RESEARCH DOSSIER / 2026

Published researchReleased August 14, 2026

Observed MX provider benchmark 2026

Across 99,300 observed domains, rank-adjusted DMARC adoption was 89.4% for Microsoft 365 and 80.6% for Google Workspace. The comparison is observational and does not show that either provider caused the difference.

Download aggregate CSVDownload JSON

58.1%

DMARC adoption

57,732 of 99,300

64.0%

Enforcement among publishers

36,938 of 57,732

20.7%

Publishers without aggregate reporting

11,959 of 57,732

2.6%

SPF recursive lookup failures

1,810 of 69,338

KEY FINDINGS

Microsoft 365 leads on DMARC deployment; Google leads on SPF health and BIMI

These are rank-band-standardized comparisons, which reduce the effect of one operator appearing more often among highly ranked domains. Each estimate uses the complete provider base shown below; the downloadable JSON includes the numerator and denominator for every rank-band component.

DMARC

Microsoft 365: 89.4% adoption and 68.3% enforcement

Google Workspace measured 80.6% and 62.1%, respectively. Bases: 12,222 Microsoft 365 and 19,450 Google Workspace domains.

REPORTING + SPF

The trade-off runs in opposite directions

Publishers without aggregate reporting: 12.6% on Microsoft 365 versus 19.1% on Google. SPF lookup failures: 3.9% versus 2.6%.

BIMI + GATEWAYS

Google’s enforcing domains publish BIMI more often

BIMI among enforcing domains was 18.0% for Google and 12.7% for Microsoft 365. Recognized gateways reached 76.0% enforcement, but gateways may conceal the mailbox platform beneath them.

This study describes public DNS configuration among observed groups. It does not establish that choosing an MX operator improves authentication, and it does not measure compromise, mail delivery or internal security controls.

SCOPE

What this study measures

  • 01The same pinned 100,000-domain corpus used by the State of DMARC research.
  • 02Complete MX exchanges and priorities, classified with a versioned public rule set.
  • 03Raw and rank-band-standardized comparisons, with every denominator exposed.

RESEARCH QUESTIONS

Questions the data answers

  1. 01Which observed MX groups publish and enforce DMARC most often?
  2. 02Where are aggregate-reporting addresses missing?
  3. 03How do SPF multiple-record and recursive lookup failures compare?
  4. 04How often do enforcing domains publish a BIMI record?

RELEASE RECORD

How this research became citable

  1. August 14, 2026

    Classifier and 100-domain manual QA completed

  2. August 14, 2026

    Pinned 100,000-domain scan and aggregate frozen

  3. August 14, 2026

    Evidence package, charts and report released

    The release passed the stated evidence and review gates.

DELIVERY PACKAGE

What is available

  • Four reusable SVG charts and PNG newsroom exports.
  • Aggregate provider and rank-band CSV/JSON tables.
  • Methodology, classifier version and citation text.
  • A 25–40-target infrastructure and email-operations media brief.

Media posture

Offer 3–5 top-matched journalists a 48-hour first look; the dataset remains non-exclusive.

Published comparisons

Groups below the 30-domain threshold are suppressed. Every visible percentage includes its numerator and denominator.

GroupObservedDMARCEnforcementNo reportingSPF lookup failureBIMI among enforcing
Unknown operator31,75660.5% (19228/31756)56.4% (10840/19228)28.8% (5543/19228)1.9% (515/27288)8.7% (943/10840)
No published MX27,20615.7% (4267/27206)81.3% (3470/4267)27% (1151/4267)0.6% (28/4486)1.8% (62/3470)
Google Workspace19,45081.1% (15770/19450)62.7% (9886/15770)18.7% (2954/15770)2.6% (458/17294)18.3% (1813/9886)
Microsoft 36512,22289.5% (10938/12222)68% (7436/10938)12.8% (1399/10938)3.9% (473/12041)12.4% (923/7436)
Recognized gateway5,22895% (4965/5228)76.4% (3791/4965)5% (249/4965)4.5% (231/5109)15.6% (591/3791)
Mixed operators2,11782% (1736/2117)61% (1059/1736)19.6% (341/1736)3.5% (66/1889)15.2% (161/1059)
Other operator1,32162.7% (828/1321)55.1% (456/828)38.9% (322/828)3.2% (39/1231)11.2% (51/456)

Rank-adjusted provider comparison

The same Tranco rank-band distribution is applied to every operator. This reduces rank-composition bias; it does not turn the observational comparison into a causal one.

Observed MX operatorBaseDMARCEnforcementNo reportingSPF lookup failureBIMI among enforcing
Google Workspace19,45080.6%62.1%19.1%2.6%18.0%
Microsoft 36512,22289.4%68.3%12.6%3.9%12.7%
Recognized gateway5,22894.7%76.0%5.3%4.6%15.3%
Other operator1,32163.3%56.4%38.3%3.2%11.3%
Mixed operators2,11782.0%61.3%19.4%3.5%15.6%
Unknown operator31,75660.8%56.7%28.4%1.9%9.0%

Percentages are weighted estimates. “Base” is the total observed provider group; metric-specific bases and every rank-band numerator and denominator are included in the JSON download.

Reusable charts

SVG and PNG versions are licensed CC BY 4.0.

MX provider benchmark: adoption chart
Download SVGDownload PNG
MX provider benchmark: reporting chart
Download SVGDownload PNG
MX provider benchmark: spf chart
Download SVGDownload PNG
MX provider benchmark: bimi chart
Download SVGDownload PNG

Methodology

  1. 1.Resolve DMARC, SPF, BIMI and MX through the same public resolvers within one 24-hour scan window.
  2. 2.Classify the observed inbound MX operator from official hostname patterns. Third-party gateways remain a separate group because they can conceal the underlying mailbox platform.
  3. 3.Standardize each provider result against the corpus rank-band distribution to reduce rank-composition bias.

Measurement record

Corpus and observations
99,300 observed of 100,000
Scan window
Aug 14, 2026, 05:00 PM UTC to Aug 14, 2026, 05:08 PM UTC
Scanner version
2.0.0
MX classifier version
2026-08-14.2

Pinned source snapshot

dcf2107c17aee2483b65cde6f9c09c6aa6355adefb987a66a36294d15b29fa7b

Limitations

  • — MX identifies observed inbound infrastructure, not necessarily the underlying mailbox provider.
  • — The results describe configuration differences and do not establish that a provider caused them.
  • — The ranked web-domain corpus is not a census of every active business email domain.

Source record

Google Workspace MX setup

Official current and legacy Google MX patterns.

Microsoft 365 external DNS records

Official Exchange Online MX hostname pattern.

State of DMARC 2026

Parent corpus, definitions and global baseline.

Publication policy

Publish aggregate provider groups only. Unknown and mixed MX answers remain visible rather than being forced into a vendor category.