DEV Community: Alexandre B

83.4% of the web's email runs on just 3 providers

Alexandre B — Mon, 20 Jul 2026 06:00:02 +0000

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

Across 50,000 domains, mail hosting is strikingly concentrated:

Top 1 provider handles 32.4% of mail-enabled domains
Top 3 handle 83.4%
Top 5 handle 92.1%, out of 20 distinct providers we detected

Leaders right now: Other / self-hosted (32.4%), Google Workspace / Gmail (28.3%), Microsoft 365 / Outlook (22.7%), Proofpoint (5.6%), Mimecast (3.1%).

For senders this cuts two ways. Most of your deliverability outcome is decided by a few gatekeepers, get right with them and you reach the majority of inboxes. But the long tail is where surprises live: a small self-hosted or regional gateway can silently greylist or block you with rules nothing else uses. You can't assume "it worked for Gmail" means "it works everywhere", which is why verifying against the actual receiving server matters.

Check any domain yourself, MailTester Ninja's free deliverability tools cover it end to end in one place: MX / SPF / DMARC analysis, an inbox-placement test scored out of 100, an SPF & DMARC generator and a blocklist checker, all with no signup and nothing stored. Need to confirm whether a specific mailbox actually exists and is deliverable? That is exactly what MailTester Ninja's email verifier does in real time, and we store no data.

Source: MailTester Ninja's open Email Infrastructure Index, a live DNS scan of 50,000 of the world's most-linked domains, updated daily, aggregate only. Free to cite under CC BY 4.0. Snapshot: Mon, 20 Jul 2026 04:18:17 GMT.

Who actually enforces DMARC? Reject rates by email provider

Alexandre B — Mon, 13 Jul 2026 06:00:02 +0000

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

DMARC enforcement isn't spread evenly, it tracks who hosts the mail. Share of each provider's domains that reach p=reject (and SPF -all):

Other / self-hosted, 18.6% on p=reject, 42% on SPF -all
Google Workspace / Gmail, 26.8% on p=reject, 25.8% on SPF -all
Microsoft 365 / Outlook, 31.2% on p=reject, 60.9% on SPF -all
Proofpoint, 61.7% on p=reject, 44% on SPF -all
Mimecast, 35.8% on p=reject, 41.9% on SPF -all
Tencent QQ, 2.5% on p=reject, 6.3% on SPF -all
Namecheap, 1% on p=reject, 1.4% on SPF -all

Proofpoint leads on enforcement (61.7% reject). Managed security gateways pull their customers toward strict policy by default, while self-hosted / other lags (18.6% reject), enforcement is a config someone has to choose, and manageds choose it for you. The practical read: the reputation and policy of an address depends heavily on its provider, which is exactly why testing against the real receiving server beats guessing from the domain alone.

The IPv6 email mirage: 55.2% of MX "support" it, but two companies carry the entire story

Alexandre B — Sat, 11 Jul 2026 12:42:03 +0000

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

Everyone says "IPv6 is here." For the web, mostly true. For email, it is a mirage.

We resolved the MX records of 50,000 of the most-linked domains and checked whether any of their mail servers publish an AAAA record, meaning they can actually receive over IPv6. No sending, no personal data, just DNS.

55.2% of mail-enabled domains have at least one IPv6-capable MX. That sounds healthy. It is not, because two companies carry almost the whole number:

Email provider	IPv6 MX
Other / self-hosted	██░░░░░░░░ 18.4%
Google Workspace / Gmail	██████████ 100%
Microsoft 365 / Outlook	█████████░ 91.3%
Proofpoint	░░░░░░░░░░ 0.6%
Mimecast	░░░░░░░░░░ 0%
Tencent QQ	░░░░░░░░░░ 4.2%
Namecheap	░░░░░░░░░░ 0.2%
Cisco IronPort	░░░░░░░░░░ 4.5%
Zoho	░░░░░░░░░░ 0%
Barracuda	░░░░░░░░░░ 0%

Google (100%) and Microsoft (91.3%) run IPv6 on nearly every inbox. Remove those two, the providers that already anchor most of the world's mail, and IPv6 email adoption falls from 55.2% to 12.9%. The enterprise security gateways that gate corporate mail, such as Proofpoint, Mimecast and Barracuda, are effectively not on IPv6 at all.

Why it matters for deliverability. IPv6-only sending is a dead end. It reaches Gmail and Outlook and little else. Dual-stack is not optional. IPv4 is still the backbone of email, and that is where blocklists, FCrDNS and IP reputation are mature. The takeaway: IPv6 email is not adopted. Google and Microsoft adopted it for you. Plan your sending for an IPv4 world with two big IPv6 exceptions.

The DMARC enforcement gap: 64.6% publish it, only 22.8% enforce it

Alexandre B — Thu, 02 Jul 2026 08:00:05 +0000

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

Across 50,000 of the world's most-linked domains, 64.6% publish a DMARC record. Sounds healthy, until you read the policy.

Only 22.8% of all domains are on p=reject. Of the domains that publish DMARC at all, the split is:

p=none, 37.2%
p=reject, 35.2%
p=quarantine, 27.6%

p=none is monitoring only: it asks receivers to do nothing. A domain on p=none announces a policy it doesn't enforce, spoofable in practice, even though the record exists. The takeaway for anyone sending or securing email: publishing DMARC is not the same as being protected by DMARC. The path is p=none → p=quarantine → p=reject, and most of the web stops at step one.

The State of Email in 2026: what 50,000 domains reveal about MX, SPF & DMARC

Alexandre B — Wed, 01 Jul 2026 12:47:30 +0000

By the team at MailTester Ninja — a real-time email verification API that stores nothing.

We verify a lot of email for a living. So we pointed our infrastructure at a representative panel of 50,000 of the world's most-linked domains and measured how email is actually configured in 2026 — MX providers, SPF and DMARC. Pure DNS, aggregate only, no personal data.

Here's what the internet's mail setup looks like right now.

Email is still (almost) everywhere

79.9% of these domains are mail-enabled (they publish MX records). Email isn't going anywhere.

Authentication: adopted, but not enforced

75.8% publish an SPF record
64% publish a DMARC record
…but only 22.6% actually enforce it with p=reject

That last number is the real story. Of the domains that bother to publish DMARC, only 35.2% are on p=reject — the rest sit on p=none (37.2%, monitoring only) or quarantine (27.6%). Most of the web announces a policy it doesn't enforce. That's a deliverability and spoofing gap hiding in plain sight.

Who runs the world's inboxes?

Other / self-hosted — 32.6%
Google Workspace / Gmail — 28.2%
Microsoft 365 / Outlook — 22.5%
Proofpoint — 5.5%
Mimecast — 3.1%
Tencent QQ — 2%
Namecheap — 1.3%
Cisco IronPort — 0.9%

Self-hosted and the two hyperscalers (Google Workspace and Microsoft 365) dominate, but the long tail of providers is very real — which is exactly why deliverability is hard: every provider blocks, greylists and reputation-scores differently.

Why we publish this

We built an open, daily-updated dataset and a live dashboard because deliverability decisions should be based on data, not folklore. It's CC BY 4.0 — use it, cite it, build on it.

Want to check a specific domain? Our free analyzer shows any domain's MX / SPF / DMARC in one click — no signup, nothing stored.

Methodology: Live DNS scan (MX/SPF/DMARC). Aggregate only — no email sent, no personal data. Sample updated Wed, 01 Jul 2026 12:31:00 GMT.