Observed MX provider benchmark 2026
===================================

Status: Published 2026-08-14T17:10:30.000Z
Audience: Email, security, infrastructure and IT publications
Contact target: 25–40 highly matched email, identity, security and infrastructure editors

Plain-language summary
A fresh scan of the pinned Tranco top 100,000 compares Microsoft 365, Google Workspace, recognized gateways and other observed MX operators without treating provider choice as a cause of better security.

Key findings
- 99,300 of 100,000 domains were observed during the recorded scan window.
- Rank-adjusted DMARC adoption: Microsoft 365 89.4% (base 12,222) vs Google Workspace 80.6% (base 19,450).
- Rank-adjusted enforcement among DMARC publishers: Microsoft 365 68.3% vs Google Workspace 62.1%.
- Publishers without aggregate reporting: Microsoft 365 12.6% vs Google Workspace 19.1%.
- SPF lookup-limit failures: Microsoft 365 3.9% vs Google Workspace 2.6%.
- BIMI among enforcing domains: Google Workspace 18.0% vs Microsoft 365 12.7%.
- Recognized gateways measured 76.0% rank-adjusted enforcement (base 5,228); gateways may conceal the underlying mailbox platform.
- These are observational comparisons. They do not show that provider choice caused the differences.

Embargo approach
Offer 3–5 top-matched journalists a 48-hour first look; the dataset remains non-exclusive.

Pitch angles
- Industry: Microsoft 365 and Google Workspace domains do not reach enforcement at the same rate after rank adjustment.
- Operational: The reporting and SPF gaps behind apparently valid DMARC deployments.
- Standards: What observed MX infrastructure can and cannot tell us about authentication maturity.

Methodology
- Resolve DMARC, SPF, BIMI and MX through the same public resolvers within one 24-hour scan window.
- Classify the observed inbound MX operator from official hostname patterns. Third-party gateways remain a separate group because they can conceal the underlying mailbox platform.
- Standardize each provider result against the corpus rank-band distribution to reduce rank-composition bias.

Limitations
- MX identifies observed inbound infrastructure, not necessarily the underlying mailbox provider.
- The results describe configuration differences and do not establish that a provider caused them.
- The ranked web-domain corpus is not a census of every active business email domain.

Publication policy
Publish aggregate provider groups only. Unknown and mixed MX answers remain visible rather than being forced into a vendor category.

Sources
- Google Workspace MX setup: https://knowledge.workspace.google.com/admin/domains/set-up-mx-records-for-google-workspace, Official current and legacy Google MX patterns.
- Microsoft 365 external DNS records: https://learn.microsoft.com/en-us/microsoft-365/enterprise/external-domain-name-system-records?view=o365-worldwide, Official Exchange Online MX hostname pattern.
- State of DMARC 2026: /research/state-of-dmarc-2026, Parent corpus, definitions and global baseline.

Suggested citation
Palisade. “Observed MX provider benchmark 2026.” 2026-08-14. https://www.palisade.email/research/email-provider-benchmark-2026

Reusable charts
- adoption (SVG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/adoption.svg
- adoption (PNG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/adoption.png
- reporting (SVG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/reporting.svg
- reporting (PNG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/reporting.png
- spf (SVG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/spf.svg
- spf (PNG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/spf.png
- bimi (SVG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/bimi.svg
- bimi (PNG): https://www.palisade.email/research/email-provider-benchmark-2026/charts/bimi.png
Visible attribution: Source: Palisade: Observed MX provider benchmark 2026 (https://www.palisade.email/research/email-provider-benchmark-2026), CC BY 4.0.