Observed MX, SPF and DMARC infrastructure for 664,010 domains of the Tranco top-1M, rebuilt daily from OpenINTEL measurements. Snapshot 2026-08-02.
Domain directory Providers Historical snapshots JSON API Run inbox placement test
What you're looking at. Headline numbers for the analysed Tranco
snapshot: how many domains publish each kind of email-related DNS record, and what share
of DMARC publishers actually enforce their policy (quarantine/reject).
Higher MX vs SPF gap = more domains receive mail than authorise sending; higher SPF vs
DMARC gap = SPF adopted but no policy/feedback enforcement yet.
rua= address and therefore receive no aggregate reports at all — and 114 799 of them (24.66% of all DMARC publishers) pair that with p=none, so the record enforces nothing and reports nowhere. #Each statement is recomputed daily from the full dataset and published under CC BY 4.0 — reuse it, cite "Live Direct Marketing, Email infrastructure of the Tranco top-1M" with a link. Machine-readable version: api/latest.json · llms.txt. Looking for one domain? Domain lookup — mailbox provider, ESPs and DMARC policy of any top-10k website.
Coverage is recomputed from every snapshot. MX vendor attribution excludes
self-hosted domains (22.76%); SPF coverage counts each
distinct include:/redirect= target once per domain. Fully classified
SPF stacks: 72.25% of domains
that delegate through at least one include.
Reading the long series: the vertical dashed line marks the change of the underlying list — OpenINTEL alexa (2016-01-22 … 2022-08-10, ~1.6 M measured names) and tranco (from 2022-08-11, ~1.1 M). Absolute counts across that line are not comparable: they describe different measured populations. Gaps in a line are real gaps — no interpolation is drawn. DMARC series start on 2022-08-11 because the alexa partitions contain no _dmarc queries at all; earlier points are empty, not zero. Snapshots flagged partial (an incomplete day at the source) are excluded from deltas and trends.
What this block shows. Where each domain hosts incoming mail —
derived from its primary MX record (lowest mx_preference). This is the
receiving side of email: Google Workspace, Microsoft 365, Zoho, on-prem Exchange, etc.
"Generic / unmatched" buckets are common mail.* / mx*.* hostnames
we couldn't attribute to a specific provider; "Unknown / Other" is everything else.
Note: Cloudflare Email Routing also appears in the ESP table below — that is the
same service observed through two different record types (MX here, SPF there), not a
double count of domains.
| # | Mailbox provider | Domains | Share of MX-having domains |
|---|---|---|---|
| 1 | Self-Hosted → | 151 148 | 22.76% |
| 2 | Google Workspace → | 144 769 | 21.80% |
| 3 | Microsoft 365 → | 112 488 | 16.94% |
| 4 | Unknown / Other → | 44 859 | 6.76% |
| 5 | Generic / unmatched (mx*.*) → | 16 982 | 2.56% |
| 6 | Proofpoint → | 12 861 | 1.94% |
| 7 | Generic / unmatched (mail.*) → | 11 752 | 1.77% |
| 8 | Yandex 360 → | 11 162 | 1.68% |
| 9 | Cloudflare Email Routing → | 10 956 | 1.65% |
| 10 | Mimecast → | 10 238 | 1.54% |
| # | Mailbox provider | Domains | Share of MX-having domains |
|---|---|---|---|
| 11 | Hostinger → | 7 547 | 1.14% |
| 12 | Zoho Mail → | 6 775 | 1.02% |
| 13 | Namecheap Email Forwarding → | 6 593 | 0.99% |
| 14 | QQ Mail (Tencent) → | 5 633 | 0.85% |
| 15 | GoDaddy → | 5 013 | 0.75% |
| 16 | OVH Mail → | 4 780 | 0.72% |
| 17 | Amazon WorkMail → | 4 658 | 0.70% |
| 18 | 1&1 IONOS → | 4 197 | 0.63% |
| 19 | Mail.ru for Business → | 3 636 | 0.55% |
| 20 | Barracuda → | 3 547 | 0.53% |
| 21 | Proofpoint Essentials → | 2 916 | 0.44% |
| 22 | Jellyfish (Namecheap) → | 2 664 | 0.40% |
| 23 | SpamExperts (SolarWinds) → | 2 661 | 0.40% |
| 24 | Cisco IronPort → | 2 605 | 0.39% |
| 25 | Beget (RU) → | 2 480 | 0.37% |
| 26 | Mailgun (inbound) → | 2 286 | 0.34% |
| 27 | Rackspace Email → | 2 237 | 0.34% |
| 28 | Alibaba Mail (China) → | 2 121 | 0.32% |
| 29 | Zoho Mail (EU) → | 1 816 | 0.27% |
| 30 | ProtonMail → | 1 728 | 0.26% |
Reading the long series: the vertical dashed line marks the change of the underlying list — OpenINTEL alexa (2016-01-22 … 2022-08-10, ~1.6 M measured names) and tranco (from 2022-08-11, ~1.1 M). Absolute counts across that line are not comparable: they describe different measured populations. Gaps in a line are real gaps — no interpolation is drawn. DMARC series start on 2022-08-11 because the alexa partitions contain no _dmarc queries at all; earlier points are empty, not zero. Snapshots flagged partial (an incomplete day at the source) are excluded from deltas and trends.
What this block shows. The slice of domains whose mailbox cannot be attributed to a named provider — regional hosters, self-built Postfix/Exim, corporate gateways, niche ESPs. Researchers ask for this specifically because it captures the deliverability reality outside the Google / Microsoft monoculture. The detailed report drills down into Top-1000 most common unmatched hosts, 100 hand-picked curiosities (longest one-off names) and a TLD breakdown.
