Summary

  • Google Workspace and Microsoft 365 together received mail for 38.6% of MX-publishing domains in a measured popular-domain sample, but that is a domain share, not a measure of mailboxes, messages or global traffic.
  • The useful resilience question is not whether concentration exists. It is whether an organization can move routing, authentication, administration and retained mail under a tested clock when a provider boundary fails.

Internet Society Pulse republished a deceptively simple measurement on 25 August. In the 18 July 2026 snapshot behind it, Google Workspace accounted for 21.8% of domains with MX records in the measured Tranco top million and Microsoft 365 for 16.8%. Together they reached 38.6%. The next named provider, Proofpoint, stood at 1.9%. Self-hosting, meanwhile, had fallen from 44.6% in 2016 to 22.4%, including a further half-percentage-point decline in the preceding thirty days.

Those figures describe an important change in the shape of email infrastructure. They do not yet describe a failure.

What the measurement can see

Mail routing leaves a public trace. An MX record names the mail-transfer system through which a domain can be reached. The measurement process classifies the lowest-preference MX hostname against provider dictionaries and also reads SPF and DMARC records. A typical daily run found roughly 659,000 domains with MX records and 618,000 with SPF records.

The data foundation is inspectable. OpenINTEL measures the current Tranco top-million list at least daily and records MX alongside other DNS answers. Tranco averages four source rankings over thirty days and archives list identities for reproducibility.

But the denominator matters. The 38.6% is a share of MX-publishing domains in this popular-domain sample, not of the world's mailboxes, messages, users or revenue. Tranco leans towards popular sites in the United States and Europe. The classifier can also miss providers behind customer-branded hostnames, CNAMEs it does not unroll or flattened SPF data. The long tail mixes real decentralization with the limits of the dictionary.

The control surface behind an MX record

Changing an MX record is only one move. A domain may also need new DKIM keys, revised SPF, preserved DMARC alignment, migrated identities and archives, rebuilt retention rules, reconnected applications and protected recovery addresses. The old provider may still hold queued mail while the new one begins accepting it. DNS time-to-live is only one clock among several.

SMTP further complicates a dramatic reading of concentration. Internet mail is store-and-forward infrastructure. A sending server normally queues and retries after temporary delivery failures. A short intake outage is therefore not automatically a loss event. Harm depends on duration, retry policy, filtering decisions, administrative access and whether the recipient can restore service before queues expire or senders give up.

That is why concentration should be treated as an exposure signal, not a complete risk score. Two providers can create a wide common boundary: one outage, filtering rule or account-control decision can touch many organizations at once. Yet the MX share alone cannot tell us how many of those organizations have independent administrator identities, recent exports, a second receiving path or a rehearsed cutover.

Self-hosting is not the automatic answer

The fall in self-hosting also reflects operational choice. Large providers pool abuse defenses, availability engineering and authentication work that many organizations do not want to reproduce. A small independent server can be more fragile than a large platform.

The relevant distinction is recoverable versus untested. An organization can use a large provider while keeping domain control, emergency identities, exports and a cutover plan outside the same failure boundary. It can also self-host behind one administrator, one upstream and one untested backup. Ownership labels do not settle resilience.

The new measurement has done the first job: it has made concentration visible. The next useful metric is how quickly and completely a domain can recover or move.

Sources