Live Direct Marketing logo
Inbox Placement Test
by Live Direct Marketing

What the current snapshot tells us

Three observations from Live Direct Marketing's analysis of the OpenINTEL Tranco snapshot on . These describe this measured population, not every domain on the Internet.

Two providers, a shared dependency

38.62%

of MX-publishing domains are attributed to Google Workspace or Microsoft 365 by their primary MX. This is the receiving side of email.

Compare mailbox providers →

Policy needs a feedback loop

36.05%

of DMARC publishers have no usable aggregate-reporting address in the parsed record. Explore the difference between publication, monitoring and enforcement.

Read the DMARC breakdown →

The long tail still matters

22.47%

of MX-publishing domains fall in the Self-Hosted classification. See how hostname rules distinguish named providers from the long tail.

Understand the long tail →

Go from a number to an explanation

Read the research behind the metrics, then follow the data into a provider, a policy or a domain.

01 / Mailbox market

Where does the Internet receive its email?

Named providers, regional hosting and the long tail. Understand what a primary MX record can tell us.

Read the mailbox provider study →
02 / Email authentication

A DMARC record is only the beginning.

Separate publishing a policy from requesting enforcement, and see why reporting addresses matter.

Read the DMARC adoption study →
03 / Company changes

What changed in a company's email stack?

Follow observed changes in MX, SPF and DMARC. A DNS change prompts investigation; it does not establish buying intent.

Understand the change signals →
Research by Artem Berezin · Live Direct Marketing
Source: OpenINTEL measurements · Methodology and limitations · Corrections
{inline_publications()}
For analysts, developers and agents

Use the data in your own work.

Current aggregates, historical snapshots, domain records and a public MCP endpoint. Bring the observation date, source and limitations along with every number.

CC BY 4.0 · Cite and reuse · Browse historical snapshots

Explore the full report

The complete snapshot, with accessible tables, interactive charts and definitions. Browse the domain directory or use the report sections below.

672 143
Domains with MX
634 905
Domains with SPF
474 431
Domains with DMARC
46.84%
DMARC enforced · among DMARC publishers

What you're looking at. Headline numbers for the analysed Tranco snapshot: how many domains publish each kind of email-related DNS record, and what share of DMARC publishers actually enforce their policy (quarantine/reject). Higher MX vs SPF gap = more domains receive mail than authorise sending; higher SPF vs DMARC gap = SPF adopted but no policy/feedback enforcement yet.

Classification coverage — what the dictionaries explain

66.23%
MX attributed to a vendor
11.30%
MX unresolved / generic
82.31%
SPF include targets classified
82 667
Unique unknown SPF targets

Coverage is recomputed from every snapshot. MX vendor attribution excludes self-hosted domains (22.47%); SPF coverage counts each distinct include:/redirect= target once per domain. Fully classified SPF stacks: 71.94% of domains that delegate through at least one include.

Trend — last 30 day(s) · KPIs

Top mailbox providers

What this block shows. Where each domain hosts incoming mail — derived from its primary MX record (lowest mx_preference). This is the receiving side of email: Google Workspace, Microsoft 365, Zoho, on-prem Exchange, etc. "Generic / unmatched" buckets are common mail.* / mx*.* hostnames we couldn't attribute to a specific provider; "Unknown / Other" is everything else. Note: Cloudflare Email Routing also appears in the ESP table below — that is the same service observed through two different record types (MX here, SPF there), not a double count of domains.

#Mailbox providerDomainsShare of MX-having domains
1Self-Hosted →151 05922.47%
2Google Workspace →145 37921.63%
3Microsoft 365 →114 20516.99%
4Unknown / Other →44 7066.65%
5Generic / unmatched (mx*.*) →17 1092.55%
6Generic / unmatched (mail.*) →13 0971.95%
7Proofpoint →12 5231.86%
8Cloudflare Email Routing →11 7961.75%
9Yandex 360 →10 9151.62%
10Mimecast →9 8211.46%
Show rows 11 – 30
#Mailbox providerDomainsShare of MX-having domains
11Hostinger →8 1671.22%
12Namecheap Email Forwarding →7 0891.05%
13Zoho Mail →6 9861.04%
14QQ Mail (Tencent) →5 5540.83%
15GoDaddy →5 2340.78%
16OVH Mail →5 1090.76%
17Amazon SES (inbound) →4 5720.68%
181&1 IONOS →4 5640.68%
19Mail.ru for Business →3 5790.53%
20Barracuda →3 4170.51%
21Proofpoint Essentials →2 8750.43%
22Jellyfish (Namecheap) →2 6830.40%
23SpamExperts (SolarWinds) →2 6400.39%
24Beget (RU) →2 5620.38%
25Cisco IronPort →2 5170.37%
26Mailgun (inbound) →2 1560.32%
27Rackspace Email →2 1350.32%
28Timeweb (RU) →1 9860.30%
29Alibaba Mail (China) →1 9840.30%
30Zoho Mail (EU) →1 9180.29%
🏠 Open Providers portfolio → cards with country, blurb, sparkline & TLD breakdown — click any provider name above to drill into a detail page

Trend — last 30 day(s) · Top mailbox providers

Long-tail / Unknown MX — the rest of the internet

What this block shows. The slice of domains whose mailbox cannot be attributed to a named provider — regional hosters, self-built Postfix/Exim, corporate gateways, niche ESPs. Researchers ask for this specifically because it captures the deliverability reality outside the Google / Microsoft monoculture. The detailed report drills down into Top-1000 most common unmatched hosts, 100 hand-picked curiosities (longest one-off names) and a TLD breakdown.

Unknown / Generic share
11.30%
75 944 domains
Unique unmatched MX hosts
36 328
individual hostnames in the long tail
Self-hosted
22.47%
151 059 domains running their own MX
📋 Open detailed long-tail report →·⬇ Download top-1000 unmatched MX (CSV)·⬇ Download 100 curiosities (CSV)

Authentication by Tranco tier

The same metrics cut by list position. Enforcement is a function of how big the site is: the gradient from the top of the list to the tail is the finding, not the average. "Not in current list" = domains measured in this snapshot that are absent from today's Tranco file (list rotation).

#TierDomains with MXSPFDMARC enforcedSelf-hosted
1Tranco top-1k69293.79%73.84%11.85%
2top-1k … 10k6 46093.00%56.95%15.00%
3top-10k … 100k64 71491.29%43.53%17.57%
4top-100k … 1M589 20389.79%28.23%23.03%
5not in current list11 07488.30%19.12%26.78%

Top ESPs / mass-mailing services

What this block shows. Outbound mass-mailing platforms each domain authorises in its SPF record — the marketing-automation, transactional-email and customer-engagement layer (SendGrid, Mailchimp, Mailgun, Klaviyo, HubSpot, Salesforce Marketing Cloud, etc.). One domain can use several ESPs, so percentages sum to more than 100% of SPF-publishing domains.