The same metrics cut by list position. Enforcement is a function of how big the site is: the gradient from the top of the list to the tail is the finding, not the average. "Not in current list" = domains measured in this snapshot that are absent from today's Tranco file (list rotation).
| # | Tier | Domains with MX | SPF | DMARC enforced | Self-hosted |
|---|---|---|---|---|---|
| 1 | Tranco top-1k | 694 | 93.66% | 73.05% | 11.67% |
| 2 | top-1k … 10k | 6 513 | 92.89% | 56.53% | 14.28% |
| 3 | top-10k … 100k | 64 763 | 91.19% | 43.47% | 17.61% |
| 4 | top-100k … 1M | 474 637 | 89.93% | 30.07% | 22.73% |
| 5 | not in current list | 117 403 | 87.48% | 19.45% | 26.27% |
What this block shows. Outbound mass-mailing platforms each domain authorises in its SPF record — the marketing-automation, transactional-email and customer-engagement layer (SendGrid, Mailchimp, Mailgun, Klaviyo, HubSpot, Salesforce Marketing Cloud, etc.). One domain can use several ESPs, so percentages sum to more than 100% of SPF-publishing domains.
| # | ESP | Domains | Share of SPF-publishing domains |
|---|---|---|---|
| 1 | Amazon SES → | 38 958 | 6.20% |
| 2 | SendGrid (Twilio) → | 29 843 | 4.75% |
| 3 | Mailgun → | 25 738 | 4.10% |
| 4 | Zendesk → | 24 060 | 3.83% |
| 5 | Mailchimp → | 23 210 | 3.70% |
| 6 | Mandrill → | 21 089 | 3.36% |
| 7 | HubSpot → | 20 059 | 3.19% |
| 8 | Salesforce → | 16 520 | 2.63% |
| 9 | Mailjet (Sinch) → | 13 380 | 2.13% |
| 10 | Cloudflare Email Routing → | 11 564 | 1.84% |
| # | ESP | Domains | Share of SPF-publishing domains |
|---|---|---|---|
| 11 | Brevo (ex-Sendinblue) → | 9 110 | 1.45% |
| 12 | Mimecast → | 8 963 | 1.43% |
| 13 | MailerSend → | 8 102 | 1.29% |
| 14 | Namecheap Forwarding → | 6 878 | 1.10% |
| 15 | MailChannels → | 6 659 | 1.06% |
| 16 | Proofpoint → | 5 960 | 0.95% |
| 17 | Elastic Email → | 4 445 | 0.71% |
| 18 | Unisender (RU) → | 3 710 | 0.59% |
| 19 | Constant Contact → | 3 680 | 0.59% |
| 20 | Campaign Monitor → | 3 555 | 0.57% |
| 21 | Marketo (Adobe) → | 3 306 | 0.53% |
| 22 | Zoho Campaigns → | 3 261 | 0.52% |
| 23 | Emsd1 (transactional) → | 3 019 | 0.48% |
| 24 | Postmark → | 2 970 | 0.47% |
| 25 | SendPulse → | 2 908 | 0.46% |
| 26 | Exclaimer (signatures) → | 2 719 | 0.43% |
| 27 | Zoho ZeptoMail → | 2 670 | 0.43% |
| 28 | SparkPost → | 2 645 | 0.42% |
| 29 | Help Scout → | 2 306 | 0.37% |
| 30 | Salesforce Marketing Cloud → | 2 204 | 0.35% |
Reading the long series: the vertical dashed line marks the change of the underlying list — OpenINTEL alexa (2016-01-22 … 2022-08-10, ~1.6 M measured names) and tranco (from 2022-08-11, ~1.1 M). Absolute counts across that line are not comparable: they describe different measured populations. Gaps in a line are real gaps — no interpolation is drawn. DMARC series start on 2022-08-11 because the alexa partitions contain no _dmarc queries at all; earlier points are empty, not zero. Snapshots flagged partial (an incomplete day at the source) are excluded from deltas and trends.
What this block shows. SaaS apps that send mail FROM a
customer's domain on the customer's behalf — productivity, support, payments, HR,
e-commerce and other business apps appearing as include: targets in the
customer's SPF. Distinct from ESPs (mass-mailing platforms) and mailbox providers
(where the inbox lives).
| # | SaaS app | Domains | Share of SPF-publishing domains |
|---|---|---|---|
| 1 | Shopify → | 5 398 | 0.86% |
| 2 | Pardot (Salesforce) → | 4 968 | 0.79% |
| 3 | CodeTwo Email Signatures 365 → | 4 507 | 0.72% |
| 4 | KnowBe4 → | 3 551 | 0.57% |
| 5 | Statuspage (Atlassian) → | 2 098 | 0.33% |
| 6 | Trustpilot → | 1 892 | 0.30% |
| 7 | Firebase (Google) → | 1 840 | 0.29% |
| 8 | Atlassian (Jira/Confluence) → | 1 833 | 0.29% |
| 9 | BigCommerce → | 1 602 | 0.26% |
| 10 | Lark / Feishu → | 1 304 | 0.21% |
| # | SaaS app | Domains | Share of SPF-publishing domains |
|---|---|---|---|
| 11 | Sage Intacct → | 1 162 | 0.19% |
| 12 | NetSuite (Oracle) → | 1 140 | 0.18% |
| 13 | Qualtrics → | 1 104 | 0.18% |
| 14 | Oracle Cloud Email → | 1 085 | 0.17% |
| 15 | WordPress.com / WP Cloud → | 978 | 0.16% |
| 16 | SAP SuccessFactors → | 974 | 0.16% |
| 17 | Docebo (LMS) → | 939 | 0.15% |
| 18 | Oracle Cloud → | 850 | 0.14% |
| 19 | One.com (DK hosting) → | 803 | 0.13% |
| 20 | Zoho Books → | 714 | 0.11% |
| 21 | AFAS → | 674 | 0.11% |
| 22 | Greenhouse → | 629 | 0.10% |
| 23 | PayPal Braintree → | 582 | 0.09% |
| 24 | ClickDimensions → | 580 | 0.09% |
| 25 | UKG / UltiPro → | 555 | 0.09% |
| 26 | Autotask (ConnectWise) → | 480 | 0.08% |
| 27 | FormAssembly → | 465 | 0.07% |
| 28 | TOPdesk → | 458 | 0.07% |
| 29 | ConnectWise → | 447 | 0.07% |
| 30 | Freshservice (Freshworks) → | 437 | 0.07% |
Reading the long series: the vertical dashed line marks the change of the underlying list — OpenINTEL alexa (2016-01-22 … 2022-08-10, ~1.6 M measured names) and tranco (from 2022-08-11, ~1.1 M). Absolute counts across that line are not comparable: they describe different measured populations. Gaps in a line are real gaps — no interpolation is drawn. DMARC series start on 2022-08-11 because the alexa partitions contain no _dmarc queries at all; earlier points are empty, not zero. Snapshots flagged partial (an incomplete day at the source) are excluded from deltas and trends.
