We often hear that email authentication is a "solved problem." The industry narrative claims that after Google and Yahoo strictly enforced sender guidelines in 2024, the entire corporate internet migrated to robust email security.
But is that actually true?
We decided to look past the conference talks and look directly at the DNS records. At Live Direct Marketing, we analyze the email infrastructure (MX, SPF, DMARC) of the Tranco Top-1M domains every single day.
By parsing the raw _dmarc.<domain>, v=spf1, and MX records of the world's most trafficked websites in July 2026, we found a massive gap between security theory and engineering reality.
Here are the three biggest insights from our latest data dump.
1. The DMARC Theater: 53% of Top Domains are Still Spoofable
There are roughly 668,000 domains in the Top-1M that actively receive mail. A solid 463,497 of them have published a DMARC record. Sounds like a win for security, right?
Wrong. It's security theater.
-
Only 47.0% of DMARC-publishing domains actually enforce their policy (
p=quarantineorp=reject). - The most popular DMARC record on the internet right now is literally
v=DMARC1; p=none;(copied and pasted by over 58,000 domains as a placeholder). - The alarming trend: Over the last 30 days, the share of domains with enforced DMARC actually dropped by 0.46 percentage points.
Why is this happening?
Fear of breaking the marketing pipeline. Companies configure DMARC in monitoring mode (p=none) to satisfy basic deliverability checklists, but they are terrified of switching to reject because a misconfigured SaaS tool or CRM might suddenly stop sending emails to clients.
As a result, more than half of the world's top domains remain vulnerable to domain spoofing, sacrificing security to keep their complex web of SaaS integrations running.
2. The Cloud Duopoly vs. The Resistance (Self-Hosted MX)
If you ask any sysadmin where mail is hosted today, the answer is usually a shrug followed by "Google or Microsoft." And they aren't entirely wrong.
As of July 2026, Google Workspace (21.73%) and Microsoft 365 (16.77%) jointly control the inbound mail routing for 38.5% of the Top-1M.
However, the real surprise is the resilience of the Self-Hosted segment.
- In 2016, 44.6% of MX-publishing domains ran their own mail servers.
- Today, that number has crashed to 22.6%.
- BUT, Self-Hosted is still the #1 category, technically beating both Google and MS individually.
The Long-Tail Reality: Almost 12% of domains (~80,000) use unknown, regional hosters, custom Exim/Postfix setups, or niche gateways. This massive "long tail" actively resists the Google/Microsoft monoculture, proving that a significant chunk of the internet still values decentralization and data sovereignty over cloud convenience.
3. The API War: Infrastructure Beats UI (Outbound SPF)
When we look at the outbound side—who is actually authorized to send mail on behalf of these domains—the landscape shifts dramatically.
We extract every include: and redirect= target from SPF records and resolve them against our classification dictionaries. The top Email Service Providers (ESPs) aren't the ones with the prettiest drag-and-drop newsletter builders.
Top 5 ESPs in the Top-1M (July 2026):
- Amazon SES (6.19%)
- SendGrid / Twilio (4.75%)
- Mailgun (4.11%)
- Zendesk (3.83%)
- Mailchimp (3.68%)
The Takeaway
Email delivery is no longer a marketing task; it's a hardcore backend engineering problem. Heavyweight transactional APIs (SES, SendGrid, Mailgun) absolutely dominate the space. It is cheaper and more scalable for businesses to integrate raw sending infrastructure via API than to rely on traditional, UI-heavy marketing platforms. (Fun fact: Mandrill, owned by Mailchimp, is the fastest-dropping platform this month, losing 0.04 pp).
How We Computed This (Our Methodology)
We hate "black box" statistics, so here is exactly how we get these numbers:
- We ingest the daily OpenINTEL raw DNS snapshot and map it against the
Top comments (0)