According to Live Direct Marketing's daily Tranco top-1M scan (July 13, 2026), FireEye is the mailbox provider for 312 domains — 0.05% of 658,711 domains with MX records. Detection method: primary MX record (lowest preference).
FireEye, now operating under the Trellix brand (owned by Broadcom), provides email security gateways and threat detection solutions that organisations deploy to filter messages, detect threats, and enforce email security policies. Rather than a native mailbox provider, FireEye acts as an intermediary between senders and recipients.
FireEye's presence in primary MX records skews toward mid-market and smaller organisations rather than the largest global brands, with international distribution led by .com domains and a predominantly US-global regional pattern. For email operations teams and senders, this means FireEye gateways are encountered regularly but not as a dominant provider, making them a secondary but material factor in deliverability troubleshooting and bounce investigation.
| Tranco rank band | Domains | Share of its base |
|---|---|---|
| Top 1,000 | 1 | 0.3% |
| Top 10,000 | 7 | 2.2% |
| Top 100,000 | 61 | 19.6% |
| Top 1,000,000 | 224 | 71.8% |
| Unranked | 19 | 6.1% |
| TLD | Domains | Share | |
|---|---|---|---|
| .com | 119 | 38.1% | |
| .com.br | 21 | 6.7% | |
| .ca | 14 | 4.5% | |
| .co.jp | 12 | 3.8% | |
| .pl | 11 | 3.5% | |
| .de | 8 | 2.6% | |
| .jp | 8 | 2.6% | |
| .gov | 7 | 2.2% | |
| .br | 6 | 1.9% | |
| .com.ph | 6 | 1.9% |
Cross-tabulated from the same daily snapshot — the other email services seen on the same 312 domains.
| Type | Service | Domains | Share of FireEye users |
|---|---|---|---|
| ESP | FireEye / Trellix | 111 | 35.6% |
| ESP | Amazon SES | 30 | 9.6% |
| ESP | Salesforce | 24 | 7.7% |
| ESP | SendGrid (Twilio) | 17 | 5.4% |
| ESP | Zendesk | 14 | 4.5% |
| ESP | Mailgun | 10 | 3.2% |
| ESP | Mailchimp | 8 | 2.6% |
| ESP | Mandrill | 7 | 2.2% |
| ESP | SparkPost | 7 | 2.2% |
| ESP | HubSpot | 6 | 1.9% |
Because FireEye operates as an email security gateway rather than a native mailbox provider, authentication signals (SPF, DKIM, DMARC) and sender reputation are evaluated at the gateway layer before messages reach recipients. Organisations using FireEye often enforce strict authentication requirements or apply content scanning that can introduce delivery delays or rejections; configuration varies significantly by tenant, so senders should monitor bounce patterns and delivery latency when targeting organisations known to use FireEye gateways.
See the full FireEye data page (KPI cards, trend, sample domains) →
If your recipient base includes mid-market and smaller organisations—particularly in regulated sectors like finance or healthcare—testing against FireEye is worthwhile to understand gateway filtering behaviour. However, FireEye configuration is tenant-specific, so results won't predict delivery across all FireEye deployments; focus instead on ensuring strong authentication credentials and identifying unexpected delays in delivery paths.
312 domains in the Tranco top-1M use FireEye as their mailbox provider as of July 13, 2026 (0.05% of domains with MX records), according to Live Direct Marketing's daily DNS scan.
FireEye accounts for 0.05% of domains with MX records in the top 1M. Whether you should seed a test mailbox there depends on how much of your audience it represents — the co-usage table above shows the services it appears alongside most.
FireEye's largest TLD is .com (38.1% of its domains); it appears across 70 TLDs in total.