What this block shows. The policy each DMARC-publishing domain
advertises at _dmarc.<domain>: none = monitor only,
quarantine = mark as spam on fail, reject = drop on fail,
invalid = a syntactically broken record. "Enforced %" treats only
quarantine / reject with pct=100 as actually
enforcing.
Reading the long series: the vertical dashed line marks the change of the underlying list — OpenINTEL alexa (2016-01-22 … 2022-08-10, ~1.6 M measured names) and tranco (from 2022-08-11, ~1.1 M). Absolute counts across that line are not comparable: they describe different measured populations. Gaps in a line are real gaps — no interpolation is drawn. DMARC series start on 2022-08-11 because the alexa partitions contain no _dmarc queries at all; earlier points are empty, not zero. Snapshots flagged partial (an incomplete day at the source) are excluded from deltas and trends.
Reading the long series: the vertical dashed line marks the change of the underlying list — OpenINTEL alexa (2016-01-22 … 2022-08-10, ~1.6 M measured names) and tranco (from 2022-08-11, ~1.1 M). Absolute counts across that line are not comparable: they describe different measured populations. Gaps in a line are real gaps — no interpolation is drawn. DMARC series start on 2022-08-11 because the alexa partitions contain no _dmarc queries at all; earlier points are empty, not zero. Snapshots flagged partial (an incomplete day at the source) are excluded from deltas and trends.
A three-way split instead of the usual enforced/not-enforced binary.
Enforcing — p=quarantine or p=reject.
Monitoring — p=none with a working rua=
address: a legitimate rollout phase, someone is reading the reports.
Inert — p=none with no reporting address at all:
the record enforces nothing and reports nowhere.
Maturity split of 465 602 DMARC-publishing domains:
49.76% enforcing,
25.54% monitoring,
24.66% inert.
Under DMARCbis (RFC 9989/9990/9991) the pct= tag no longer exists, so the
same snapshot yields 49.76% enforcing
against 47.42% under RFC 7489 — both are published, the
RFC 7489 figure keeps the 2016 series continuous.
DMARCbis adoption is still marginal: 269 domains
(0.06%) publish np=,
69 publish psd=.
953 records carry a rua= tag that
parses to no usable address at all.
| # | DMARC reporting destination | Domains | Share of DMARC publishers |
|---|---|---|---|
| 1 | Self-hosted / Other | 216 565 | 46.51% |
| 2 | Cloudflare DMARC | 27 245 | 5.85% |
| 3 | Valimail | 14 443 | 3.10% |
| 4 | Proofpoint EFD | 12 776 | 2.74% |
| 5 | Brevo (ex-Sendinblue) | 12 344 | 2.65% |
| 6 | dmarcian | 10 207 | 2.19% |
| 7 | Postmark DMARC | 7 412 | 1.59% |
| 8 | DMARC Analyzer | 6 996 | 1.50% |
| 9 | DMARC Advisor | 3 198 | 0.69% |
| 10 | DMARC Digests | 2 911 | 0.63% |
| # | DMARC reporting destination | Domains | Share of DMARC publishers |
|---|---|---|---|
| 11 | PowerDMARC | 2 516 | 0.54% |
| 12 | Agari (Fortra) | 2 307 | 0.50% |
| 13 | URIports | 2 169 | 0.47% |
| 14 | DMARCLY | 1 985 | 0.43% |
| 15 | Barracuda | 1 567 | 0.34% |
| 16 | Google Workspace | 934 | 0.20% |
| 17 | EasyDMARC | 834 | 0.18% |
| 18 | MailHardener | 729 | 0.16% |
| 19 | Red Sift OnDMARC | 570 | 0.12% |
| 20 | Cisco Secure Email | 419 | 0.09% |
| 21 | Validity (Return Path) | 310 | 0.07% |
| 22 | Microsoft 365 | 296 | 0.06% |
| 23 | Netcraft | 289 | 0.06% |
| 24 | TDMARC | 225 | 0.05% |
| 25 | MXToolbox | 45 | 0.01% |
Which sending platforms sit on top of which inbound stack. Cell = domains whose primary MX belongs to that mailbox provider and whose SPF authorises that ESP; the percentage is of that provider's domains. A domain may use several ESPs, so rows do not sum to 100%.
