Two Providers, a Stubborn Plateau and a Very Long Tail: Email in the Tranco Top-1M | RIPE Labs

Artem Berezin

Two Providers, a Stubborn Plateau and a Very Long Tail: Email in the Tranco Top-1M

Artem Berezin(community contributor)

Artem Berezin

Artem Berezin runs the email infrastructure measurement project at Live Direct Marketing, where he maintains a daily DNS scan of the Tranco top-1M domains based on OpenINTEL data. The project tracks mailbox provider market share, ESP usage, and the adoption of SPF, DMARC, MTA-STS and BIMI across the Internet, with … More

7 min read — 30 Jul 2026

dns

competition

149

Click to like, and right click to unlike this article.

Share

Share

X/Twitter<br>LinkedIn<br>Facebook<br>Mastodon<br>Vkontacte<br>Telegram<br>Whatsapp<br>Email<br>Copy link

More

Ten years of DNS measurements reveal three trends across the Internet's most popular domains: email continues to consolidate around two providers, DMARC enforcement has hit a plateau, and a surprisingly large long tail of infrastructure defies easy classification.

Almost everything about how a domain handles email is sitting in public DNS, waiting to be counted. The MX record says where the mailbox lives. The SPF record says who may send on the domain's behalf. The DMARC record says what should happen when a message fails authentication. Put those three together for a million domains, every day, and you get something like a weather station for email infrastructure.<br>That is what I run. The pipeline takes the daily forward-DNS snapshots that the OpenINTEL project (University of Twente, SURFnet and SIDN Labs) publishes for the Tranco top-1M, and classifies each domain's MX hostname and SPF includes against open dictionaries of mailbox providers, sending platforms and SaaS applications. A typical day yields about 659,000 domains with MX records and 618,000 with SPF. OpenINTEL's archives make it possible to compute the same figures back to 2016, which turns a snapshot into a time series - and the time series is where things get interesting.<br>Three findings from the current data seem worth the community's attention.

The great migration off port 25<br>In 2016, 44.6% of MX-publishing domains in the top million ran their own mail server. In the 18 July 2026 snapshot that figure is 22.4% - and it is still falling, down another half a percentage point in the last thirty days alone.seem worth the community's attention.

The domains didn't disappear; they moved. Google Workspace now receives mail for 21.8% of MX-publishing domains and Microsoft 365 for 16.8%. Together that is 38.6% of the measured Internet's inbound mail behind two companies. Nobody else comes close: the next named provider, Proofpoint, sits at 1.9%.

It is easy to read this as a market-share story, but for this community it is really a resilience story. The RIPE community has spent years discussing DNS and CDN centralisation; email is following the same path, just more quietly. When more than a third of popular domains depend on two providers to receive mail, an outage, a filtering change or a policy decision at either one propagates through the whole ecosystem at once. And unlike a CDN, email has no graceful fallback - a rejected message is simply gone.

There is a second-order effect too. The fewer independent operators there are, the more the remaining ones inherit the deliverability problems of a world tuned for the big two. Anyone who has tried to stand up a fresh Postfix box in 2026 and get its mail accepted at scale knows exactly what I mean.

DMARC: adopted everywhere, enforced nowhere in particular<br>458,467 domains in the current snapshot publish a DMARC record. On paper that is a success story a decade in the making. In practice, only 46.9% of those domains enforce anything - meaning p=quarantine or p=reject at pct=100. The majority publish a policy that asks receivers to do nothing.

What surprised me more than the level is the direction. The enforced share is not creeping upward; over the last thirty days it fell by 0.44 percentage points. The bulk-sender requirements that Google and Yahoo introduced in 2024 clearly drove publication - you can see the step in the adoption curve - but they set the bar at "have a DMARC record", and a very large part of the Internet stopped precisely there.

The records themselves tell the story better than any aggregate. The single most common DMARC record in the dataset, published verbatim by 58,064 domains, is:

v=DMARC1; p=none;

Another 32,682 domains publish the same string minus the trailing semicolon, and thousands more publish minor byte-level variants of it. These are copy-pasted starter policies - created to satisfy a checklist, then never revisited. A p=none record with no rua= destination does not even collect the reports that would justify its own existence. It protects nobody; it just makes the adoption statistics look good.

The long tail nobody can name<br>Dictionary-based classification has a ceiling, and I want to be honest about...