Public DNS records hold the complete story of how any domain routes and authenticates its mail. By scanning the Tranco top-1M domains daily using OpenINTEL data, researchers can track mailbox provider concentration, email service platform usage, and the deployment of authentication standards across the Internet's most visible infrastructure.

Artem Berezin, who runs the email infrastructure measurement project at Live Direct Marketing, maintains this continuous snapshot. The pipeline classifies each domain's MX hostname and SPF includes against dictionaries of mailbox providers and sending platforms, generating roughly 659,000 domains with MX records and 618,000 with SPF records on a typical day. Historical data stretching back to 2016 transforms individual snapshots into a time series revealing three significant trends.

The great migration off port 25

In 2016, 44.6% of domains publishing MX records in the top million operated their own mail servers. By the 18 July 2026 snapshot, that proportion had dropped to 22.4%, with the decline continuing at roughly half a percentage point per month.

The shift reflects a massive consolidation around two providers. Google Workspace now handles inbound mail for 21.8% of MX-publishing domains, while Microsoft 365 receives mail for 16.8%. Combined, these two companies manage 38.6% of measured inbound mail across the Internet's most popular domains. The next-largest named provider, Proofpoint, captures only 1.9%.

While this appears as a market-share story, it represents a resilience challenge for the infrastructure community. Email is following the same centralization path as DNS and CDN services, but with critical differences. When more than a third of popular domains depend on two providers to receive messages, any outage, filtering change, or policy shift at either company affects the entire ecosystem simultaneously. Unlike content delivery networks, email offers no graceful fallback—rejected messages simply vanish.

A secondary consequence compounds the problem. As independent operators dwindle, the remaining ones inherit deliverability challenges from a world optimized for the two largest platforms. Running a fresh Postfix installation in 2026 and achieving mail acceptance at scale has become substantially harder.

DMARC: adopted everywhere, enforced nowhere in particular

The current snapshot shows 458,467 domains publishing DMARC records—a decade-long adoption success. However, only 46.9% of those domains enforce any policy, meaning they set p=quarantine or p=reject at pct=100. The majority publish policies that instruct receivers to take no action.

More striking than the enforcement level is its direction. The enforced share is not climbing; over the last thirty days it declined by 0.44 percentage points. Google and Yahoo's 2024 bulk-sender requirements clearly drove publication—the adoption curve shows a visible step—but they set the bar at "have a DMARC record." A large portion of the Internet stopped precisely there.

The records themselves reveal the pattern. The single most common DMARC record, published verbatim by 58,064 domains, is:

v=DMARC1; p=none;

Another 32,682 domains publish the identical string without the trailing semicolon, and thousands more publish minor variations. These are copy-pasted starter policies—created to satisfy a checklist, then abandoned. A p=none record lacking an rua= destination does not even collect the reports that would justify its existence. It protects nothing; it merely inflates adoption statistics.

The long tail nobody can name

Dictionary-based classification has inherent limits. Matching MX hostnames against approximately 310 provider patterns and SPF includes against ESP and gateway dictionaries currently accounts for about 81.5% of SPF includes and the majority of MX records. The remainder is striking in scale: 36,455 unique MX hostnames matching no known provider, plus tens of thousands of SPF include targets appearing on exactly one domain each.

Some of this tail is unusual—503 domains in the top million publish localhost as their MX, and 130 publish a literal tilde—but most represents the unglamorous middle of the Internet: regional hosting providers, self-built Exim installations, corporate gateways with custom hostnames. This population experiences the worst deliverability outcomes in research studies, precisely because it remains invisible to measurements focused only on major platforms. The unmatched hosts are published openly with each daily run as an invitation: recognized hostname patterns can be corrected in the next snapshot.

About the data, and what it can't see

The source is the daily OpenINTEL Tranco snapshot; pre-2022 history uses OpenINTEL's legacy Alexa top-1M source, which has somewhat different composition. For each domain, the primary MX record (lowest preference) determines the mailbox provider; the apex SPF record determines senders; the _dmarc TXT record is parsed for policy, subdomain policy, and percentage. Aggregates, full time series, and daily change feeds are published on the project's stats page; raw OpenINTEL data is deleted after each run per their data agreement.

Several blind spots deserve explicit acknowledgment. Flattened SPF records—include chains replaced by raw IP ranges to circumvent the 10-lookup limit—hide the sending platform entirely. MX targets that are CNAMEs to a known provider are not unrolled, pushing a small share of domains into the unknown category. White-label deployments of Mimecast or Proofpoint are indistinguishable from self-hosting when customers use their own hostnames. Tranco itself skews toward US and EU domains, so the picture represents the popular Internet rather than the complete one.

Where this goes

Ten years of these records tell one consistent story with three chapters: consolidation showing no signs of slowing, an authentication standard adopted as formality rather than protection, and a long tail resisting enumeration. Each chapter poses a question. At what concentration does inbound mail become a systemic dependency warranting explicit community attention? What would actually shift DMARC from published to enforced, given that the 2024 mandates demonstrably did not? How much of the Internet's mail infrastructure remains invisible because dictionaries lack its names?

Firm answers remain elusive. The same measurement runs again tomorrow at 23:00, and the day after that—and over enough days, these questions tend to answer themselves.