| Mailbox provider | Amazon SES | SendGrid (Twilio) | Zendesk | Mailchimp | Mailgun | HubSpot | Mandrill | Salesforce | Cloudflare Email Routing | Mailjet (Sinch) |
|---|---|---|---|---|---|---|---|---|---|---|
| Self-Hosted | 2 721 1.80% | 1 472 0.97% | 772 0.51% | 1 412 0.93% | 1 571 1.04% | 401 0.27% | 1 172 0.78% | 384 0.25% | 106 0.07% | 1 249 0.83% |
| Google Workspace | 14 638 10.11% | 11 765 8.13% | 11 209 7.74% | 9 233 6.38% | 9 779 6.75% | 9 764 6.74% | 8 548 5.90% | 4 307 2.98% | 325 0.22% | 3 519 2.43% |
| Microsoft 365 | 9 761 8.68% | 9 362 8.32% | 7 015 6.24% | 7 497 6.66% | 6 391 5.68% | 6 555 5.83% | 6 650 5.91% | 7 216 6.41% | 46 0.04% | 4 201 3.73% |
| Proofpoint | 846 6.58% | 685 5.33% | 735 5.71% | 469 3.65% | 337 2.62% | 467 3.63% | 500 3.89% | 1 112 8.65% | 1 0.01% | 249 1.94% |
| Yandex 360 | 162 1.45% | 40 0.36% | 29 0.26% | 73 0.65% | 208 1.86% | 2 0.02% | 73 0.65% | 1 0.01% | 8 0.07% | 28 0.25% |
| Cloudflare Email Routing | 221 2.02% | 77 0.70% | 73 0.67% | 30 0.27% | 134 1.22% | 13 0.12% | 18 0.16% | 6 0.05% | 10 724 97.88% | 99 0.90% |
| Mimecast | 1 028 10.04% | 1 068 10.43% | 795 7.77% | 706 6.90% | 547 5.34% | 832 8.13% | 658 6.43% | 1 201 11.73% | 0 0.00% | 201 1.96% |
| Hostinger | 38 0.50% | 39 0.52% | 9 0.12% | 6 0.08% | 41 0.54% | 3 0.04% | 6 0.08% | 0 0.00% | 8 0.11% | 26 0.34% |
| Zoho Mail | 390 5.76% | 178 2.63% | 93 1.37% | 122 1.80% | 305 4.50% | 19 0.28% | 103 1.52% | 4 0.06% | 42 0.62% | 104 1.54% |
| Namecheap Email Forwarding | 14 0.21% | 10 0.15% | 5 0.08% | 2 0.03% | 20 0.30% | 0 0.00% | 7 0.11% | 0 0.00% | 3 0.05% | 9 0.14% |
The literal record string copied verbatim from DNS — useful to spot copy-pasted
"starter" policies and identify reporting endpoints (the rua= /
ruf= tags) shared across many domains.
| # | DMARC record | Domains |
|---|---|---|
| 1 | v=DMARC1; p=none; | 57 787 |
| 2 | v=DMARC1; p=none | 32 297 |
| 3 | v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com | 9 001 |
| 4 | v=DMARC1; p=quarantine; | 5 048 |
| 5 | v=DMARC1; p=quarantine | 4 039 |
| 6 | v=DMARC1; p=reject; | 3 902 |
| 7 | v=DMARC1;p=none; | 3 758 |
| 8 | v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net; | 3 497 |
| 9 | v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com | 3 179 |
| 10 | v=DMARC1; p=quarantine; adkim=s; aspf=s | 3 014 |
| 11 | v=DMARC1; p=reject | 2 898 |
| 12 | v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc.report@axa.com; | 2 544 |
| 13 | v=DMARC1; p=none; aspf=r; adkim=r; | 2 366 |
| 14 | v=DMARC1; p=quarantine; pct=100 | 2 340 |
| 15 | v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; | 2 149 |
| 16 | v=DMARC1; p=none; sp=none; rua=mailto:dmarc@mailinblue.com!10m; ruf=mailto:dmarc@mailinblue.com!10m; rf=afrf; pct=100; ri=86400 | 2 087 |
| 17 | v=DMARC1;p=none | 1 787 |
| 18 | v=DMARC1; p=none; aspf=r; sp=none | 1 780 |
| 19 | v=DMARC1; p=none; adkim=r; aspf=r; | 1 517 |
| 20 | v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; | 1 500 |
| 21 | v=DMARC1;p=reject; | 1 286 |
| 22 | v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email | 1 269 |
| 23 | v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email | 1 269 |
| 24 | v=DMARC1;p=quarantine;pct=100;fo=1 | 1 257 |
| 25 | v=DMARC1;p=none;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400 | 1 222 |
| # | DMARC record | Domains |
|---|---|---|
| 26 | v=DMARC1; p=none; sp=none | 1 042 |
| 27 | v=DMARC1; p=none; sp=none; | 1 018 |
| 28 | v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email; | 968 |
| 29 | v=DMARC1; p=reject; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net; | 949 |
| 30 | v=DMARC1; p=reject; rua=mailto:report@dmarc.amazon.com; ruf=mailto:report@dmarc.amazon.com | 896 |
| 31 | v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:ewai10d2@ag.eu.dmarcian.com; ruf=mailto:ewai10d2@fr.eu.dmarcian.com | 893 |
| 32 | v=DMARC1; p=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com | 884 |
| 33 | v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s | 824 |
| 34 | v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email | 760 |
| 35 | v=DMARC1; p=none; pct=100 | 740 |
| 36 | v=DMARC1; p=reject; pct=100 | 734 |
| 37 | v=DMARC1; p=quarantine; fo=1; ruf=mailto:dmarc@qiye.163.com; rua=mailto:dmarc_report@qiye.163.com | 726 |
| 38 | v=DMARC1;p=quarantine;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400 | 690 |
