Email authentication census, October 2026: who hosts the top 5,000 domains’ email

On 18 October 2026 we measured the same 5,000 domains as our September census again, live, with dig. Google’s mail servers are the first stop for 34.1% of the 3,526 domains whose MX records name a mail server, and Microsoft 365 for 14.4%; security gateways sit in front of another 10.7%, and 15.5% receive on a host under their own name. In six weeks, 23 domains tightened their DMARC policy and one loosened it, DMARC went from 68.5% to 68.7%, and 30 domains changed who receives their mail. Five months after the new DMARC standard dropped the pct tag, 35.0% of DMARC records still carry it. And 157 of 568 BIMI records (27.6%) don’t meet Gmail’s rules for showing a logo.

Every number comes from our own DNS queries; nothing is modelled or borrowed from another report. The method is below, step by step, and the CSV of every figure is free to reuse under CC BY 4.0.

What changed between September and October?

Shares are of the domains measured each time (4,984 and 4,982 of 5,000). Domain by domain, over the 4,965 measured both times with every name answered:

• DMARC: 15 domains published a record for the first time (5 at reject, 2 at quarantine, 8 at none); one removed its record.
• Policies: 23 tightened (10 from none to reject, 8 from none to quarantine, 5 from quarantine to reject); one loosened, from quarantine to none.
• SPF: 13 added, 6 removed. MTA-STS: 4 added, 0 removed. BIMI: 5 added, 0 removed.
• Mail hosts: 30 domains (0.6%) changed the service their mail reaches first, in every direction: Google gained 6 and lost 5; 2 moved from Proofpoint to Microsoft 365 and 2 from Google to Proofpoint.

Six weeks is short, and the direction is the story: nearly every DMARC change made a policy stricter.

Who receives email for the top 5,000 domains?

The service behind each domain’s most-preferred MX host, the first server its mail reaches, for the 3,526 domains whose MX records name a mail server. Another 1,456 publish no MX record, or a “null MX” saying they take no mail.

“Google” is every domain whose first MX host is Google’s, Google Workspace customers and Google’s own sites alike. Proofpoint, Mimecast and Barracuda are security gateways that filter mail before handing it to a mailbox provider. Amazon SES, Mailgun and Cloudflare Email Routing receive mail for automation or forwarding rather than hosting mailboxes. The host domains that come up most among the ones our detection doesn’t recognise: iphmx.com, amazon.com, qq.com, mail.ru, registrar-servers.com, outlook.com, gpphosted.com, mxhichina.com (the top 25 are in the CSV).

Among the top 1,000 the picture is much the same, with more gateways: Google 32.5%, Microsoft 365 14.5%, Proofpoint 10.2%, against 34.5%, 14.4% and 7.8% for ranks 1,001–5,000.

What sits behind the security gateways?

A gateway hides the mailbox provider from the MX record, but the SPF record often names it. Of the 376 domains whose mail reaches a gateway first, 105 (27.9%) authorise Microsoft 365 to send for them and 80 (21.3%) authorise Google. That is evidence, not proof: a domain can authorise a service it only sends through.

Which services are allowed to send for them?

Services named anywhere in each domain’s SPF record, following every include, as a share of the 3,748 domains that publish SPF:

39.1% of SPF publishers authorise at least one sending service besides a mailbox provider (an email platform, help desk or CRM), and 9.6% authorise three or more. Every one of them is another system that can send as the domain, which is why the who-sends-email tool lists them for any domain.

How strict are DMARC policies now?

• 78.7% of DMARC records enforce with quarantine or reject; in the top 1,000, 61.0% are at reject.
• 89.0% ask for aggregate reports with a rua= address, 52.2% for failure reports (ruf=), and 24.9% set a separate subdomain policy (sp=).
• The pct tag outlived its standard. RFC 9989, the DMARC standard since May 2026, dropped pct and added t= for testing. 1,198 records (35.0%) still carry pct: 1,115 as pct=100, which changes nothing, and 83 below 100, 8 of them at pct=0.
• The new tags have barely arrived: np= (a policy for subdomains that don’t exist) on 8 domains, t= on 3, psd= on 7, up from 7, 2 and 6 in September.
• 5.2% of DMARC records are published as a CNAME to a DMARC vendor’s zone; we follow the CNAMEs.

How many BIMI logos can Gmail show?

568 domains (11.4%) publish a BIMI record. Gmail shows the logo only with a mark certificate (a VMC or CMC) and a DMARC policy of quarantine or reject applied to all mail (pct=100), according to Google’s BIMI setup page (checked 19 Oct 2026). Against those rules:

The 157 that miss mostly lack a certificate (150); 14 sit on a DMARC policy of none. We checked the records only: whether a certificate is valid and the logo file is correct is for the BIMI checker to say, one domain at a time.

