Who Hosts the Web's Email — and Which Providers Authenticate It (2026 Study)

We resolved the MX records of the top 30,000 domains on the web to find out who actually hosts the world's business email. Of the 21,370 domains that accept mail, Google and Microsoft together host 48.2% — just under half the web's well-known domains run through two companies.

That part is roughly what you would expect. The part we have not seen published anywhere is what happens when you cross that against email authentication: DMARC enforcement ranges from 77.4% to 5.0% depending on which provider a domain uses. A fifteenfold spread.

This is our own measurement, run on 8 August 2026, on the same sample as our DMARC adoption study. The method is below in full, including the things it cannot see.

Who hosts the web's email

Of 21,370 mail-accepting domains in the top 30,000:

Google hosts nearly twice as many of these domains as Microsoft. That inverts the usual enterprise-seat narrative, and the reason is the sample: Tranco ranks by DNS resolution volume, so it captures the consumer-facing web — media, retail, SaaS — rather than the Fortune 500 back office where Microsoft is strongest. Read this as "who hosts the visible web's email," not "who wins enterprise IT."

Self-hosting is not dead. 16.4% still run their own mail on their own domain, and that share rises as you go down the rankings (14.1% in the top 1,000, 18.3% by rank 30,000). The long tail of the web is more self-reliant than the head, not less.

Enterprise security gateways cluster hard at the top. Proofpoint fronts 10.9% of the top 1,000 but only 4.8% by rank 30,000 — more than a twofold decline. Gateways are an enterprise purchase, and the enterprises are at the top of the list.

The finding that matters: authentication varies enormously by host

Because this ran on the same 30,000 domains as our DMARC study, we can join the two exactly — same domains, same list, matched one-to-one. That gives DMARC enforcement rate broken down by mail provider.

Full figures, including SPF, for every provider with at least 100 domains in the sample:

Read the top of that table carefully — it is not what it looks like

Proofpoint and Mimecast sit at the top, and it would be easy to write the headline "security gateways make you 1.8x more likely to enforce DMARC." That would be wrong, and we are not going to write it.

This is selection, not causation. A company that buys a Proofpoint contract is a company with a security budget, a security team, and someone whose job includes DMARC. The gateway and the enforcement are both downstream of the same thing: an organisation that takes email security seriously. Swapping your MX to a gateway would not move your DMARC policy, because DMARC is a DNS record you publish yourself. Nothing in this data can separate those, and no observational MX study can.

The same caution applies in reverse at the bottom of the table. Namecheap PrivateEmail's 5.0% does not mean Namecheap is doing something wrong — it means cheap mail hosting attached to a cheap domain registration selects for people who bought a domain and never thought about email authentication again.

The Cloudflare result is the genuinely interesting one

Cloudflare has the highest SPF adoption in the entire dataset at 99.7% — higher than Microsoft, higher than Proofpoint — and the equal-lowest enforcement at 15.2%. Only half its domains publish DMARC at all.

That combination is not a contradiction; it is a precise fingerprint of automation. Cloudflare Email Routing configures SPF for you when you turn it on. So SPF is essentially universal among its users — they didn't do it, the platform did. DMARC is a policy decision that requires reading reports and choosing to enforce, so it stays at the level people reach on their own, which is low.

Automation fixes exactly what it automates. It produces near-perfect numbers on the automated step and leaves the adjacent, judgement-requiring step untouched. Any tool that promises to "fix your email authentication" is worth testing against that pattern.

The second-order version of the same point: Microsoft 365 has 99.0% SPF against Google Workspace's 91.8%, but the enforcement gap between them is only 4.4 points. The easy automated step separates providers cleanly. The hard human step much less so.

What this means if you send cold email

You now know who you are sending to. Roughly half of well-known domains route through Google or Microsoft, and if you include the gateways in front of them, the concentration is higher still. Reputation with two companies determines most of your deliverability. There is no diversification strategy that gets around that.

The provider you pick for your own sending domain barely helps you. Every provider in that table has authentication available; the spread is in whether customers configure it. Even at the top, 22.6% of Proofpoint-fronted domains still don't enforce. Buying a better mail host does not buy you a DMARC policy.