| 39 | v=DMARC1; p=none; fo=1; ruf=mailto:dmarc@qiye.163.com; rua=mailto:dmarc_report@qiye.163.com | 668 |
| 40 | v=DMARC1; p=reject; rua=mailto:dmarc_rua@onsecureserver.net; adkim=r; aspf=r; | 652 |
| 41 | v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com | 614 |
| 42 | v=DMARC1; p=quarantine; pct=100; | 553 |
| 43 | v=DMARC1; p=none; sp=none; rf=afrf; pct=100; ri=86400 | 553 |
| 44 | v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email; | 526 |
| 45 | v=DMARC1;p=quarantine | 525 |
| 46 | v=DMARC1; p=none; rua=mailto:mailauth-reports@qq.com | 520 |
| 47 | v=DMARC1; p=reject; pct=100; | 466 |
| 48 | v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email; | 450 |
| 49 | v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s | 449 |
| 50 | v=DMARC1; p=none; adkim=r; aspf=r | 388 |
| 51 | v=DMARC1; p=none; sp=none; adkim=r; aspf=r | 385 |
| 52 | v=DMARC1; p=none; pct=100; | 362 |
| 53 | v=DMARC1; p=reject; adkim=s; aspf=s; | 356 |
| 54 | v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1 | 351 |
| 55 | v=DMARC1; p=reject; adkim=s; aspf=s | 331 |
| 56 | v=DMARC1;p=reject | 325 |
| 57 | v=DMARC1 | 321 |
| 58 | v=DMARC1;p=reject;fo=1;rua=mailto:dmarc_rua@emaildefense.proofpoint.com;ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com | 318 |
| 59 | v=DMARC1;p=quarantine; | 312 |
| 60 | v=DMARC1; p=reject; sp=none; rf=afrf; pct=100; ri=86400 | 311 |
| 61 | v=DMARC1; p=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; | 308 |
| 62 | v=DMARC1; p=none; fo=1 | 301 |
| 63 | v=DMARC1; p=none; aspf=r; adkim=r | 299 |
| 64 | v=DMARC1; p=none; rua=mailto:dmarc@smtp.mailtrap.live; ruf=mailto:dmarc@smtp.mailtrap.live; rf=afrf; pct=100 | 293 |
| 65 | v=DMARC1; p=reject; rua=mailto:tnoff9hr@ag.eu.dmarcadvisor.com; aspf=s; adkim=s; | 277 |
| 66 | v=DMARC1; p=reject; sp=reject; pct=100; fo=1; ri=3600; rua=mailto:dmarcrecord@gmail.com; ruf=mailto:dmarcrecord@gmail.com; | 276 |
| 67 | v=DMARC1;p=none;sp=none;pct=50;adkim=r;aspf=r; | 272 |
| 68 | v=DMARC1; p=none; rua=mailto:mailauth-reports@google.com | 270 |
| 69 | v=DMARC1;p=reject;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400 | 263 |
| 70 | v=DMARC1; p=reject; rua=mailto:zsrbf6su@ag.eu.dmarcadvisor.com; | 262 |
| 71 | v=DMARC1;p=none;pct=100 | 262 |
| 72 | v=DMARC1; p=quarantine; rua=mailto:rua@dmarc.brevo.com | 255 |
| 73 | v=DMARC1;p=none;rua=mailto:dmarc_report@service.aliyun.com | 251 |
| 74 | v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;fo=1 | 250 |
| 75 | v=DMARC1; p=quarantine; adkim=s; aspf=s; | 235 |
| 76 | v=DMARC1; p=none; rua=mailto:rua-mpse@mpub.ne.jp | 230 |
| 77 | v=DMARC1; p=quarantine; adkim=r; aspf=r | 229 |
| 78 | v=DMARC1; p=reject; rua=mailto:2ynhg3yt@ag.dmarcian.com | 207 |
| 79 | v=DMARC1; p=reject; rua=mailto:zicaptxt@ag.dmarcian.com; | 205 |
| 80 | v=DMARC1; p=none; rua=mailto:dmarc.rua@edrone.app; ruf=mailto:dmarc.ruf@edrone.app | 204 |
| 81 | v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com | 203 |
| 82 | v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com | 202 |
| 83 | v=DMARC1; p=none; rua=mailto:dmarc@reporting.unisender.com | 201 |
| 84 | v=DMARC1; p=none; sp=none; rua=mailto:dmarc-raports@dhosting.pl | 198 |
| 85 | v=DMARC1; p=reject; rua=mailto:dmarc_rua@onsecureserver.net; | 197 |
| 86 | v=DMARC1; p=reject; sp=reject | 189 |
| 87 | v=DMARC1;p=none;rua=mailto:rua@dmarc.brevo.com | 188 |
| 88 | v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r | 185 |
| 89 | v=DMARC1; p=quarantine; pct=100; rua=mailto:61e7fc8674b33@ag.eu.dmarcly.com; ruf=mailto:61e7fc8674b33@fo.eu.dmarcly.com; sp=quarantine; fo=1; | 185 |
| 90 | v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; | 183 |
| 91 | v=DMARC1;p=reject;pct=100; | 182 |
| 92 | v=DMARC1; p=none; pct=100; rua=mailto:dmarc@fbl.optin.com; | 180 |
| 93 | v=DMARC1; p=reject; rua=mailto:dmarc.report@axa.com; | 173 |
| 94 | v=DMARC1;p=none;pct=100;aspf=r;adkim=r; | 173 |
| 95 | v=DMARC1;p=none;sp=none;adkim=r;aspf=r;pct=100 | 172 |
| 96 | v=DMARC1; p=quarantine; fo=1 | 172 |
| 97 | v=DMARC1; p=reject; sp=reject; | 167 |
| 98 | v=DMARC1; p=quarantine; sp=quarantine | 166 |
| 99 | v=DMARC1; p=quarantine; adkim=r; aspf=r; | 166 |
| 100 | v=DMARC1; p=reject; pct=100; adkim=s; aspf=s | 163 |
What this block shows. The most popular MX hostnames our dictionary
does not yet attribute to a named mailbox provider. Public list — these feed
back into dictionaries/mx_providers.py for the next iteration so coverage
keeps improving.