#ESPDomainsShare of SPF-publishing domains
1Amazon SES →39 2976.19%
2SendGrid (Twilio) →29 4594.64%
3Mailgun →25 4764.01%
4Zendesk →23 9023.76%
5Mailchimp →22 7433.58%
6Mandrill →20 6463.25%
7HubSpot →19 8663.13%
8Salesforce →16 1912.55%
9Mailjet (Sinch) →13 5162.13%
10Cloudflare Email Routing →12 3981.95%
Show rows 11 – 30
#ESPDomainsShare of SPF-publishing domains
11Brevo (ex-Sendinblue) →9 4441.49%
12Mimecast →8 5521.35%
13Namecheap Forwarding →7 3661.16%
14MailChannels →6 6231.04%
15MailerLite →6 5551.03%
16Proofpoint →5 7590.91%
17Elastic Email →4 4660.70%
18Unisender (RU) →3 7350.59%
19Constant Contact →3 6430.57%
20Campaign Monitor →3 5300.56%
21Marketo (Adobe) →3 2010.50%
22Zoho Campaigns →3 1910.50%
23Postmark →2 9790.47%
24Emsd1 (transactional) →2 9050.46%
25SendPulse →2 8640.45%
26Exclaimer (signatures) →2 6920.42%
27SparkPost →2 6780.42%
28Zoho ZeptoMail →2 5830.41%
29Help Scout →2 2220.35%
30Salesforce Marketing Cloud →2 1760.34%
📮 Open Mailing services portfolio → all detected ESPs with descriptions, country, sparklines — click any ESP above to drill into a detail page

Trend — last 30 day(s) · Top ESPs

SaaS senders (Notion, Slack, Zendesk, Atlassian, Stripe…)

What this block shows. SaaS apps that send mail FROM a customer's domain on the customer's behalf — productivity, support, payments, HR, e-commerce and other business apps appearing as include: targets in the customer's SPF. Distinct from ESPs (mass-mailing platforms) and mailbox providers (where the inbox lives).

#SaaS appDomainsShare of SPF-publishing domains
1Shopify →5 4710.86%
2Pardot (Salesforce) →4 7170.74%
3CodeTwo Email Signatures 365 →4 4730.70%
4KnowBe4 →3 4060.54%
5Statuspage (Atlassian) →2 0410.32%
6Trustpilot →1 8620.29%
7Firebase (Google) →1 8600.29%
8Atlassian (Jira/Confluence) →1 7570.28%
9BigCommerce →1 7470.28%
10Lark / Feishu →1 2930.20%
Show rows 11 – 30
#SaaS appDomainsShare of SPF-publishing domains
11Sage Intacct →1 1470.18%
12NetSuite (Oracle) →1 1400.18%
13Oracle Cloud Email →1 1000.17%
14Qualtrics →1 0810.17%
15WordPress.com / WP Cloud →9920.16%
16SAP SuccessFactors →9490.15%
17Docebo (LMS) →9260.15%
18Oracle Cloud →8420.13%
19Zoho Books →6970.11%
20AFAS →6750.11%
21Greenhouse →6140.10%
22PayPal Braintree →5680.09%
23ClickDimensions →5540.09%
24UKG / UltiPro →5340.08%
25Autotask (ConnectWise) →4700.07%
26TOPdesk →4600.07%
27FormAssembly →4450.07%
28Odoo →4450.07%
29Zimpel (Cision) →4320.07%
30ConnectWise →4200.07%
📧 Open SaaS/ESP senders portfolio → SaaS apps sending FROM customer domains — click any SaaS name above for detail

Trend — last 30 day(s) · Top SaaS senders

DMARC adoption

What this block shows. The policy each DMARC-publishing domain advertises at _dmarc.<domain>: none = monitor only, quarantine = mark as spam on fail, reject = drop on fail, invalid = a syntactically broken record. "Enforced %" treats only quarantine / reject with pct=100 as actually enforcing.

Trend — last 30 day(s) · DMARC enforced %

7d ago▼ -0.27%30d ago▼ -0.47%

Trend — last 30 day(s) · DMARC policies

Does the DMARC record actually do anything?

A three-way split instead of the usual enforced/not-enforced binary. Enforcing — p=quarantine or p=reject. Monitoring — p=none with a working rua= address: a legitimate rollout phase, someone is reading the reports. Inert — p=none with no reporting address at all: the record enforces nothing and reports nowhere.

36.05%
DMARC without reporting address
171 021 domains publish DMARC but receive no aggregate reports
24.59%
Inert records (p=none, no rua)
116 647 domains — the record does nothing at all
35.85%
Reports go to an external vendor only
170 102 domains send every report off-domain

Maturity split of 474 431 DMARC-publishing domains: 49.02% enforcing, 25.35% monitoring, 24.59% inert. Under DMARCbis (RFC 9989/9990/9991) the pct= tag no longer exists, so the same snapshot yields 49.02% enforcing against 46.84% under RFC 7489 — both are published, the RFC 7489 figure keeps the 2016 series continuous. DMARCbis adoption is still marginal: 419 domains (0.09%) publish np=, 91 publish psd=. 973 records carry a rua= tag that parses to no usable address at all.

#DMARC reporting destinationDomainsShare of DMARC publishers
1Self-hosted / Other217 77945.90%
2Cloudflare DMARC28 3425.97%
3Valimail14 2823.01%
4Brevo (ex-Sendinblue)13 3982.82%
5Proofpoint EFD12 4512.62%
6dmarcian9 3471.97%
7Postmark DMARC7 4231.56%
8DMARC Analyzer6 8511.44%
9DMARC Advisor3 0940.65%
10DMARC Digests2 8330.60%
Show rows 11 – 25
#DMARC reporting destinationDomainsShare of DMARC publishers
11PowerDMARC2 4530.52%
12Agari (Fortra)2 1850.46%
13URIports2 1700.46%
14DMARCLY1 8880.40%
15Barracuda1 5390.32%
16Google Workspace9610.20%
17EasyDMARC8480.18%
18MailHardener7360.16%
19Red Sift OnDMARC5900.12%
20Cisco Secure Email3920.08%
21Microsoft 3652940.06%
22Validity (Return Path)2940.06%
23Netcraft2910.06%
24TDMARC2200.05%
25MXToolbox390.01%

Mailbox provider × sending platform

Which sending platforms sit on top of which inbound stack. Cell = domains whose primary MX belongs to that mailbox provider and whose SPF authorises that ESP; the percentage is of that provider's domains. A domain may use several ESPs, so rows do not sum to 100%.

Mailbox providerAmazon SESSendGrid (Twilio)ZendeskMailgunMailchimpHubSpotMandrillSalesforceCloudflare Email RoutingMailjet (Sinch)
Self-Hosted2 878
1.91%		1 466
0.97%		774
0.51%		1 565
1.04%		1 387
0.92%		394
0.26%		1 162
0.77%		367
0.24%		106
0.07%		1 266
0.84%
Google Workspace14 773
10.16%		11 634
8.00%		11 169
7.68%		9 707
6.68%		9 049
6.22%		9 677
6.66%		8 338
5.74%		4 258
2.93%		334
0.23%		3 451
2.37%
Microsoft 3659 752
8.54%		9 317
8.16%		7 001
6.13%		6 346
5.56%		7 426
6.50%		6 570
5.75%		6 559
5.74%		7 125
6.24%		44
0.04%		4 303
3.77%
Proofpoint834
6.66%		694
5.54%		747
5.97%		339
2.71%		456
3.64%		464
3.71%		483
3.86%		1 102
8.80%		1
0.01%		243
1.94%
Cloudflare Email Routing254
2.15%		79
0.67%		63
0.53%		120
1.02%		32
0.27%		11
0.09%		21
0.18%		6
0.05%		11 549
97.91%		98
0.83%
Yandex 360153
1.40%		35
0.32%		31
0.28%		212
1.94%		72
0.66%		2
0.02%		64
0.59%		1
0.01%		7
0.06%		26
0.24%
Mimecast994
10.12%		1 018
10.37%		752
7.66%		521
5.30%		656
6.68%		781
7.95%		627
6.38%		1 141
11.62%		1
0.01%		199
2.03%
Hostinger42
0.51%		41
0.50%		11
0.13%		59
0.72%		7
0.09%		5
0.06%		4
0.05%		0
0.00%		7
0.09%		25
0.31%
Namecheap Email Forwarding11
0.16%		10
0.14%		4
0.06%		19
0.27%		2
0.03%		0
0.00%		7
0.10%		0
0.00%		4
0.06%		11
0.16%
Zoho Mail409
5.85%		175
2.51%		93
1.33%		320
4.58%		112
1.60%		19
0.27%		98
1.40%		2
0.03%		47
0.67%		106
1.52%

Reverse DNS of inbound MX addresses

PTR is measured separately from the OpenINTEL snapshot. These addresses receive mail; they do not identify the actual sending IP. Forward-confirmed reverse DNS, outbound use and delivery are not measured here.