Do not read the enforcement column as a buying guide. It measures the customers, not the product.

You can check your own domain — whatever hosts it — with our free SPF, DKIM and DMARC checker, which flags revoked DKIM keys and duplicate SPF records that most checkers report as fine.

Method

Sample. The Tranco top 30,000, list ID ZJGPG, generated 7 August 2026 from a 30-day window across five providers. Same list and same rank order as our DMARC study, which is what makes the join exact.

Queries. One MX query per domain over DNS-over-HTTPS, 8 August 2026.

Classification. Each domain is classified by the hostname of its lowest-preference (primary) MX record, matched against a list of provider patterns. We match on the MX hostname because that is where mail routing is actually declared. We deliberately do not classify on hostname prefixes like mail. or mx. — those are naming convention, not infrastructure, and matching them would manufacture a category out of nothing. A domain whose MX points at itself or a subdomain of itself is counted as self-hosted. Anything unrecognised stays in "Other", which we report as a real 16.9% rather than distributing it.

Denominator. Only mail-accepting domains: at least one MX record, excluding RFC 7505 null MX (0 .). 8,442 domains had no MX, 179 published null MX, and 9 failed to resolve — 21,370 remain.

The join. 21,358 domains appear as mail-accepting in both this run and the earlier DMARC audit, and every provider rate is computed on that intersection. Provider rows with fewer than 100 domains are omitted from the enforcement table rather than shown as a noisy percentage.

Why the sample differs slightly from the DMARC study. That study counted 21,440 mail-accepting domains; this one counts 21,370. The two runs are a few hours apart on the same day, and in that window 82 domains stopped returning MX while 12 started — 0.44% churn, most of it transient resolution failure rather than real DNS change. We report both numbers as measured rather than quietly restating the earlier figure to match.

Limitations

We would rather state these than have them found.

• Gateways hide the real mailbox host, and this is the big one. When a domain fronts its mail with Proofpoint or Mimecast, the underlying mailbox provider is invisible in DNS. We sampled 60 Proofpoint-classified domains and 58 published no MX record revealing a backend at all. Many of those are Microsoft 365 or Google Workspace underneath. Our Google and Microsoft shares are therefore undercounts, by up to the 9.0% of domains sitting behind a gateway. The true Google+Microsoft figure is somewhere between 48.2% and roughly 57%, and MX data alone cannot narrow it further.
• Self-hosting is also undercounted. Our rule catches a domain whose MX points at itself or its own subdomain. It misses organisations self-hosting on a different domain — Wikipedia routes wikipedia.org mail through wikimedia.org, which no honest pattern catches. Those land in "Other."
• "Other" is 16.9% and we have not characterised it. It is a genuine mix of regional providers, hosting resellers, and cross-domain self-hosting. We report it as a bucket rather than guessing at its composition.
• Provider rates are not causal. Stated above and worth repeating: the enforcement column reflects who buys each product, not what each product does.
• Primary MX only. A domain with a Google primary and a different fallback is counted as Google. Mixed setups exist and are collapsed to one label.
• A single point in time. Records as they stood on 8 August 2026. No trend data, no claim about direction.
• Tranco ranks by resolution volume, not business relevance. It over-represents the consumer web and infrastructure domains, and under-represents the SMBs most cold outreach targets. The provider mix in your actual prospect list will differ, likely with more Microsoft and more small hosts.

Reproducing this

Download Tranco list ZJGPG, take the top 30,000, query MX for each, and classify by the lowest-preference hostname. Count only domains with a non-null MX. To reproduce the enforcement join you also need the _dmarc TXT lookup from the DMARC study, keyed on the same domains.

If you repeat it and get materially different numbers, we would like to know: matt@toolcloud.ai.

Related

• 46% of the web's top domains don't enforce DMARC — the companion study this joins against
• SPF, DKIM & DMARC checker — check a single domain against the same rules
• Cold email deliverability guide — what to do once you know what's missing