| # | MX target | Domains |
|---|---|---|
| 1 | mx.services | 296 |
| 2 | localhost | 278 |
| 3 | 243 | |
| 4 | zonemx.eu | 190 |
| 5 | mail.parktons.com | 179 |
| 6 | mail1.sbnation.com | 168 |
| 7 | mail.autoline.com.ua | 148 |
| 8 | mx2.z-ns.net | 147 |
| 9 | mail2.recop.jp | 141 |
| 10 | mx.email-messaging.com | 140 |
| 11 | mx1.ticketsinbound.com | 132 |
| 12 | mx2.ticketsinbound.com | 127 |
| 13 | lbmx.bcc.gov.bd | 126 |
| 14 | mxi.alpha-prm.jp | 125 |
| 15 | alltheemails.com | 118 |
| 16 | mx1d10.thinline.cz | 110 |
| 17 | mx1b20.thinline.cz | 110 |
| 18 | cloudmail.auto-vision.ru | 99 |
| 19 | s.mail.dcsaas.net | 91 |
| 20 | mx.maxns.net | 87 |
| 21 | mail.pickelhost.com | 86 |
| 22 | mailforward.dnsv.jp | 86 |
| 23 | amazon-smtp.amazon.com | 85 |
| 24 | mx-backup.serveriai.lt | 85 |
| 25 | mx1-dk.centerasecurity.dk | 82 |
| # | MX target | Domains |
|---|---|---|
| 26 | mx2-dk.centerasecurity.dk | 82 |
| 27 | ~ | 78 |
| 28 | mx-01.mail-forwarder.io | 77 |
| 29 | mx.vshosting.eu | 77 |
| 30 | mx1.netim.net | 76 |
| 31 | mx2.netim.net | 76 |
| 32 | mx3-dk.centerasecurity.dk | 76 |
| 33 | mail-fr.securemail.pro | 76 |
| 34 | mail.global.frontbridge.com | 75 |
| 35 | mx-02.mail-forwarder.io | 75 |
| 36 | mail.vipmailservice.com | 74 |
| 37 | mx.aams4.jp | 71 |
| 38 | mx.sendcloud.org | 70 |
| 39 | q01es.mail.s-web.de | 70 |
| 40 | q02es.mail.s-web.de | 70 |
| 41 | r01es.mail.s-web.de | 70 |
| 42 | r02es.mail.s-web.de | 70 |
| 43 | email.webglobe.cz | 69 |
| 44 | email2.webglobe.cz | 69 |
| 45 | gmail22.gadmail.de | 69 |
| 46 | gmail23.gadmail.de | 69 |
| 47 | wmail22.gadmail.de | 69 |
| 48 | mx6.kvnbw.de | 69 |
| 49 | mx7.kvnbw.de | 69 |
| 50 | mx8.kvnbw.de | 69 |
| 51 | mx9.kvnbw.de | 69 |
| 52 | mx-0.aams4.jp | 68 |
| 53 | mx-1.aams4.jp | 68 |
| 54 | mxa.expediagroup.com | 68 |
| 55 | mxb.expediagroup.com | 68 |
| 56 | email3.webglobe.cz | 68 |
| 57 | email4.webglobe.cz | 68 |
| 58 | wmail23.gadmail.de | 68 |
| 59 | void.blackhole.mx | 67 |
| 60 | mx1.email-cluster.com | 67 |
| 61 | mx2.email-cluster.com | 67 |
| 62 | townsites.dnsmaster.net | 66 |
| 63 | antispam.korea.kr | 66 |
| 64 | smtp-avas.seeweb.it | 65 |
| 65 | rmail22.gadmail.de | 65 |
| 66 | rmail23.gadmail.de | 65 |
| 67 | mx.spamfilter.io | 64 |
| 68 | mx1.daouoffice.com | 64 |
| 69 | failover1.email-cluster.com | 64 |
| 70 | omail22.gadmail.de | 64 |
| 71 | omail23.gadmail.de | 64 |
| 72 | mx01.statens-it.dk | 63 |
| 73 | mx02.statens-it.dk | 63 |
| 74 | mx03.statens-it.dk | 63 |
| 75 | mx04.statens-it.dk | 63 |
| 76 | mx05.statens-it.dk | 63 |
| 77 | mx06.statens-it.dk | 63 |
| 78 | mx07.statens-it.dk | 63 |
| 79 | mx08.statens-it.dk | 63 |
| 80 | mx4.emailowl.com | 62 |
| 81 | mx1.nepal.gov.np | 62 |
| 82 | mx5.emailowl.com | 61 |
| 83 | mx2.nepal.gov.np | 61 |
| 84 | mx1.oderland.com | 60 |
| 85 | mx2.oderland.com | 60 |
| 86 | mx6.emailowl.com | 60 |
| 87 | mail.mpcloud.net | 60 |
| 88 | smtp.faisco.cn | 59 |
| 89 | d01es.mail.s-web.de | 59 |
| 90 | d02es.mail.s-web.de | 59 |
| 91 | e01es.mail.s-web.de | 59 |
| 92 | e02es.mail.s-web.de | 59 |
| 93 | posta.mediacenter.hu | 58 |
| 94 | posta2.mediacenter.hu | 58 |
| 95 | posta4.mediacenter.hu | 58 |
| 96 | posta5.mediacenter.hu | 58 |
| 97 | mx1.simplelogin.co | 58 |
| 98 | mx2.simplelogin.co | 58 |
| 99 | mx.mymailwall.com | 58 |
| 100 | posta3.mediacenter.hu | 57 |
What this block shows. The most popular SPF include:
targets that don't match any known ESP, mailbox-as-sender, or SaaS pattern yet. Same
feedback loop: top hits get added to dictionaries/esps.py or
dictionaries/saas_senders.py.