Last stored DNS attempt: 2026-09-16 08:17:20 UTC. Complete current observations: 238 376 of 378 412 MX hostnames in this snapshot. The freshness window is 14 days; this is not a daily check of every MX.

15 680 of 238 376 completely measured MX hosts returned negative PTR answers for every address. A partial check of the first few addresses cannot establish that result.

No PTR by mailbox provider

GroupComplete measured domainsAll MX addresses without PTR
Self-Hosted140 3257.28% (10 217)
Google Workspace122 9600.00% (0)
Unknown / Other38 4764.75% (1 827)
Generic / unmatched (mx*.*)14 8974.66% (694)
Generic / unmatched (mail.*)12 08711.02% (1 332)
Proofpoint12 0590.00% (0)
Yandex 36010 8640.00% (0)
Hostinger8 14599.47% (8 102)
Namecheap Email Forwarding7 0360.00% (0)
Zoho Mail6 9580.00% (0)
QQ Mail (Tencent)5 52499.86% (5 516)
GoDaddy5 1800.00% (0)

No PTR by list position

GroupComplete measured domainsAll MX addresses without PTR
top_1k4936.90% (34)
top_10k4 4964.49% (202)
top_100k44 3135.75% (2 550)
top_1m413 6877.30% (30 214)
unranked8 30112.76% (1 059)

No PTR by ccTLD

GroupComplete measured domainsAll MX addresses without PTR
cn3 90168.80% (2 684)
kr2 48827.17% (676)
in6 42514.61% (939)
pk1 05913.60% (144)
hk54111.28% (61)
cc1 05610.61% (112)
ir2 20110.54% (232)
kz92610.04% (93)
lt6729.23% (62)
id2 7049.06% (245)

56.44% of 140 325 completely measured self-hosted domains have observed PTR names entirely outside the study domain. This is a relationship between names, not a DNS-zone or FCrDNS test.

31 021 observed IPs are associated with 2–100 current MX hostnames. This does not identify shared sending reputation.

Stale: 829; legacy results without per-address outcomes: 881; not cached: 2 578; partial address coverage: 120 286. These categories can overlap. Incomplete and unknown domains are excluded from percentages.

Next check: obtain the actual sending IP, query its PTR records, then resolve those names to A/AAAA and compare the IPs. A PTR name outside this domain alone does not establish a configuration failure.

Top 100 most-used DMARC records (verbatim)

The literal record string copied verbatim from DNS — useful to spot copy-pasted "starter" policies and identify reporting endpoints (the rua= / ruf= tags) shared across many domains.

#DMARC recordDomains
1v=DMARC1; p=none;60 303
2v=DMARC1; p=none33 376
3v=DMARC1; p=none; rua=mailto:rua@dmarc.brevo.com9 501
4v=DMARC1; p=quarantine;5 109
5v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;4 170
6v=DMARC1; p=reject;4 165
7v=DMARC1; p=quarantine4 107
8v=DMARC1;p=none;3 571
9v=DMARC1; p=quarantine; adkim=s; aspf=s3 045
10v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com3 039
11v=DMARC1; p=reject3 034
12v=DMARC1; p=none; aspf=r; adkim=r;2 476
13v=DMARC1; p=quarantine; pct=1002 173
14v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;2 164
15v=DMARC1; p=none; sp=none; rua=mailto:dmarc@mailinblue.com!10m; ruf=mailto:dmarc@mailinblue.com!10m; rf=afrf; pct=100; ri=864001 968
16v=DMARC1;p=none1 824
17v=DMARC1; p=none; aspf=r; sp=none1 763
18v=DMARC1; p=none; adkim=r; aspf=r;1 671
19v=DMARC1; p=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;1 532
20v=DMARC1;p=reject;1 343
21v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email1 269
22v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email1 263
23v=DMARC1;p=none;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=864001 189
24v=DMARC1;p=quarantine;pct=100;fo=11 174
25v=DMARC1; p=none; sp=none1 153
Show rows 26 – 100
#DMARC recordDomains
26v=DMARC1; p=none; sp=none;1 135
27v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email;920
28v=DMARC1; p=reject; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;912
29v=DMARC1; p=reject; rua=mailto:report@dmarc.amazon.com; ruf=mailto:report@dmarc.amazon.com904
30v=DMARC1; p=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com842
31v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email754
32v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s752
33v=DMARC1; p=none; pct=100733
34v=DMARC1; p=reject; rua=mailto:dmarc_rua@onsecureserver.net; adkim=r; aspf=r;726
35v=DMARC1; p=reject; pct=100724
36v=DMARC1; p=quarantine; fo=1; ruf=mailto:dmarc@qiye.163.com; rua=mailto:dmarc_report@qiye.163.com702
37v=DMARC1;p=quarantine;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400666
38v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com632
39v=DMARC1; p=none; fo=1; ruf=mailto:dmarc@qiye.163.com; rua=mailto:dmarc_report@qiye.163.com626
40v=DMARC1;p=quarantine555
41v=DMARC1; p=quarantine; pct=100;546
42v=DMARC1; p=none; sp=none; rf=afrf; pct=100; ri=86400541
43v=DMARC1; p=quarantine; rua=mailto:dmarc_agg@vali.email;509
44v=DMARC1; p=none; rua=mailto:mailauth-reports@qq.com492
45v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email;467
46v=DMARC1; p=reject; pct=100;460
47v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s438
48v=DMARC1; p=none; sp=none; adkim=r; aspf=r435
49v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:ewai10d2@ag.eu.dmarcian.com; ruf=mailto:ewai10d2@fr.eu.dmarcian.com435
50v=DMARC1; p=none; adkim=r; aspf=r420
51v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc.report@axa.com;375
52v=DMARC1; p=reject; adkim=s; aspf=s;372
53v=DMARC1; p=none; pct=100;366
54v=DMARC1; p=quarantine; adkim=r; aspf=r353
55v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; fo=1337
56v=DMARC1;p=reject331
57v=DMARC1; p=none; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;328
58v=DMARC1; p=reject; sp=reject; pct=100; fo=1; ri=3600; rua=mailto:dmarcrecord@gmail.com; ruf=mailto:dmarcrecord@gmail.com;326
59v=DMARC1; p=reject; adkim=s; aspf=s324
60v=DMARC1; p=none; aspf=r; adkim=r324
61v=DMARC1319
62v=DMARC1;p=quarantine;318
63v=DMARC1; p=reject; sp=none; rf=afrf; pct=100; ri=86400304
64v=DMARC1; p=none; fo=1301
65v=DMARC1;p=reject;fo=1;rua=mailto:dmarc_rua@emaildefense.proofpoint.com;ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com298
66v=DMARC1; p=quarantine; rua=mailto:rua@dmarc.brevo.com288
67v=DMARC1;p=none;sp=none;pct=50;adkim=r;aspf=r;285
68v=DMARC1; p=reject; rua=mailto:tnoff9hr@ag.eu.dmarcadvisor.com; aspf=s; adkim=s;276
69v=DMARC1; p=none; rua=mailto:mailauth-reports@google.com274
70v=DMARC1; p=reject; rua=mailto:zsrbf6su@ag.eu.dmarcadvisor.com;268
71v=DMARC1;p=reject;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400266
72v=DMARC1; p=none; rua=mailto:dmarc@smtp.mailtrap.live; ruf=mailto:dmarc@smtp.mailtrap.live; rf=afrf; pct=100265
73v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;fo=1243
74v=DMARC1; p=quarantine; adkim=s; aspf=s;243
75v=DMARC1; p=reject; rua=mailto:rua@dmarc.brevo.com234
76v=DMARC1; p=none; rua=mailto:rua-mpse@mpub.ne.jp229
77v=DMARC1;p=none;rua=mailto:dmarc_report@service.aliyun.com225
78v=DMARC1; p=none; rua=mailto:dmarc.rua@edrone.app; ruf=mailto:dmarc.ruf@edrone.app225
79v=DMARC1; p=none; sp=none; rua=mailto:dmarc-raports@dhosting.pl224
80v=DMARC1; p=none; rua=mailto:dmarc@reporting.unisender.com219
81v=DMARC1; p=reject; rua=mailto:dmarc_rua@onsecureserver.net;207
82v=DMARC1; p=reject; sp=reject205
83v=DMARC1; p=reject; rua=mailto:zicaptxt@ag.dmarcian.com;197
84v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com196
85v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com193
86v=DMARC1;p=none;rua=mailto:rua@dmarc.brevo.com191
87v=DMARC1; p=reject; ruf=mailto:dmarc@purelymail.com187
88v=DMARC1; p=quarantine; pct=100; adkim=r; aspf=r185
89v=DMARC1; p=quarantine; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;183
90v=DMARC1; p=reject; sp=reject;182
91v=DMARC1; p=quarantine; adkim=r; aspf=r;182
92v=DMARC1; p=quarantine; pct=100; rua=mailto:61e7fc8674b33@ag.eu.dmarcly.com; ruf=mailto:61e7fc8674b33@fo.eu.dmarcly.com; sp=quarantine; fo=1;177
93v=DMARC1; p=quarantine; fo=1175
94v=DMARC1;p=reject;pct=100;174
95v=DMARC1;p=none;pct=100172
96v=DMARC1; p=reject; pct=100; adkim=s; aspf=s171
97v=DMARC1; p=reject; rua=mailto:dmarcfeedbackwelcome@gmail.com; ruf=mailto:dmarcfeedbackwelcome@gmail.com; fo=1; pct=100;170
98v=DMARC1;p=none;sp=none;adkim=r;aspf=r;pct=100169
99v=DMARC1; p=none; rua=mailto:dmarc-report@cv-library.co.uk; ruf=mailto:dmarc-report@cv-library.co.uk; fo=0; adkim=r; aspf=r; pct=0; rf=afrf; ri=86400; sp=none169
100v=DMARC1; p=none; pct=100; rua=mailto:dmarc@fbl.optin.com;161
From DNS policy to a real message. A published policy cannot tell you where a particular email lands. Run an inbox placement test: send a real message to our seed mailboxes at Gmail, Outlook, Yandex and Mail.ru and see where it lands — inbox, spam, or nowhere.
Test your deliverability →

