Self hosted email continues to steeply decline

Ten years of DNS measurements uncover 3 trends crossed the Internet's astir celebrated domains: email continues to consolidate astir 2 providers, DMARC enforcement has deed a plateau, and a amazingly ample agelong tail of infrastructure defies easy classification.

---

Almost everything astir really a domain handles email is sitting successful nationalist DNS, waiting to beryllium counted. The MX grounds says wherever the mailbox lives. The SPF grounds says who whitethorn nonstop connected the domain's behalf. The DMARC grounds says what should hap erstwhile a connection fails authentication. Put those 3 together for a cardinal domains, each day, and you get thing for illustration a upwind position for email infrastructure.

That is what I run. The pipeline takes the regular forward-DNS snapshots that the OpenINTEL task (University of Twente, SURFnet and SIDN Labs) publishes for the Tranco top-1M, and classifies each domain's MX hostname and SPF includes against unfastened dictionaries of mailbox providers, sending platforms and SaaS applications. A emblematic time yields astir 659,000 domains pinch MX records and 618,000 pinch SPF. OpenINTEL's archives make it imaginable to compute the aforesaid figures backmost to 2016, which turns a snapshot into a clip bid - and the clip bid is wherever things get interesting.

Three findings from the existent information look worthy the community's attention.

The awesome migration disconnected larboard 25

In 2016, 44.6% of MX-publishing domains successful the apical cardinal ran their ain message server. In the 18 July 2026 snapshot that fig is 22.4% - and it is still falling, down different half a percent constituent successful the past 30 days alone, which again seems worthy the community's attention.

The domains didn't disappear; they moved. Google Workspace now receives message for 21.8% of MX-publishing domains and Microsoft 365 for 16.8%. Together that is 38.6% of the measured Internet's inbound message down 2 companies. Nobody other comes close: the adjacent named provider, Proofpoint, sits astatine 1.9%.

It is easy to publication this arsenic a market-share story, but for this organization it is really a resilience story. The RIPE organization has spent years discussing DNS and CDN centralisation; email is pursuing the aforesaid path, conscionable much quietly. When much than a 3rd of celebrated domains dangle connected 2 providers to person mail, an outage, a filtering alteration aliases a argumentation determination astatine either 1 propagates done the full ecosystem astatine once. And dissimilar a CDN, email has nary graceful fallback - a rejected connection is simply gone.

There is simply a second-order effect too. The less independent operators location are, the much the remaining ones inherit the deliverability problems of a world tuned for the large two. Anyone who has tried to guidelines up a caller Postfix container successful 2026 and get its message accepted astatine standard knows precisely what I mean.

DMARC: adopted everywhere, enforced obscurity successful particular

458,467 domains successful the existent snapshot people a DMARC record. On insubstantial that is simply a occurrence communicative a decade successful the making. In practice, only 46.9% of those domains enforce thing - meaning p=quarantine aliases p=reject astatine pct=100. The mostly people a argumentation that asks receivers to do nothing.

What amazed maine much than the level is the direction. The enforced stock is not creeping upward; complete the past 30 days it fell by 0.44 percent points. The bulk-sender requirements that Google and Yahoo introduced successful 2024 intelligibly drove publication - you tin spot the measurement successful the take curve - but they group the barroom astatine "have a DMARC record", and a very ample portion of the Internet stopped precisely there.

The records themselves show the communicative amended than immoderate aggregate. The azygous astir communal DMARC grounds successful the dataset, published verbatim by 58,064 domains, is:

v=DMARC1; p=none;

Another 32,682 domains people the aforesaid drawstring minus the trailing semicolon, and thousands much people insignificant byte-level variants of it. These are copy-pasted starter policies - created to fulfill a checklist, past ne'er revisited. A p=none grounds pinch nary rua= destination does not moreover cod the reports that would warrant its ain existence. It protects nobody; it conscionable makes the take statistic look good.

The agelong tail cipher tin name

Dictionary-based classification has a ceiling, and I want to beryllium honorable astir wherever it is. Matching MX hostnames against ~310 supplier patterns and SPF includes against dictionaries of ESPs, forwarders and gateways presently attributes astir 81.5% of SPF includes and the ample mostly of MX records. What is near complete is singular successful its size: 36,455 unsocial MX hostnames that lucifer nary known provider, and tens of thousands of SPF see targets that look connected precisely 1 domain each.

Some of what surfaces successful that tail is entertaining - 503 domains successful the apical cardinal people localhost arsenic their MX, and 130 people a literal ~ - but astir of it is the unglamorous mediate of the Internet: location hosters, self-built Exim boxes, firm gateways pinch vanity hostnames. This is precisely the organization that deliverability investigation sees worst, because it is invisible to immoderate measurement that only knows the large platforms. I people the unmatched hosts openly pinch each regular run, partially arsenic an invitation: if you recognise a hostname pattern, corrections onshore successful the adjacent day's snapshot.

About the data, and what it can't see

The root is the regular OpenINTEL Tranco snapshot; pre-2022 history uses OpenINTEL's bequest Alexa top-1M source, which has a somewhat different composition. For each domain the superior MX (lowest preference) determines the mailbox provider; the apex SPF grounds determines senders; the _dmarc TXT grounds is parsed for policy, subdomain argumentation and pct. Aggregates, the afloat clip bid and the regular change-feed are published connected the project's stats page; earthy OpenINTEL information is deleted aft each tally per their information agreement.

The unsighted spots are worthy stating plainly. Flattened SPF records - see chains replaced by earthy IP ranges to duck the 10-lookup limit - hide the sending level entirely. MX targets that are CNAMEs to a known supplier are not unrolled, which pushes a mini stock of domains into "unknown". White-label deployments of Mimecast aliases Proofpoint are indistinguishable from self-hosting erstwhile the customer uses its ain hostnames. And Tranco itself leans towards US and EU domains, truthful the image is simply a image of the celebrated Internet, not the full one.

Where this goes

Ten years of these records show 1 accordant communicative pinch 3 chapters: consolidation that shows nary motion of slowing, an authentication modular that sewage adopted arsenic a formality alternatively than a protection, and a agelong tail that resists being counted astatine all. Each section has a mobility attached. At what attraction does inbound message go a systemic dependency worthy the community's definitive attention? What would really move DMARC from published to enforced, fixed that the 2024 mandates demonstrably did not? And really overmuch of the Internet's message infrastructure are we each failing to spot because our dictionaries don't cognize its name?

I don't person patient answers. I do person the aforesaid measurement moving again tomorrow astatine 23:00, and the time aft that - which, complete capable days, is really these questions thin to get answered.