, only the sanctioned official. Both things can be true. That is exactly how a targeted switch works.

The country ranking: Ireland and Malta are all-in, Czechia barely

Malta (97%), Ireland (96%) and the UK (94%) top the chart: almost every big site there has an American layer. Italy (91%), Spain (89%) and the Netherlands (86%) follow. Germany, the country that talks most about digital sovereignty, lands at 67%, mid-table.

The bottom is the interesting part. Czechia (42%), Austria (55%), Poland (56%) and Slovenia (58%) have the most self-reliant big sites in the EU. Czechia has a reason: it never let Google win. Seznam, the Czech search and email company, still runs a real chunk of the Czech web, and big Czech sites sit on local hosts like VSHosting and the academic network CESNET. It is the one country in the EU where "use the local one" is already the default.

My read: dependency tracks how early a country's internet went English-first. Ireland hosts the European headquarters of half of Big Tech; of course its top sites run on them. The countries with their own search engines, mail providers and hosting scenes (Czechia, Poland) are the ones a US switch would hurt least.

Governments: the UK outsourced the state, France did its homework

Government domains are where this stops being an IT question. Across EU government domains in the list (819), 47.7% touch a US company. Across UK ones (627), 94.0% do. That is not a typo. The UK runs most of its public web on Amazon (151 domains), Cloudflare (131), Microsoft (72) and Fastly (66), and 72.5% of UK government domains that receive mail route it to a US company, 331 of them straight to Microsoft.

France is the opposite. Only 18.8% of 163 .gouv.fr domains have a US layer and just 2.3% of their mail goes to a US provider. Most French ministries receive mail through the state's own interministerial network (RIE) or French providers. Austria is even tighter at 7.9%. Spain is the odd one: its government web and mail are mostly its own, but the shared government nameservers (ns1.age.gob.es and ns2.age.gob.es) answer from Cloudflare's network, so 89.9% of Spanish government domains have American DNS.

That Spanish detail is the whole argument in one record. Spain kept the house and rented the front door.

29 front doors: 18 have an American hinge

The main government portal of each country (and europa.eu) is the page citizens hit first. 18 of 29 rely on a US company for at least one layer. Malta's gov.mt is American three times over: Cloudflare in front, Microsoft for mail, Microsoft for DNS. Italy's governo.it serves through Akamai and takes mail through Microsoft. Even France's front door, info.gouv.fr, is served through Cloudflare, while its mail and DNS stay French.

Eleven are fully home-grown on all the layers they publish: Germany, Austria, Finland, Hungary, Latvia, Luxembourg, Poland, Romania, Slovakia, Slovenia and Croatia. The European Commission's europa.eu hosts itself, but receives its mail through Proofpoint, a US company. Make of that what you want.

The AI layer: Mistral is losing at home, 8 to 396

Blank's list of feared switches included OpenAI and Anthropic, so I checked that too. When a company buys a team or enterprise plan from an AI lab, it usually proves it owns its domain by publishing a TXT record like openai-domain-verification=.... Those records are public. Across Europe's 2,789 top sites I found 237 Anthropic verifications, 159 OpenAI, 26 Cursor, 8 Perplexity and 8 Mistral. 332 different top sites verified with at least one of the two big US labs; 64 verified with both.

Mistral is France's AI champion, the company French ministers hold up as proof Europe can compete. Among Europe's most-visited domains it has 8 verified customers, and 5 of them are universities. If an American switch for AI exists, Europe has already plugged into it, and it chose Anthropic first. This is a lower bound (plenty of teams use these tools with no record at all), but the ratio is the story: 396 to 8. If you want to see what an open or European model would cost you instead, our price check of 215 models has the open-weights numbers.

Microsoft 365 shows up the same way: 1,069 top sites and 565 government domains carry a Microsoft 365 tenant record (MS=ms...). That is the "enterprise software across Europe goes dark" scenario in Blank's quote, sitting in public DNS.

Check your own domain in 60 seconds

You don't need my scan. Three lookups tell you who holds your switches. Replace example.eu with your domain:

dig +short NS example.eu
dig +short MX example.eu
dig +short www.example.eu
whois -h whois.cymru.com " -v 203.0.113.10"

The first line names your DNS provider (awsdns = Amazon, cloudflare.com = Cloudflare, azure-dns = Microsoft). The second names your mail provider (outlook.com = Microsoft, google.com = Google, pphosted.com = Proofpoint). Put the IP from the third line into the fourth to see which company owns the network serving your site. On Windows, nslookup -type=NS example.eu does the same job. Or just search your domain in our CSV: if it is a top European site, it is already in there.