Unmatched MX targets — top 100

What this block shows. The most popular MX hostnames our dictionary does not yet attribute to a named mailbox provider. Public list — these feed back into dictionaries/mx_providers.py for the next iteration so coverage keeps improving.

#MX targetDomains
1mail.levikof.com988
2localhost436
3mail238
4mail.parktons.com174
5ms06.cv-library.co.uk171
6ms07.cv-library.co.uk171
7ms08.cv-library.co.uk171
8ns4.forevermail.com170
9mail1.sbnation.com165
10mail.pickelhost.com164
11mail2.recop.jp153
12alltheemails.com145
13mx.email-messaging.com136
14lbmx.bcc.gov.bd133
15s.mail.dcsaas.net133
16mx1d10.thinline.cz119
17mx1b20.thinline.cz119
18mail.autoline.com.ua119
19mx2.z-ns.net118
20mxi.alpha-prm.jp117
21entrap-01.hostns.io109
22entrap-02.hostns.io109
23entrap-03.hostns.io109
24mx1.ticketsinbound.com106
25mx2.ticketsinbound.com103
Show rows 26 – 100
#MX targetDomains
26mail.mpcloud.net99
27mx-backup.serveriai.lt96
28mx.maxns.net95
29~94
30mx2.netim.net92
31mx1.netim.net91
32mx.aams4.jp87
33amazon-smtp.amazon.com86
34townsites.dnsmaster.net86
35mail-fr.securemail.pro85
36mx-0.aams4.jp84
37mx-1.aams4.jp84
38mailgw01.host.it84
39cloudmail.auto-vision.ru82
40mailgw02.host.it82
41mx.vshosting.eu82
42mail.vipmailservice.com81
43mailforward.dnsv.jp79
44mx-01.mail-forwarder.io79
45mx1-dk.centerasecurity.dk78
46mx2-dk.centerasecurity.dk78
47mx-02.mail-forwarder.io77
48mx6.kvnbw.de77
49mx7.kvnbw.de77
50mx8.kvnbw.de77
51mx9.kvnbw.de77
52mx1.email-cluster.com74
53mx2.email-cluster.com74
54mx3-dk.centerasecurity.dk72
55email.webglobe.cz72
56email2.webglobe.cz72
57failover1.email-cluster.com72
58posta.mediacenter.hu71
59posta2.mediacenter.hu71
60posta4.mediacenter.hu71
61posta5.mediacenter.hu71
62email3.webglobe.cz71
63email4.webglobe.cz71
64posta3.mediacenter.hu70
65mail.global.frontbridge.com70
66q01es.mail.s-web.de70
67q02es.mail.s-web.de70
68r01es.mail.s-web.de70
69r02es.mail.s-web.de70
70mail.bluetie.com69
71gmail22.gadmail.de69
72gmail23.gadmail.de69
73wmail22.gadmail.de69
74mx1.oderland.com68
75mx2.oderland.com68
76wmail23.gadmail.de68
77mx4.emailowl.com67
78mxa.expediagroup.com67
79mxb.expediagroup.com67
80mx.sendcloud.org65
81mta.vshosting.eu65
82mx5.emailowl.com65
83rmail22.gadmail.de65
84rmail23.gadmail.de65
85mx6.emailowl.com64
86mx1.simplelogin.co64
87mx2.simplelogin.co64
88mx01.muumuu-mail.com64
89mx1.alwaysdata.com64
90mx2.alwaysdata.com64
91omail22.gadmail.de64
92omail23.gadmail.de64
93smtp.faisco.cn63
94mx3.oderland.com63
95mx4.oderland.com63
96mx1.daouoffice.com63
97mx4.nameshield.net62
98mx1.nepal.gov.np62
99mx.spamfilter.io61
100smtp-avas.seeweb.it61

Unmatched SPF includes — top 100

What this block shows. The most popular SPF include: targets that don't match any known ESP, mailbox-as-sender, or SaaS pattern yet. Same feedback loop: top hits get added to dictionaries/esps.py or dictionaries/saas_senders.py.