| # | SPF include | Domains |
|---|---|---|
| 1 | _spf1-aws.recop.jp | 142 |
| 2 | yunyou.top | 141 |
| 3 | _spf.edhost.eu | 123 |
| 4 | spf.pitcom.net | 114 |
| 5 | spf.mailii.org | 111 |
| 6 | spf.w4ymail.at | 111 |
| 7 | _spf.exsilia.net | 111 |
| 8 | mlrcloud.com | 109 |
| 9 | _spf.mail-neoserv.si | 108 |
| 10 | _spf.lh.pl | 105 |
| 11 | _spf.armada.it | 105 |
| 12 | _spf.abcp.ru | 105 |
| 13 | spf.spcloud.jp | 104 |
| 14 | gateways.firstdata.com | 104 |
| 15 | spf-2248456.jmsend.com | 103 |
| 16 | spf.v6send.net | 103 |
| 17 | spf.mailcamp.nl | 103 |
| 18 | spf.cesky-hosting.cz | 102 |
| 19 | spf.mijndomeinhosting.nl | 101 |
| 20 | _spf.wpopt.net | 101 |
| 21 | spf.betrend.com | 101 |
| 22 | spf.boldem.cz | 100 |
| 23 | fmx.etius.jp | 100 |
| 24 | spf.ssmx.net | 99 |
| 25 | dospf.simplepart.com | 99 |
| # | SPF include | Domains |
|---|---|---|
| 26 | spf.satorimail.net | 99 |
| 27 | _spf.tld-mx.com | 98 |
| 28 | relay.thundermail.uk | 98 |
| 29 | relay.guzelhosting.com | 98 |
| 30 | amazon.com | 98 |
| 31 | _spf.simpleviewinc.com | 97 |
| 32 | _pmta2.antevenio.com | 97 |
| 33 | _spf.localservices.com.br | 97 |
| 34 | _spf.presscloud.com | 96 |
| 35 | _spf.octadesk.com | 96 |
| 36 | verifymyfafsa.com | 96 |
| 37 | _spf.academicworks.com | 96 |
| 38 | spf.protection.outlook | 95 |
| 39 | _spf.sendnode.com | 95 |
| 40 | send.k-crm.jp | 95 |
| 41 | smtp-cluster.plusvps.com | 95 |
| 42 | spf.aams4.jp | 95 |
| 43 | spf.symplicity.com | 94 |
| 44 | mfg.siteprotect.com | 93 |
| 45 | _spf01.mykronos.com | 93 |
| 46 | ofsys.com | 91 |
| 47 | mailing.eqs.com | 91 |
| 48 | spf.sosafe.de | 90 |
| 49 | mailii.org | 90 |
| 50 | spf.emailfilter.io | 90 |
| 51 | spf.form.run | 90 |
| 52 | _spf.aid.no | 90 |
| 53 | spf.qb-feedback.com | 89 |
| 54 | spfref.jackhenry.com | 89 |
| 55 | _spf.yourfilter.nl | 88 |
| 56 | _spf.axa.com | 88 |
| 57 | spf.chinaemail.cn | 88 |
| 58 | spf.qboxmail.com | 88 |
| 59 | eversrv.com | 87 |
| 60 | spf.redpoints.com | 87 |
| 61 | sender.zcsend.jp | 87 |
| 62 | spf.263xmail.com | 87 |
| 63 | spf.host-ww.net | 86 |
| 64 | spf | 86 |
| 65 | mailmailmail.net | 86 |
| 66 | spf-us.appmail.granicusgovaccess.net | 86 |
| 67 | ciphr247.com | 86 |
| 68 | spf.esvacloud.com | 86 |
| 69 | _spf.sent2email.com | 86 |
| 70 | spf2.nlk2.smtps.jp | 86 |
| 71 | spf.w2solution.com | 86 |
| 72 | _spf.eemsg.mail.mil | 86 |
| 73 | custmail.vdata.com | 85 |
| 74 | _spf.herodesk-mails.io | 84 |
| 75 | spf.shopserve.jp | 84 |
| 76 | mail.imismailcenter.com | 83 |
| 77 | _spf.shared-server.net | 83 |
| 78 | spf-bulk.axa.com | 82 |
| 79 | spf.filteredmx.net | 82 |
| 80 | spf.zoner.fi | 82 |
| 81 | spf.rpost.net | 82 |
| 82 | _spf.firmstep.com | 81 |
| 83 | no-ip.com | 81 |
| 84 | senders.mailmasterplus.net | 81 |
| 85 | relay.email-cluster.com | 80 |
| 86 | _spf.saashr.com | 80 |
| 87 | spf.sabre.com | 80 |
| 88 | universalspf.org | 80 |
| 89 | x.universalspf.org | 80 |
| 90 | spf.mlwrx.com | 79 |
| 91 | _spf.goskope.com | 79 |
| 92 | email.nimbleams.com | 79 |
| 93 | support.gov.sg | 79 |
| 94 | spf.protect.kvnbw.de | 78 |
| 95 | eur.pb-dynmktge.com | 78 |
| 96 | system.spektrix.com | 78 |
| 97 | _spf.zorgmail.nl | 78 |
| 98 | successfactors.eu | 78 |
| 99 | _spf.postaffiliatepro.com | 78 |
| 100 | spf.icontroller.eu | 77 |
The dataset is the daily OpenINTEL forward-DNS Tranco snapshot
(University of Twente / SURFnet / SIDN Labs). OpenINTEL queries the entire
Tranco top-1M domain list
daily for MX, TXT, NS, A, AAAA, SOA, CAA, DNSSEC and other records, publishing the
results as Apache Parquet. For pre-2022 history we additionally use OpenINTEL's
alexa source (the legacy Alexa top-1M list, retired 2023).
Cite: Roland van Rijswijk-Deij et al., "A High-Performance, Scalable Infrastructure for Large-Scale Active DNS Measurements", IEEE JSAC 2016.
Six deep-dive pages are rebuilt by the same daily run and were previously
reachable only through the sitemap:
SPF health (final all qualifier, DNS-lookup
limit, record length) ·
Email security posture (MTA-STS, BIMI, TLS-RPT, DKIM
selectors) ·
SaaS via verification tokens ·
DNS/NS providers ·
Country × ESP ·
Infrastructure & TLS.
Each report covers a single date — OpenINTEL publishes snapshot D on D+1, so the current UTC date is never treated as an expected snapshot. Freshness means matching the latest date actually present in the OpenINTEL catalogue, typically ~700 k domains with MX records and ~620 k with SPF. The pipeline runs daily at 03:00 UTC, after the usual source-publication window; each daily run produces an HTML report, a JSON summary, an updated time-series, and incremental updates to the domain registry (§ 12). No sub-sampling.
For each domain we read its MX RRset and pick the record with the lowest
mx_preference as the primary mailbox host. The hostname of that
primary MX is matched against an open regex dictionary (dictionaries/mx_providers.py,
currently 328 patterns, hash below). Specific patterns (e.g. .mail.protection.outlook.com)
are tried first; generic fallbacks (mail.*, mx*.*) only after.
Domains whose MX matches no rule are kept as "Unknown / Other" — never dropped — and
exported in Unmatched MX targets for dictionary improvement.
For each domain's apex SPF record (TXT starting with v=spf1) we extract every
include: and redirect= target and resolve them against open classification dictionaries (ESPs, mailbox-as-sender, anti-spam gateways, forwarders, SaaS senders, DMARC vendors, NS providers, verification tokens).
Resolution order: PURE_ESP → MAILBOX_AS_SENDER → GATEWAYS → FORWARDERS → bare-apex
substring fallback → SAAS_SENDERS substring iteration. Bare-apex derivation strips
leading _spf., _spf-eu., spf., mail.
prefixes from dict keys to catch subdomain variants
(e.g. _spf.m1.websupport.sk → matches websupport.sk).