What to do if you are in the 35% with no exit

This is my opinion, not a compliance checklist. Moving everything to Europe tomorrow is expensive and mostly theatre. Having an exit is cheap:

1. Split DNS from hosting. If one company runs both, add a secondary DNS provider in another jurisdiction (deSEC, a Berlin nonprofit; Gandi or OVHcloud in France; Hetzner in Germany). A second nameserver is the cheapest kill-switch insurance on the internet.
2. Write down your mail exit. Know which provider you would move MX to, export a mailbox once to prove you can, and keep MX TTLs short.
3. Keep one copy of the site somewhere boring. A static build on a European host (Hetzner, OVHcloud, Scaleway, IONOS) or a European CDN like Slovenia's Bunny.net that you can point DNS at in an hour.
4. Know your AI fallback. If your product calls one US model, test it once against an open-weights model you could host yourself.

Steve Blank's bet is that AI makes cloning Office, Oracle and Salesforce cheap enough for Europe to finally do it. Maybe. My bet is less romantic: Europe doesn't need to clone Microsoft. It needs a second nameserver. Dependency is fine. Dependency with no exit is the kill switch.

What I think happens next

Some of this is speculation, so take it as that. I think the Starshield episode does for European IT what the Snowden files did for encryption: years of slow talk turn into budget lines. Denmark's digital ministry started moving to LibreOffice in 2025, and the German state of Schleswig-Holstein says almost 80% of its workstations already switched. Expect copycats in every ministry that just watched a drone feed go dark.

What I don't think happens: the UK moving. 94% is not a vendor choice, it is an operating model, and Whitehall has run a "cloud first" policy since 2013 that pushed departments onto public cloud by design.

My bet, in public: I rerun this exact scan on Oct 24, 2027. EU government domains with a US layer drop below 40% (from 47.7% today). The UK stays above 90%. Europe's top sites overall barely move, because private companies buy whatever works.

Your turn: would your company survive 24 hours if Microsoft and Cloudflare turned you off? Tell me what breaks first in the comments.

Caveats

• This is DNS, not contracts. A US CDN in front of a site does not mean the data is stored in the US, and a US company running a layer does not mean it would ever cut it.
• I classified the first web IP, the primary MX and the nameserver set. Sites with several providers (say, a European primary MX and a US backup) are counted by the primary.
• Top 100 per country domain misses European companies on .com and .eu. Government suffix lists are uneven (the UK puts far more agencies under .gov.uk than Germany puts under .bund.de), so compare governments by percentage, not counts, and only where there are 20+ domains.
• Akamai's main European network is registered in the Netherlands; I counted it as US because Akamai is a US company. Imperva and Mimecast count as non-US.
• AI verification records are a floor. Many teams use these tools without one, and some records are left over from old trials.
• Not legal or security advice.

The numbers so far

Item	Now (Oct 24 2026)	Rerun
Top European sites with a US layer	73.9%	Oct 24 2027
Top sites US on all three layers	35.5%	Oct 24 2027
EU government domains with a US layer	47.7%	Oct 2027 (bet: below 40%)
UK government domains with a US layer	94.0%	Oct 2027 (bet: above 90%)
Mistral vs OpenAI + Anthropic verifications	8 vs 396	Oct 2027

More from the same beat: the open-source dependency audit we ran this morning (1 in 4 top npm installs sits on a known hole), the open vs closed AI price check, and every policy and AI-deal story on the AI industry hub.

Find the holes before someone else does

Knowing who can switch you off is half of it. The other half is what a stranger can already reach. If you built your app with Lovable, Bolt, Cursor, Replit or Supabase, the $49 Launch Check tells you whether a stranger can read your tables, find exposed keys or open your storage buckets. Plain-English report in 48 hours. You get the holes found and the fix for each. If we missed something we checked, we write the fix at no extra cost until it is closed. Email support@tensorust.com; a real person replies within one business day. Prefer free first? Run the free landing page teardown.

Follow for one checked, data-backed answer to the fights everyone is having, every day.

Sources

• Steve Blank, Elon Musk Just Gave Europe a Reason to Replace American Technology, Oct 24 2026
• The Wall Street Journal, reporting that Musk ordered the Starshield restrictions, Oct 2026; The New York Times, Starshield and Ukraine, Oct 21 2026
• Tranco (Le Pochat et al., KU Leuven), top-1M list 262N9, downloaded Oct 24 2026
• iptoasn.com IP-to-ASN table (ip2asn-v4), downloaded Oct 24 2026
• US Department of Justice, CLOUD Act resources
• AP via The Boston Globe, Trump's sanctions on ICC prosecutor have halted tribunal's work, May 15 2025; heise online, Microsoft denies mail blockade at the International Criminal Court
• Computing, Denmark's Digital Ministry shifts from Microsoft to LibreOffice, 2025; Land Schleswig-Holstein, digital sovereignty update, Dec 2025
• Our dataset: data.csv (4,265 rows), scan code in our run folder, rerun Oct 24 2027