#SPF includeDomains
1spf.jetsmtp.net238
2_spf.cv-library.co.uk171
3_spf1-aws.recop.jp154
4_spf.mail-neoserv.si142
5_spf.lh.pl141
6yunyou.top141
7_spf.abcp.ru136
8spf.mailii.org135
9_spf.edhost.eu116
10spf.pitcom.net115
11spf.w4ymail.at113
12spf.host-ww.net111
13spf.aams4.jp111
14spf.mailcamp.nl110
15_spf.armada.it110
16spf.cesky-hosting.cz108
17_spf.exsilia.net107
18relay.guzelhosting.com107
19spf.boldem.cz106
20mailii.org105
21spf.spcloud.jp104
22_spf.wpopt.net103
23spf.betrend.com103
24_spf.tld-mx.com102
25spf-2248456.jmsend.com102
Show rows 26 – 100
#SPF includeDomains
26spf.emailfilter.io102
27smtp-cluster.plusvps.com102
28_spf.localservices.com.br102
29spf.shopserve.jp101
30mlrcloud.com100
31_spf.yourfilter.nl100
32_spf.sendnode.com99
33spf.host.it99
34spf.mijndomeinhosting.nl99
35spf.satorimail.net99
36amazon.com97
37_pmta2.antevenio.com97
38send.k-crm.jp97
39_spf.octadesk.com97
40spf.symplicity.com96
41mailing.eqs.com96
42_spf.academicworks.com96
43mfg.siteprotect.com95
44_spf.presscloud.com95
45spf.v6send.net95
46fmx.etius.jp94
47spf.qboxmail.com94
48spf.form.run94
49_spf.aid.no93
50_spf01.mykronos.com92
51spf.protection.outlook92
52spf.zoner.fi90
53relay.thundermail.uk90
54_spf.sent2email.com90
55sender.zcsend.jp90
56spf.w2solution.com90
57eversrv.com89
58spf.ssmx.net89
59_spf.simpleviewinc.com89
60senders.mailmasterplus.net89
61verifymyfafsa.com89
62spf.esvacloud.com88
63spf.qb-feedback.com88
64mailmailmail.net88
65relay.email-cluster.com88
66_spf.goskope.com88
67_spf.eemsg.mail.mil88
68spf2.nlk2.smtps.jp87
69ofsys.com86
70spf.protect.kvnbw.de86
71woexchange.com86
72spf.redpoints.com86
73limajo.witglobal.net85
74spf.sosafe.de84
75spf-us.appmail.granicusgovaccess.net84
76spf.filteredmx.net84
77spf.postbox.yandexcloud.net84
78_spf.herodesk-mails.io84
79dospf.simplepart.com84
80_spf.shared-server.net84
81spf.rpost.net83
82spf.gansend.com83
83spfref.jackhenry.com83
84all._spf.ds.network83
85_spf-c.arukereso.hu82
86spfv.global-mail.cn82
87ciphr247.com82
88custmail.vdata.com82
89_spf.newsautodoc.com81
90gateways.firstdata.com81
91spf.chinaemail.cn81
92_spf.zorgmail.nl80
93spf.sabre.com79
94spf79
95universalspf.org79
96x.universalspf.org79
97no-ip.com79
98eur.pb-dynmktge.com78
99_spf.paytsoftware.com78
100spf.hostido.pl78

Methodology — how the numbers were produced

1. Data source

The dataset is the daily OpenINTEL forward-DNS Tranco snapshot (University of Twente / SURFnet / SIDN Labs). OpenINTEL queries the entire Tranco top-1M domain list daily for MX, TXT, NS, A, AAAA, SOA, CAA, DNSSEC and other records, publishing the results as Apache Parquet. For pre-2022 history we additionally use OpenINTEL's alexa source (the legacy Alexa top-1M list, retired 2023).

Cite: Roland van Rijswijk-Deij et al., "A High-Performance, Scalable Infrastructure for Large-Scale Active DNS Measurements", IEEE JSAC 2016.

1b. Where the rest of the analysis lives

Six deep-dive pages are rebuilt by the same daily run and were previously reachable only through the sitemap: SPF health (final all qualifier, DNS-lookup limit, record length) · Email security posture (MTA-STS, BIMI, TLS-RPT, DKIM selectors) · SaaS via verification tokens · DNS/NS providers · Country × ESP · Infrastructure & TLS.

2. Sample & cadence

Each report covers a single date — OpenINTEL publishes snapshot D on D+1, so the current UTC date is never treated as an expected snapshot. Freshness means matching the latest date actually present in the OpenINTEL catalogue, typically ~700 k domains with MX records and ~620 k with SPF. The pipeline runs daily at 03:00 UTC, after the usual source-publication window; each daily run produces an HTML report, a JSON summary, an updated time-series, and incremental updates to the domain registry (§ 12). No sub-sampling.

3. Mailbox provider classification

For each domain we read its MX RRset and pick the record with the lowest mx_preference as the primary mailbox host. The hostname of that primary MX is matched against an open regex dictionary (dictionaries/mx_providers.py, currently 330 patterns, hash below). Specific patterns (e.g. .mail.protection.outlook.com) are tried first; generic fallbacks (mail.*, mx*.*) only after. Domains whose MX matches no rule are kept as "Unknown / Other" — never dropped — and exported in Unmatched MX targets for dictionary improvement.

4. ESP / SaaS / forwarder / gateway classification (SPF-based)

For each domain's apex SPF record (TXT starting with v=spf1) we extract every include: and redirect= target and resolve them against open classification dictionaries (ESPs, mailbox-as-sender, anti-spam gateways, forwarders, SaaS senders, DMARC vendors, NS providers, verification tokens).

Resolution order: PURE_ESP → MAILBOX_AS_SENDER → GATEWAYS → FORWARDERS → bare-apex substring fallback → SAAS_SENDERS substring iteration. Bare-apex derivation strips leading _spf., _spf-eu., spf., mail. prefixes from dict keys to catch subdomain variants (e.g. _spf.m1.websupport.sk → matches websupport.sk). Malformed includes (no dot, <4 chars) are filtered.

One domain may use several ESPs simultaneously, so ESP shares sum to more than 100% of SPF-publishing domains. Current SPF-include target coverage: 82.31%, recomputed from this snapshot rather than hard-coded.

Limitation: "flattened" SPF (where include chains were replaced with raw IP ranges to fit the 10-lookup limit) is not detectable from DNS alone — those domains appear ESP-less even when an ESP is in fact used.

5. DMARC (deep)

For each domain we query the _dmarc.<domain> TXT record. Records starting with v=DMARC1 are parsed for:

  • p= (apex policy): none / quarantine / reject / invalid
  • sp= (subdomain policy)
  • pct= (rollout percentage)
  • rua= aggregate-report destinations → classified into vendor buckets (Postmark DMARC, Valimail, dmarcian, URIports, EasyDMARC, Red Sift, Proofpoint EFD, Agari/Fortra, …) using dictionaries/dmarc_vendors.py

A domain is counted as enforced if p=quarantine or p=reject with pct=100 (or pct absent — defaults to 100).

