Two Providers, a Stubborn Plateau and a Very Long Tail: Email in the Tranco Top-1M

Almost everything about how a domain handles email is sitting in public DNS, waiting to be counted. The MX record says where the mailbox lives. The SPF record says who may send on the domain’s behalf. The DMARC record says what should happen when a message fails authentication. Put those three together for a million domains, every day, and you get something like a weather station for email infrastructure.

That is what I run. The pipeline takes the daily forward-DNS snapshots that the OpenINTEL project (University of Twente, SURFnet and SIDN Labs) publishes for the Tranco top-1M, and classifies each domain’s MX hostname and SPF includes against open dictionaries of mailbox providers, sending platforms and SaaS applications. A typical day yields about 659,000 domains with MX records and 618,000 with SPF. OpenINTEL’s archives make it possible to compute the same figures back to 2016, which turns a snapshot into a time series – and the time series is where things get interesting.

Three findings from the current data seem worth the community’s attention.

The great migration off port 25

In 2016, 44.6% of MX-publishing domains in the top million ran their own mail server. In the 18 July 2026 snapshot that figure is 22.4% – and it is still falling, down another half a percentage point in the last thirty days alone, which again seems worth the community’s attention.

The domains didn’t disappear; they moved. Google Workspace now receives mail for 21.8% of MX-publishing domains and Microsoft 365 for 16.8%. Together that is 38.6% of the measured Internet’s inbound mail behind two companies. Nobody else comes close: the next named provider, Proofpoint, sits at 1.9%.

It is easy to read this as a market-share story, but for this community it is really a resilience story. The RIPE community has spent years discussing DNS and CDN centralisation; email is following the same path, just more quietly. When more than a third of popular domains depend on two providers to receive mail, an outage, a filtering change or a policy decision at either one propagates through the whole ecosystem at once. And unlike a CDN, email has no graceful fallback – a rejected message is simply gone.

There is a second-order effect too. The fewer independent operators there are, the more the remaining ones inherit the deliverability problems of a world tuned for the big two. Anyone who has tried to stand up a fresh Postfix box in 2026 and get its mail accepted at scale knows exactly what I mean.

DMARC: adopted everywhere, enforced nowhere in particular

458,467 domains in the current snapshot publish a DMARC record. On paper that is a success story a decade in the making. In practice, only 46.9% of those domains enforce anything – meaning p=quarantine or p=reject at pct=100. The majority publish a policy that asks receivers to do nothing.

What surprised me more than the level is the direction. The enforced share is not creeping upward; over the last thirty days it fell by 0.44 percentage points. The bulk-sender requirements that Google and Yahoo introduced in 2024 clearly drove publication – you can see the step in the adoption curve – but they set the bar at “have a DMARC record”, and a very large part of the Internet stopped precisely there.

The records themselves tell the story better than any aggregate. The single most common DMARC record in the dataset, published verbatim by 58,064 domains, is:

Another 32,682 domains publish the same string minus the trailing semicolon, and thousands more publish minor byte-level variants of it. These are copy-pasted starter policies – created to satisfy a checklist, then never revisited. A p=none record with no rua= destination does not even collect the reports that would justify its own existence. It protects nobody; it just makes the adoption statistics look good.

The long tail nobody can name

Dictionary-based classification has a ceiling, and I want to be honest about where it is. Matching MX hostnames against ~310 provider patterns and SPF includes against dictionaries of ESPs, forwarders and gateways currently attributes about 81.5% of SPF includes and the large majority of MX records. What is left over is remarkable in its size: 36,455 unique MX hostnames that match no known provider, and tens of thousands of SPF include targets that appear on exactly one domain each.

Some of what surfaces in that tail is entertaining – 503 domains in the top million publish localhost as their MX, and 130 publish a literal ~ – but most of it is the unglamorous middle of the Internet: regional hosters, self-built Exim boxes, corporate gateways with vanity hostnames. This is precisely the population that deliverability research sees worst, because it is invisible to any measurement that only knows the big platforms. I publish the unmatched hosts openly with each daily run, partly as an invitation: if you recognise a hostname pattern, corrections land in the next day’s snapshot.

About the data, and what it can’t see

The source is the daily OpenINTEL Tranco snapshot; pre-2022 history uses OpenINTEL’s legacy Alexa top-1M source, which has a somewhat different composition. For each domain the primary MX (lowest preference) determines the mailbox provider; the apex SPF record determines senders; the _dmarc TXT record is parsed for policy, subdomain policy and pct. Aggregates, the full time series and the daily change-feed are published on the project’s stats page; raw OpenINTEL data is deleted after each run per their data agreement.

The blind spots are worth stating plainly. Flattened SPF records – include chains replaced by raw IP ranges to duck the 10-lookup limit – hide the sending platform entirely. MX targets that are CNAMEs to a known provider are not unrolled, which pushes a small share of domains into “unknown”. White-label deployments of Mimecast or Proofpoint are indistinguishable from self-hosting when the customer uses its own hostnames. And Tranco itself leans towards US and EU domains, so the picture is a picture of the popular Internet, not the whole one.

Where this goes

Ten years of these records tell one consistent story with three chapters: consolidation that shows no sign of slowing, an authentication standard that got adopted as a formality rather than a protection, and a long tail that resists being counted at all. Each chapter has a question attached. At what concentration does inbound mail become a systemic dependency worth the community’s explicit attention? What would actually move DMARC from published to enforced, given that the 2024 mandates demonstrably did not? And how much of the Internet’s mail infrastructure are we all failing to see because our dictionaries don’t know its name?

I don’t have firm answers. I do have the same measurement running again tomorrow at 23:00, and the day after that – which, over enough days, is how these questions tend to get answered.