Malformed includes (no dot, <4 chars) are filtered.
One domain may use several ESPs simultaneously, so ESP shares sum to more than 100% of SPF-publishing domains. Current SPF-include target coverage: 82.64%, recomputed from this snapshot rather than hard-coded.
Limitation: "flattened" SPF (where include chains were replaced with raw IP ranges to fit the 10-lookup limit) is not detectable from DNS alone — those domains appear ESP-less even when an ESP is in fact used.
For each domain we query the _dmarc.<domain> TXT record. Records
starting with v=DMARC1 are parsed for:
p= (apex policy): none / quarantine / reject / invalidsp= (subdomain policy)pct= (rollout percentage)rua= aggregate-report destinations → classified into vendor buckets
(Postmark DMARC, Valimail, dmarcian, URIports, EasyDMARC, Red Sift,
Proofpoint EFD, Agari/Fortra, …) using dictionaries/dmarc_vendors.pyA domain is counted as enforced if p=quarantine or
p=reject with pct=100 (or pct absent — defaults to
100).
For every SPF record we additionally extract:
all mechanism:
-all (hard fail), ~all (soft fail), ?all
(neutral), +all (pass-everything — broken / dangerous), or missinginclude:, redirect=,
a:, mx:, exists:, ptr:) — each
mechanism counts as 1 against the spec limit of 10. Records exceeding the limit
return PermErr at recipientsAdoption of modern mail-security TXT records, parsed from the same OpenINTEL parquet:
_mta-sts.<domain> with
v=STSv1 — domain advertises required-TLS to its MXdefault._bimi.<domain> with
v=BIMI1 — brand publishes a verified logo (requires
p=reject)_smtp._tls.<domain>
with v=TLSRPTv1 — domain monitors TLS-failure reports*._domainkey.<domain> queries, well-known selectors
(google, selector1/2, s1/s2, k1/k2/k3,
mailo, mte1, …) are mapped to issuing ESPsFor each domain's NS RRset, every NS hostname is matched against a suffix dictionary
(dictionaries/ns_providers.py) with patterns for Cloudflare, AWS Route 53,
Azure DNS, Google Cloud DNS, GoDaddy, Akamai, NS1, UltraDNS, Yandex, DNSPod,
Aliyun, OVH, Hetzner, Gandi, registrars, and others. A domain is assigned to its
dominant NS provider; ties resolve to whichever pattern was matched first.
Many SaaS apps a domain is connected to never appear in SPF (because the SaaS doesn't
send mail FROM the customer domain). To recover this signal we parse apex TXT records for
verification tokens — google-site-verification=…, MS=…,
atlassian-domain-verification=…, stripe-verification=…, plus
149 other patterns in
dictionaries/verification_tokens.py. This produces a
complementary "SaaS density" metric and surfaces apps that the SPF-only view misses.
Three additional TLS / IPv6 metrics:
_25._tcp.<mx_host>
(where the parquet includes TLSA queries)0 issue … / 0 issuewild … record
at apex; CAs aggregated into a market-share view (Let's Encrypt, DigiCert,
Sectigo, …)Every domain ever observed across snapshots is assigned a stable integer ID
in /var/openintel-cache/registry/domains.sqlite3 (currently
1 882 932 domains). Reports reference domains by ID rather than embedding
strings; clients resolve names from a single gzipped registry dump
(/email-stats/domains.csv.gz, 21.3 MB). This keeps per-report payloads
compact, enables fast set-operation diffs across snapshots, and gives every domain a
first-seen / last-seen timestamp.
Each daily run computes a domain-level diff vs the previous scan and emits a
change-feed at /email-stats/alerts.html (also as JSON + Atom). Detected
events: ESP added/removed in SPF, DMARC policy upgrade/downgrade, primary-mailbox-provider
change, SPF strict→soft regression, MTA-STS / BIMI first publication. Severity tag is
good / bad / info.
The top-100 ESPs, top-100 SaaS senders and top-80 mailbox providers each have a dedicated
detail page at /email-stats/detail/<kind>/<slug>.html showing KPI
cards, a Chart.js sparkline (from history.json), TLD distribution and a
sample of customer domains.
Each domain is assigned a tier from its Tranco rank: top-1k / top-10k / top-100k / top-1M, plus unranked for domains measured in the snapshot but absent from the current list file (rotation). Published as Authentication by Tranco tier: SPF, DMARC enforcement and self-hosting per tier.
Dictionary hashes for this run (sha256, first 12 hex):
compliance.py — 76d502287abedmarc_vendors.py — 8c195eb564fcesps.py — 0f7a40a1f7d3mx_providers.py — c29c6e1b1f58ns_providers.py — cc4f43c6651fproviders_meta.py — 5dc92db7869fsaas_meta.py — fe611e6e8a68saas_senders.py — 1c5ebd9f7c09tld_regions.py — 61e8bd3dcca8verification_tokens.py — 6ba8313e55abEvery published report includes the exact OpenINTEL date, dictionary file hashes, and counts of unmatched MX hosts and SPF includes — so any reader can verify or reproduce the figures. Raw OpenINTEL parquet is downloaded into a temporary cache and deleted after analysis; only aggregated, non-redistributable counts are kept long-term (per OpenINTEL data agreement). The domain registry stores names but no record-level content.
Every change to a metric definition is recorded in
the methodology changelog and stamped into each
history point as methodology_version — so a step in a series can
always be attributed to a formula change rather than to reality.
mail.example.com →
mail.example.protection.outlook.com) are not unrolled — only the first MX target
is matched. This biases a small share of domains toward "Unknown" when their MX is a
CNAME to a known provider.Spotted a mis-classified MX target, missed ESP, or want to discuss a finding? We publish corrections in the next daily snapshot.
Send feedback to support@live-direct-marketing.onlineInline comments coming soon. For now, email is the fastest path — you'll see your fix reflected in tomorrow's run.
Daily snapshots — last 90 days kept fully, older ones thinned to one point per month. Points marked partial are incomplete days at the source and are excluded from deltas and trends.