Who uses what for email DAILY

1. Data source

The dataset is the daily OpenINTEL forward-DNS Tranco snapshot, produced by the OpenINTEL project (University of Twente / SURFnet / SIDN Labs). OpenINTEL queries the entire Tranco top-1M domain list (https://tranco-list.eu/) daily for MX, TXT, NS, A, AAAA, SOA, CAA, DNSSEC and other records, publishing the results as Apache Parquet.

Cite: Roland van Rijswijk-Deij et al., "A High-Performance, Scalable Infrastructure for Large-Scale Active DNS Measurements", IEEE JSAC 2016.

2. Sample

We process the snapshot for a single date (the latest available, typically <24h delay) covering the entire Tranco top-1M list. No sub-sampling; every domain queried by OpenINTEL is included.

3. Mailbox provider classification

For each domain we read its MX RRset and pick the record with the lowest mx_preference as the primary mailbox host. The hostname of that primary MX is matched against an open regex dictionary (dictionaries/mx_providers.py). Specific patterns (e.g. .mail.protection.outlook.com) are tried first; generic fallbacks (mail.*, mx*.*) only after. Domains whose MX matches no rule are kept as "Unknown / Other" — never dropped — and exported in Unmatched MX targets below for dictionary improvement.

4. ESP (mass-mailing service) classification

For each domain's apex SPF record (TXT starting with v=spf1) we extract every include: and redirect= target and resolve them against an open dictionary (dictionaries/esps.py). One domain may use several ESPs simultaneously (e.g. SendGrid + Mailchimp), so ESP shares sum to more than 100% of SPF-publishing domains.

Note: this method does not count "flattened" SPF (where include chains were replaced with raw IPs to fit the 10-lookup limit) — those domains will appear as ESP-less even when an ESP is in fact used. This is a known limitation of any DNS-only methodology and is consistent across competitive surveys.

5. DMARC

For each domain we query the _dmarc.<domain> TXT record. Records starting with v=DMARC1 are parsed for p= (policy) and pct= (percentage covered). A domain is counted as enforced if p=quarantine or p=reject with pct=100 (or pct absent, which defaults to 100).

6. Tier breakdown

Each domain is assigned a tier from its Tranco rank: top-1k, top-10k, top-100k, top-1M, or unranked if absent from the list at scan time.

7. Reproducibility

Every published report includes the exact OpenINTEL date, dictionary hashes, and counts of unmatched MX hosts and SPF includes — so any reader can verify or reproduce the figures. Raw OpenINTEL parquet is downloaded into a temporary cache and deleted after analysis; only aggregated, non-redistributable counts are kept here (per OpenINTEL data agreement).

8. Limitations to be aware of

• Tranco bias. Top-1M skews toward US/EU and global SaaS; ccTLD-only domains with low traffic may be under-represented.
• SPF flattening hides ESP identity (see §4).
• CNAME chains on MX (e.g. mail.example.com → mail.example.protection.outlook.com) are not unrolled — only the first MX target is matched. This biases a small share of domains toward "Unknown" when their MX is a CNAME to a known provider.
• Vanity MX with white-label provider (e.g. some Mimecast/Proofpoint customers use their own brand) is not detectable from DNS alone.