6. SPF mechanics & health

For every SPF record we additionally extract:

  • Final qualifier on the all mechanism: -all (hard fail), ~all (soft fail), ?all (neutral), +all (pass-everything — broken / dangerous), or missing
  • DNS lookup count (include:, redirect=, a:, mx:, exists:, ptr:) — each mechanism counts as 1 against the spec limit of 10. Records exceeding the limit return PermErr at recipients
  • Mechanism mix: include-only (modern), raw IP4/IP6 ranges only (legacy/flattened), mixed
  • Record byte length: percentiles to flag fragmentation risk (>450 B)

7. Email security maturity

Adoption of modern mail-security TXT records, parsed from the same OpenINTEL parquet:

  • MTA-STS: TXT at _mta-sts.<domain> with v=STSv1 — domain advertises required-TLS to its MX
  • BIMI: TXT at default._bimi.<domain> with v=BIMI1 — brand publishes a verified logo (requires p=reject)
  • TLS-RPT (SMTP TLS Reporting): TXT at _smtp._tls.<domain> with v=TLSRPTv1 — domain monitors TLS-failure reports
  • DKIM selectors: where the OpenINTEL scan includes *._domainkey.<domain> queries, well-known selectors (google, selector1/2, s1/s2, k1/k2/k3, mailo, mte1, …) are mapped to issuing ESPs

8. DNS provider classification

For each domain's NS RRset, every NS hostname is matched against a suffix dictionary (dictionaries/ns_providers.py) with patterns for Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Akamai, NS1, UltraDNS, Yandex, DNSPod, Aliyun, OVH, Hetzner, Gandi, registrars, and others. A domain is assigned to its dominant NS provider; ties resolve to whichever pattern was matched first.

9. SaaS-via-verification-tokens

Many SaaS apps a domain is connected to never appear in SPF (because the SaaS doesn't send mail FROM the customer domain). To recover this signal we parse apex TXT records for verification tokens — google-site-verification=…, MS=…, atlassian-domain-verification=…, stripe-verification=…, plus 149 other patterns in dictionaries/verification_tokens.py. This produces a complementary "SaaS density" metric and surfaces apps that the SPF-only view misses.

10. Email infrastructure modernity

Three additional TLS / IPv6 metrics:

  • IPv6-on-MX: MX hostname has at least one AAAA record
  • DANE / TLSA on MX: TLSA record at _25._tcp.<mx_host> (where the parquet includes TLSA queries)
  • CAA: any 0 issue … / 0 issuewild … record at apex; CAs aggregated into a market-share view (Let's Encrypt, DigiCert, Sectigo, …)

11. Cross-tabulations

  • Country × ESP heatmap: top-15 ccTLDs × top-15 ESPs, cell = % of country's SPF-publishing domains using ESP X. Surfaces regional ESP champions (Brevo / FR, Unisender / RU, MailerLite / LT, Akna / BR, Shoptet / CZ).
  • Mailbox × ESP combinations: stacked frequency of common stack pairings — published as Mailbox provider × sending platform.

12. Domain registry & identifiers

Every domain ever observed across snapshots is assigned a stable integer ID in /var/openintel-cache/registry/domains.sqlite3 (currently 1 984 347 domains). Reports reference domains by ID rather than embedding strings; clients resolve names from a single gzipped registry dump (/email-stats/domains.csv.gz, 25.9 MB). This keeps per-report payloads compact, enables fast set-operation diffs across snapshots, and gives every domain a first-seen / last-seen timestamp.

13. Daily change-alerts feed

Each daily run computes a domain-level diff vs the previous scan and emits a change-feed at /email-stats/alerts.html (also as JSON + Atom). Detected events: ESP added/removed in SPF, DMARC policy upgrade/downgrade, primary-mailbox-provider change, SPF strict→soft regression, MTA-STS / BIMI first publication. Severity tag is good / bad / info.

14. Per-entity detail pages

The top-100 ESPs, top-100 SaaS senders and top-80 mailbox providers each have a dedicated detail page at /email-stats/detail/<kind>/<slug>.html showing KPI cards, a Chart.js sparkline (from history.json), TLD distribution and a sample of customer domains.

15. Tier breakdown

Each domain is assigned a tier from its Tranco rank: top-1k / top-10k / top-100k / top-1M, plus unranked for domains measured in the snapshot but absent from the current list file (rotation). Published as Authentication by Tranco tier: SPF, DMARC enforcement and self-hosting per tier.

16. Reproducibility & data hygiene

Dictionary hashes for this run (sha256, first 12 hex):

  • compliance.py — 76d502287abe
  • dmarc_vendors.py — 8c195eb564fc
  • domain_match.py — 8411162f72b7
  • esps.py — 206a79aab417
  • mx_providers.py — 23fb265346a7
  • mx_selection.py — 8e9445ccc3e3
  • ns_providers.py — cc4f43c6651f
  • providers_meta.py — 8222adcb331d
  • saas_meta.py — 10901ef58846
  • saas_senders.py — 9ffa69056163
  • tld_regions.py — 61e8bd3dcca8
  • verification_tokens.py — 6ba8313e55ab

Every published report includes the exact OpenINTEL date, dictionary file hashes, and counts of unmatched MX hosts and SPF includes — so any reader can verify or reproduce the figures. Raw OpenINTEL parquet is downloaded into a temporary cache and deleted after analysis; only aggregated, non-redistributable counts are kept long-term (per OpenINTEL data agreement). The domain registry stores names but no record-level content.

16b. Methodology changelog

Every change to a metric definition is recorded in the methodology changelog and stamped into each history point as methodology_version — so a step in a series can always be attributed to a formula change rather than to reality.

17. Limitations to be aware of

  • Tranco bias. Top-1M skews toward US/EU and global SaaS; ccTLD-only domains with low traffic may be under-represented. The alexa source used for pre-2022 history has a different composition and a different size: the alexa partition of 2022-04-01 contains 1 637 544 measured apex names against 1 087 498 in tranco on 2026-07-24, so absolute counts are not comparable across the 2022-08-11 boundary — only shares within a snapshot are.
  • SPF flattening hides ESP identity (see § 4).
  • CNAME chains on MX (e.g. mail.example.com → mail.example.protection.outlook.com) are not unrolled — only the first MX target is matched. This biases a small share of domains toward "Unknown" when their MX is a CNAME to a known provider.
  • Vanity MX with white-label provider (Mimecast/Proofpoint customers using their own brand) is not detectable from DNS alone.
  • DKIM enumeration is selector-based — only domains whose well-known selectors are scanned by OpenINTEL appear in the DKIM layer.
  • Long-tail unmatched: this snapshot contains 82 667 unique unclassified SPF targets. The count is published as a measured coverage KPI rather than a fixed estimate; many are regional hosters, tenant-specific endpoints, malformed records, or single-domain infrastructure.
  • Newly-added dictionary entries have no historical sparkline until ≥ 2 daily scans accumulate, since archived raw parquet is purged after parsing per the OpenINTEL data agreement.

Comments & corrections

Spotted a mis-classified MX target, missed ESP, or want to discuss a finding? We publish corrections in the next daily snapshot.

Send feedback to support@live-direct-marketing.online

Inline comments coming soon. For now, email is the fastest path — you'll see your fix reflected in tomorrow's run.