How do SPF records end?

Of 3,748 SPF records, 1,966 (52.5%) end in -all (fail what isn’t listed), 1,554 (41.5%) in ~all (soft fail), 82 in ?all, and 146 have no all mechanism. 50 domains publish more than one SPF record, which ends every SPF check on them in a permanent error (RFC 7208), down from 53 in September.

How was this measured?

1. Domains. The top 5,000 of Tranco list XN6XN, the same 5,000 as the first run: a research ranking of the most popular sites, generated on 5 September 2026 from CrUX, Farsight, Majestic, Cloudflare Radar and Cisco Umbrella over the previous 30 days, registrable domains only (described in “Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation”, NDSS 2019).
2. One dig call per domain, asking five names of Cloudflare’s public resolver, and of Google’s (8.8.8.8, with an 8-second timeout) only if 1.1.1.1 gave no answer at all:

   dig +time=4 +tries=2 +noall +answer +comments @1.1.1.1 \
     example.com TXT  _dmarc.example.com TXT  example.com MX \
     _mta-sts.example.com TXT  default._bimi.example.com TXT

3. Politely. Six domains at a time and at most six started a second, so the resolver saw no more than 30 queries a second from us, on 18 October 2026 from 19:57 to 20:14 UTC. The first run, on 6 September from 09:37 to 09:42 UTC, used 20 at a time with no cap. Only public DNS was queried; nothing connected to anyone’s mail or web servers.
4. What counts. A domain is measured unless its own name answers NXDOMAIN or SERVFAIL. SPF is an apex TXT record starting v=spf1. DMARC is a TXT record containing v=DMARC1 at _dmarc, with CNAMEs followed; the policy is the first record’s p=. MX is any MX record. MTA-STS is a TXT record at _mta-sts starting v=STSv1, and BIMI one at default._bimi starting v=BIMI1. These are the first run’s rules.
5. Three fixes, applied to both runs. We re-read the first run’s stored answers with the same code: TXT records split into several strings are joined with nothing in between (RFC 7208, section 3.3), CNAME chains are followed to the end, and the rua=, sp= and pct= shares count every DMARC record (the first run counted them only on domains that also publish SPF). That moves the first run’s DMARC count from 3,413 to 3,415, MTA-STS from 138 to 140, and its rua= share from 85.9% to 89.0% (sp= from 24.3% to 24.8%, pct= from 34.2% to 35.5%); its headline percentages don’t change. The September figures on this page are the re-read ones, and the first census now carries the corrected shares.
6. Answers we couldn’t get. 18 domains answered NXDOMAIN or SERVFAIL for their own name and are left out (16 in September). 23 more answered SERVFAIL for another of their names; we asked them again at 20:21 UTC with the same command, and 11 still failed, so those names count as absent, as in the first run. Several failures were DNSSEC validation errors in one DMARC vendor’s zone (under pphosted.com) that came and went between resolvers; the records are there when validation is switched off. The domain-by-domain changes leave out every domain with a SERVFAIL in either run (14), so they compare 4,965 domains.
7. Mail hosts and senders. We ran SuperMailOS’s own who-sends-email detection over each domain’s measured MX and SPF records, looking up every include and redirect in the SPF tree live (one lookup per name for the whole run, at most 20 a second). DKIM selectors weren’t probed. A domain’s mail host is the service matching its most-preferred MX host; the September hosts are read the same way from that run’s MX records.
8. A second resolver. A random sample of 50 domains (15 without SPF, 15 without DMARC, 10 without MTA-STS, 10 with DMARC) asked again of Quad9 (9.9.9.9) was classified the same way 50 times out of 50.
9. Limits. DNS changes daily, so a rerun will differ slightly. A record we couldn’t see counts as absent. Detection sees only what MX and SPF reveal: a service that sends under its own domain, or signs only with DKIM, doesn’t show. And Tranco ranks popularity, not how much email a domain sends.

Where can I get the data?

Download the CSV (both runs, every figure on this page). One row per number, with columns section, metric, cohort, run, measured_on, count, base, percent and label; base is what the percentage is of. It is published under CC BY 4.0: use it for anything, with a link back to this page.

How should I cite this census?

SuperMailOS (Adee Labs), “Email Authentication Census, October 2026”, 21 Oct 2026, https://supermailos.com/learn/email-auth-census-2026-10. Data: CC BY 4.0.

How does your own domain compare?

The free email checker runs the same record checks on any domain, the DMARC checker explains every tag including pct and t=, and who-sends-email shows the mail host and senders this census counted. For what the records do, start with SPF, DKIM and DMARC explained.

Questions