Microsoft Defender for Office 365 email service provider (ESP)
According to Live Direct Marketing's daily Tranco top-1M scan (September 12, 2026), Microsoft Defender for Office 365 is the email service provider (ESP) for 160 domains — 0.03% of 629,828 SPF-publishing domains. Detection method: include: mechanisms in the SPF record.
Key facts
- 160 domains in the Tranco top-1M use Microsoft Defender for Office 365 (0.03% of SPF-publishing domains).
- Snapshot date: 2026-09-12 — recomputed every day.
- Strongest TLD: .com (46.9% of its domains).
- Most co-used service: Microsoft 365.
- Directory category: email security gateway.
Why Microsoft Defender for Office 365 appears in this category
Microsoft 365 EOP / Defender — primary M365 mail security.
We classify it as a email security gateway from include: mechanisms in the SPF record matching a maintained provider rule. This is infrastructure attribution from public DNS, not evidence of a direct contract or exclusive use.
Microsoft Defender for Office 365 is a cloud-based threat-protection service operated by Microsoft that scans inbound and outbound email for malware, phishing, and other security threats within organisations running Microsoft 365 (formerly Office 365). It is embedded in Microsoft's enterprise email infrastructure rather than deployed as a separate appliance.
In mail-routing terms, the presence of Microsoft Defender SPF includes in a domain's record indicates that organisation uses the Microsoft 365 platform. The distribution pattern—concentrated in smaller organisations and .com domains—reflects the broader Microsoft 365 adoption curve; this matters for senders because it shapes the threat-scoring, rate-limiting, and authentication checks applied to incoming mail at those endpoints.
Where Microsoft Defender for Office 365 sits in the Tranco ranking
| Tranco rank band | Domains | Share of its base |
|---|---|---|
| Top 1,000 | 0 | 0.0% |
| Top 10,000 | 0 | 0.0% |
| Top 100,000 | 18 | 11.2% |
| Top 1,000,000 | 142 | 88.8% |
| Unranked | 0 | 0.0% |
Top-level domain split
| TLD | Domains | Share | |
|---|---|---|---|
| .com | 75 | 46.9% | |
| .org | 10 | 6.2% | |
| .co.uk | 10 | 6.2% | |
| .net | 7 | 4.4% | |
| .nl | 4 | 2.5% | |
| .pl | 4 | 2.5% | |
| .fr | 4 | 2.5% | |
| .com.br | 4 | 2.5% | |
| .de | 3 | 1.9% | |
| .com.ar | 2 | 1.2% |
What Microsoft Defender for Office 365 users also use
Cross-tabulated from the same daily snapshot — the other email services seen on the same 160 domains.
| Type | Service | Domains | Share of Microsoft Defender for Office 365 users |
|---|---|---|---|
| Mailbox | Microsoft 365 | 78 | 48.8% |
| Mailbox | Proofpoint | 19 | 11.9% |
| Mailbox | Mimecast | 16 | 10.0% |
| Mailbox | Unknown / Other | 13 | 8.1% |
| Mailbox | Self-Hosted | 10 | 6.2% |
| Mailbox | Cisco IronPort | 6 | 3.8% |
| ESP | Mimecast | 17 | 10.6% |
| ESP | Proofpoint | 16 | 10.0% |
| ESP | Salesforce | 16 | 10.0% |
| ESP | HubSpot | 15 | 9.4% |
SPF authentication and infrastructure signalling
When a domain publishes an SPF include for Microsoft Defender (typically include:spf.protection.outlook.com or similar), it signals both the use of Microsoft 365 and the specific mail-acceptance topology senders should expect. The SPF include scope, alignment with DMARC policy, and the envelope sender domain all interact with Defender's threat-scoring logic; misconfigured SPF or DMARC can cause legitimate mail to be flagged as high-risk or rate-limited even before Defender's content filters run. Understanding this topology is essential for senders diagnosing delivery problems to Microsoft 365 tenants.
See the full Microsoft Defender for Office 365 data page (KPI cards, trend, sample domains) →
Run a free inbox-placement test across Gmail, Outlook, Yahoo and more — see exactly where your mail lands and why.
Frequently asked questions
Do I need to do anything special to deliver mail to Microsoft Defender for Office 365 users?
No special configuration is required on your end; Microsoft Defender runs transparently on the receiving organisation's Microsoft 365 tenant. Maintaining correct SPF, DKIM, and DMARC alignment, and avoiding known phishing signals (lookalike domains, mismatched reply-to headers), minimises the risk that Defender's threat filters will reject or delay your mail.
How many domains use Microsoft Defender for Office 365?
160 domains in the Tranco top-1M use Microsoft Defender for Office 365 as their email service provider (ESP) as of September 12, 2026 (0.03% of SPF-publishing domains), according to Live Direct Marketing's daily DNS scan.
Is Microsoft Defender for Office 365 common enough to affect email deliverability testing?
Microsoft Defender for Office 365 accounts for 0.03% of SPF-publishing domains in the top 1M. Whether you should seed a test mailbox there depends on how much of your audience it represents — the co-usage table above shows the services it appears alongside most.
Which countries or TLDs use Microsoft Defender for Office 365 most?
Microsoft Defender for Office 365's largest TLD is .com (46.9% of its domains); it appears across 39 TLDs in total.