For press and analysts

What this block shows. The dataset is rebuilt every day and published under CC BY 4.0 — use the numbers, the charts and the PDF in your material, with a link back. If you need a cut that is not on this page, ask: we run it against the same snapshot and send it over.

Download the report (PDF) Headline numbers, charts and methodology in one file, rebuilt daily. Press kitCharts as PNG and WebP, ready to publish, with captions. Machine-readableJSON API, full time series, CSV exports, Atom change feed. Licence & citationCC BY 4.0, ready-made citation and BibTeX.
Need a custom cut? A single country, a single provider, a longer period, a comparison against your own list — we prepare it from the same daily snapshot and send the numbers with the date attached. No charge for editorial use.
Request data

Historical reports

Daily snapshots — last 90 days kept fully, older ones thinned to one point per month. Points marked partial are incomplete days at the source and are excluded from deltas and trends.

217 snapshots since 2016-01-22 — open the list
2026-09-16 — 672 143 MX, 634 905 SPF2026-09-14 — 674 487 MX, 637 677 SPF2026-09-13 — 664 797 MX, 628 913 SPF2026-09-12 — 665 310 MX, 629 828 SPF2026-09-11 — 666 213 MX, 631 089 SPF2026-09-10 — 667 099 MX, 632 322 SPF2026-09-09 — 667 415 MX, 633 115 SPF2026-09-08 — 667 494 MX, 633 491 SPF2026-09-07 — 666 076 MX, 632 414 SPF2026-09-06 — 665 504 MX, 631 995 SPF2026-09-05 — 666 937 MX, 633 359 SPF2026-09-04 — 676 554 MX, 642 190 SPF2026-09-03 — 675 596 MX, 641 147 SPF2026-09-02 — 674 627 MX, 639 932 SPF2026-09-01 — 674 958 MX, 640 343 SPF2026-08-31 — 679 421 MX, 644 387 SPF2026-08-30 — 680 695 MX, 645 473 SPF2026-08-29 — 618 823 MX, 587 379 SPF partial2026-08-28 — 677 171 MX, 642 062 SPF2026-08-27 — 677 157 MX, 641 959 SPF2026-08-26 — 677 089 MX, 641 830 SPF2026-08-25 — 677 219 MX, 641 893 SPF2026-08-24 — 676 834 MX, 641 489 SPF2026-08-23 — 676 669 MX, 641 394 SPF2026-08-22 — 676 355 MX, 641 125 SPF2026-08-21 — 681 191 MX, 645 688 SPF2026-08-20 — 674 470 MX, 639 419 SPF2026-08-19 — 672 105 MX, 637 085 SPF2026-08-18 — 671 693 MX, 636 741 SPF2026-08-17 — 671 752 MX, 636 637 SPF2026-08-16 — 674 092 MX, 638 721 SPF2026-08-14 — 663 240 MX, 628 485 SPF2026-08-13 — 663 264 MX, 628 572 SPF2026-08-12 — 663 252 MX, 628 407 SPF2026-08-11 — 662 761 MX, 627 932 SPF2026-08-10 — 662 160 MX, 627 184 SPF2026-08-09 — 661 672 MX, 626 624 SPF2026-08-08 — 670 439 MX, 634 892 SPF2026-08-07 — 670 484 MX, 634 873 SPF2026-08-06 — 668 231 MX, 632 544 SPF2026-08-05 — 680 832 MX, 644 102 SPF2026-08-04 — 664 122 MX, 628 339 SPF2026-08-02 — 664 010 MX, 628 104 SPF2026-08-01 — 667 030 MX, 630 925 SPF2026-07-31 — 667 040 MX, 630 769 SPF2026-07-30 — 667 152 MX, 630 662 SPF2026-07-29 — 666 778 MX, 630 142 SPF2026-07-28 — 666 803 MX, 630 030 SPF2026-07-27 — 666 750 MX, 629 781 SPF2026-07-26 — 667 887 MX, 630 738 SPF2026-07-25 — 671 693 MX, 634 220 SPF2026-07-24 — 668 195 MX, 626 838 SPF2026-07-23 — 668 612 MX, 627 156 SPF2026-07-22 — 667 580 MX, 626 173 SPF2026-07-21 — 667 464 MX, 626 022 SPF2026-07-20 — 668 961 MX, 627 463 SPF2026-07-19 — 659 183 MX, 618 199 SPF2026-07-18 — 659 259 MX, 618 271 SPF2026-07-17 — 659 253 MX, 618 231 SPF2026-07-16 — 659 459 MX, 618 470 SPF2026-07-15 — 659 420 MX, 618 461 SPF2026-07-14 — 659 112 MX, 618 197 SPF2026-07-13 — 658 711 MX, 617 702 SPF2026-07-12 — 658 108 MX, 617 244 SPF2026-07-11 — 657 701 MX, 616 967 SPF2026-07-10 — 657 207 MX, 616 333 SPF2026-07-09 — 657 304 MX, 616 494 SPF2026-07-08 — 656 808 MX, 615 969 SPF2026-07-07 — 655 988 MX, 615 231 SPF2026-07-06 — 655 261 MX, 614 575 SPF2026-07-05 — 654 926 MX, 614 272 SPF2026-07-04 — 665 047 MX, 623 765 SPF2026-07-03 — 664 686 MX, 623 266 SPF2026-07-02 — 664 961 MX, 623 597 SPF2026-07-01 — 664 715 MX, 623 370 SPF2026-06-30 — 665 299 MX, 624 066 SPF2026-06-29 — 671 597 MX, 630 016 SPF2026-06-28 — 667 370 MX, 626 001 SPF2026-06-27 — 666 220 MX, 624 986 SPF2026-06-26 — 666 177 MX, 624 950 SPF2026-06-25 — 665 951 MX, 624 772 SPF2026-06-24 — 665 655 MX, 624 551 SPF2026-06-23 — 665 823 MX, 624 757 SPF2026-06-22 — 665 950 MX, 625 047 SPF2026-06-21 — 667 342 MX, 626 553 SPF2026-06-20 — 669 301 MX, 628 455 SPF2026-06-15 — 662 137 MX, 623 017 SPF2026-06-08 — 650 013 MX, 611 648 SPF2026-06-01 — 662 428 MX, 622 222 SPF2026-05-18 — 653 826 MX, 613 816 SPF2026-05-11 — 654 275 MX, 614 529 SPF2026-05-04 — 662 839 MX, 622 414 SPF2026-04-30 — 665 325 MX, 624 448 SPF2026-04-27 — 665 219 MX, 624 507 SPF2026-03-01 — 683 543 MX, 639 798 SPF2026-02-01 — 688 114 MX, 641 985 SPF2026-01-01 — 660 114 MX, 616 352 SPF2025-12-01 — 668 692 MX, 622 313 SPF2025-11-01 — 659 524 MX, 613 922 SPF2025-10-01 — 644 366 MX, 599 103 SPF2025-09-01 — 685 366 MX, 635 390 SPF2025-08-01 — 681 988 MX, 632 521 SPF2025-07-01 — 687 700 MX, 638 068 SPF2025-06-01 — 699 879 MX, 648 954 SPF2025-05-01 — 711 257 MX, 659 028 SPF2025-04-01 — 