According to Live Direct Marketing's daily Tranco top-1M scan (July 13, 2026), Microsoft Defender for Office 365 is the email service provider (ESP) for 161 domains — 0.03% of 617,702 SPF-publishing domains. Detection method: include: mechanisms in the SPF record.
Microsoft Defender for Office 365 is a cloud-based threat-protection service operated by Microsoft that scans inbound and outbound email for malware, phishing, and other security threats within organisations running Microsoft 365 (formerly Office 365). It is embedded in Microsoft's enterprise email infrastructure rather than deployed as a separate appliance.
In mail-routing terms, the presence of Microsoft Defender SPF includes in a domain's record indicates that organisation uses the Microsoft 365 platform. The distribution pattern—concentrated in smaller organisations and .com domains—reflects the broader Microsoft 365 adoption curve; this matters for senders because it shapes the threat-scoring, rate-limiting, and authentication checks applied to incoming mail at those endpoints.
| Tranco rank band | Domains | Share of its base |
|---|---|---|
| Top 1,000 | 0 | 0.0% |
| Top 10,000 | 0 | 0.0% |
| Top 100,000 | 16 | 9.9% |
| Top 1,000,000 | 128 | 79.5% |
| Unranked | 17 | 10.6% |
| TLD | Domains | Share | |
|---|---|---|---|
| .com | 74 | 46.0% | |
| .co.uk | 12 | 7.5% | |
| .org | 12 | 7.5% | |
| .net | 5 | 3.1% | |
| .de | 4 | 2.5% | |
| .com.ar | 3 | 1.9% | |
| .com.br | 3 | 1.9% | |
| .fr | 3 | 1.9% | |
| .pl | 3 | 1.9% | |
| .nl | 3 | 1.9% |
Cross-tabulated from the same daily snapshot — the other email services seen on the same 161 domains.
| Type | Service | Domains | Share of Microsoft Defender for Office 365 users |
|---|---|---|---|
| Mailbox | Microsoft 365 | 77 | 47.8% |
| Mailbox | Proofpoint | 19 | 11.8% |
| Mailbox | Mimecast | 17 | 10.6% |
| Mailbox | Unknown / Other | 12 | 7.5% |
| Mailbox | Self-Hosted | 9 | 5.6% |
| Mailbox | Google Workspace | 6 | 3.7% |
| ESP | Mandrill | 19 | 11.8% |
| ESP | Mimecast | 19 | 11.8% |
| ESP | Proofpoint | 18 | 11.2% |
| ESP | Salesforce | 15 | 9.3% |
When a domain publishes an SPF include for Microsoft Defender (typically include:spf.protection.outlook.com or similar), it signals both the use of Microsoft 365 and the specific mail-acceptance topology senders should expect. The SPF include scope, alignment with DMARC policy, and the envelope sender domain all interact with Defender's threat-scoring logic; misconfigured SPF or DMARC can cause legitimate mail to be flagged as high-risk or rate-limited even before Defender's content filters run. Understanding this topology is essential for senders diagnosing delivery problems to Microsoft 365 tenants.
See the full Microsoft Defender for Office 365 data page (KPI cards, trend, sample domains) →
No special configuration is required on your end; Microsoft Defender runs transparently on the receiving organisation's Microsoft 365 tenant. Maintaining correct SPF, DKIM, and DMARC alignment, and avoiding known phishing signals (lookalike domains, mismatched reply-to headers), minimises the risk that Defender's threat filters will reject or delay your mail.
161 domains in the Tranco top-1M use Microsoft Defender for Office 365 as their email service provider (ESP) as of July 13, 2026 (0.03% of SPF-publishing domains), according to Live Direct Marketing's daily DNS scan.
Microsoft Defender for Office 365 accounts for 0.03% of SPF-publishing domains in the top 1M. Whether you should seed a test mailbox there depends on how much of your audience it represents — the co-usage table above shows the services it appears alongside most.
Microsoft Defender for Office 365's largest TLD is .com (46.0% of its domains); it appears across 42 TLDs in total.