702 306 MX, 651 786 SPF2025-03-01 — 705 611 MX, 653 173 SPF2025-02-01 — 696 358 MX, 644 666 SPF2025-01-01 — 674 214 MX, 626 064 SPF2024-12-01 — 675 247 MX, 626 465 SPF2024-11-01 — 669 912 MX, 614 354 SPF2024-10-01 — 659 879 MX, 603 315 SPF2024-09-01 — 660 693 MX, 604 347 SPF2024-08-01 — 639 733 MX, 586 007 SPF2024-07-02 — 632 526 MX, 578 066 SPF2024-06-01 — 614 961 MX, 562 373 SPF2024-05-01 — 621 817 MX, 566 602 SPF2024-04-01 — 641 948 MX, 582 732 SPF2024-03-01 — 666 638 MX, 601 954 SPF2024-02-01 — 653 497 MX, 588 373 SPF2024-01-01 — 657 371 MX, 586 519 SPF2023-12-01 — 660 455 MX, 588 456 SPF2023-11-01 — 666 944 MX, 591 587 SPF2023-10-01 — 675 039 MX, 597 200 SPF2023-09-01 — 694 895 MX, 612 567 SPF2023-08-01 — 716 729 MX, 622 501 SPF2023-07-01 — 653 321 MX, 565 370 SPF2023-06-01 — 656 260 MX, 561 661 SPF2023-05-01 — 657 236 MX, 561 046 SPF2023-04-01 — 662 162 MX, 562 122 SPF2023-03-01 — 730 155 MX, 620 415 SPF2023-02-01 — 715 023 MX, 602 519 SPF2023-01-01 — 712 767 MX, 599 702 SPF2022-12-01 — 712 641 MX, 594 977 SPF2022-11-01 — 710 891 MX, 590 969 SPF2022-10-01 — 716 152 MX, 594 587 SPF2022-09-01 — 716 956 MX, 595 410 SPF2022-08-11 — 427 823 MX, 354 634 SPF partial2022-07-01 — 968 388 MX, 789 788 SPF alexa2022-06-01 — 1 026 911 MX, 833 170 SPF alexa2022-05-01 — 921 706 MX, 748 398 SPF alexa2022-04-01 — 1 217 939 MX, 976 244 SPF alexa2022-03-01 — 975 521 MX, 779 131 SPF alexa2022-02-01 — 569 414 MX, 464 224 SPF partial alexa2022-01-01 — 552 174 MX, 447 427 SPF partial alexa2021-12-01 — 786 477 MX, 631 833 SPF alexa2021-11-01 — 525 808 MX, 424 311 SPF partial alexa2021-10-01 — 794 460 MX, 633 349 SPF alexa2021-09-01 — 788 407 MX, 628 585 SPF alexa2021-08-01 — 619 384 MX, 493 457 SPF partial alexa2021-07-01 — 728 817 MX, 579 133 SPF alexa2021-06-01 — 660 453 MX, 523 956 SPF alexa2021-05-01 — 788 324 MX, 620 170 SPF alexa2021-04-01 — 792 560 MX, 621 808 SPF alexa2021-03-01 — 646 458 MX, 507 824 SPF alexa2021-02-01 — 430 383 MX, 339 425 SPF partial alexa2021-01-01 — 714 286 MX, 554 817 SPF alexa2020-12-01 — 814 029 MX, 629 118 SPF alexa2020-11-01 — 748 490 MX, 574 865 SPF alexa2020-10-01 — 618 268 MX, 476 027 SPF partial alexa2020-09-01 — 768 508 MX, 586 561 SPF alexa2020-08-01 — 754 330 MX, 572 036 SPF alexa2020-07-01 — 947 188 MX, 717 066 SPF alexa2020-06-01 — 703 956 MX, 531 244 SPF partial alexa2020-05-01 — 965 680 MX, 721 262 SPF alexa2020-04-01 — 859 917 MX, 639 926 SPF alexa2020-03-01 — 780 292 MX, 579 459 SPF alexa2020-02-01 — 947 773 MX, 696 310 SPF alexa2020-01-01 — 565 274 MX, 417 038 SPF partial alexa2019-12-01 — 826 277 MX, 600 095 SPF alexa2019-11-01 — 1 039 570 MX, 747 867 SPF alexa2019-10-01 — 966 667 MX, 692 386 SPF alexa2019-09-01 — 838 362 MX, 594 935 SPF partial alexa2019-08-01 — 1 162 343 MX, 819 141 SPF alexa2019-07-01 — 1 177 952 MX, 806 744 SPF alexa2019-06-01 — 1 205 558 MX, 822 402 SPF alexa2019-05-01 — 1 196 890 MX, 811 837 SPF alexa2019-04-01 — 1 120 142 MX, 752 449 SPF alexa2019-03-01 — 1 170 801 MX, 787 932 SPF alexa2019-02-01 — 1 202 345 MX, 799 255 SPF alexa2019-01-01 — 1 190 206 MX, 783 686 SPF alexa2018-12-01 — 1 196 068 MX, 792 282 SPF alexa2018-11-01 — 1 177 133 MX, 775 137 SPF alexa2018-10-01 — 1 140 868 MX, 743 256 SPF alexa2018-09-01 — 1 183 473 MX, 765 011 SPF alexa2018-08-01 — 1 194 344 MX, 772 448 SPF alexa2018-07-01 — 1 165 617 MX, 745 554 SPF alexa2018-06-01 — 1 193 038 MX, 753 513 SPF alexa2018-05-01 — 1 168 881 MX, 732 275 SPF alexa2018-04-01 — 1 174 598 MX, 730 483 SPF alexa2018-03-01 — 827 056 MX, 516 103 SPF partial alexa2018-02-01 — 1 195 663 MX, 725 044 SPF alexa2018-01-01 — 813 525 MX, 512 876 SPF alexa2017-12-01 — 818 419 MX, 513 903 SPF alexa2017-11-01 — 815 080 MX, 507 477 SPF alexa2017-10-01 — 823 380 MX, 508 173 SPF alexa2017-09-01 — 815 671 MX, 500 347 SPF alexa2017-08-01 — 829 376 MX, 505 516 SPF alexa2017-07-01 — 830 824 MX, 502 438 SPF alexa2017-06-01 — 828 635 MX, 497 007 SPF partial alexa2017-05-01 — 828 210 MX, 493 097 SPF alexa2017-04-01 — 828 454 MX, 490 217 SPF alexa2017-03-01 — 824 804 MX, 483 151 SPF alexa2017-02-01 — 839 476 MX, 482 733 SPF alexa2017-01-01 — 827 995 MX, 470 990 SPF alexa2016-12-01 — 825 158 MX, 467 480 SPF alexa2016-11-01 — 837 849 MX, 472 624 SPF alexa2016-10-01 — 838 377 MX, 469 807 SPF alexa2016-09-01 — 835 089 MX, 462 936 SPF alexa2016-08-01 — 848 095 MX, 469 528 SPF alexa2016-07-01 — 842 098 MX, 463 893 SPF alexa2016-06-01 — 848 829 MX, 462 786 SPF alexa2016-05-01 — 843 824 MX, 455 820 SPF alexa2016-04-01 — 843 843 MX, 449 460 SPF alexa2016-03-01 — 865 090 MX, 456 873 SPF alexa2016-02-01 — 862 585 MX, 450 683 SPF alexa2016-01-22 — 845 356 MX, 440 606 SPF alexa
Data source: https://openintel.nl/data/forward-dns/top-lists/
Generated automatically from OpenINTEL Tranco snapshot 2026-09-16. Aggregates only — raw OpenINTEL data is deleted after analysis per their data agreement.
Last build: 2026-09-18T03:18:01Z.