MailTester Ninja

The email authentication funnel: 91.7% publish SPF, only 26.7% actually reject

evgeni — Mon, 31 Aug 2026 06:20:02 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

We took every mail-enabled domain in the sample (those with MX) and walked them down the authentication funnel:

Mail-enabled (have MX), 100%
Publish SPF, 91.7%
Publish DMARC, 77.6%
Enforce (quarantine or reject), 48.9%
Reject (p=reject), 26.7%

The story is the drop-off. Publishing SPF is nearly universal (91.7%) and DMARC adoption is high (77.6%), but only 48.9% enforce anything (quarantine or reject), and just 26.7% reach p=reject. Every step down that funnel is a domain that did the paperwork but left the door open. If you operate a domain, the win isn't publishing another record, it's moving one step down the funnel toward enforcement.

Check any domain yourself, MailTester Ninja's free deliverability tools cover it end to end in one place: MX / SPF / DMARC analysis, an inbox-placement test scored out of 100, an SPF & DMARC generator and a blocklist checker, all with no signup and nothing stored. Need to confirm whether a specific mailbox actually exists and is deliverable? That is exactly what MailTester Ninja's email verifier does in real time, and we store no data.

Source: MailTester Ninja's open Email Infrastructure Index, a live DNS scan of 50,000 of the world's most-linked domains, updated daily, aggregate only. Free to cite under CC BY 4.0. Snapshot: Mon, 31 Aug 2026 04:18:17 GMT.

State of email: 80.8% mail-enabled, 76.9% SPF, 65.1% DMARC

evgeni — Mon, 24 Aug 2026 06:20:01 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

A quick pulse on 50,000 of the world's most-linked domains:

80.8% are mail-enabled (publish MX)
76.9% publish SPF
65.1% publish DMARC, but only 23.2% enforce p=reject

The headline barely moves year to year: adoption is high, enforcement is low. Most domains do the easy part (publish a record) and skip the part that actually stops spoofing (enforce it). Top MX providers right now: Other / self-hosted (32.5%), Google Workspace / Gmail (28.2%), Microsoft 365 / Outlook (22.7%), Proofpoint (5.6%), Mimecast (3.1%).

50.2% of SPF records use ~all (softfail) — most email says "maybe"

evgeni — Mon, 17 Aug 2026 06:20:01 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

76.9% of domains publish an SPF record. But SPF only bites if it ends in -all (hardfail). Here's how SPF publishers actually terminate their record:

~all, 50.2%
-all, 44.8%
noneall, 2.6%
?all, 2.4%
+all, 0%

~all (softfail, 50.2%) tells receivers "this probably isn't authorized… but deliver it anyway." -all (hardfail, 44.8%) tells them to reject it. Softfail is the safe default that never gets tightened, which means most domains publish SPF that a spoofer can walk straight past. If you own the domain and every legitimate sender is listed, -all is where you want to be.

Who runs the world's inboxes? MX market share across 50,000 domains

evgeni — Mon, 10 Aug 2026 06:20:01 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

We resolved the MX records of 50,000 of the most-linked domains (80.7% are mail-enabled) and classified who actually receives their mail:

Other / self-hosted, 32.5%
Google Workspace / Gmail, 28.2%
Microsoft 365 / Outlook, 22.7%
Proofpoint, 5.6%
Mimecast, 3.1%
Tencent QQ, 2%
Namecheap, 1.2%
Cisco IronPort, 0.9%

Google Workspace (28.2%) and Microsoft 365 (22.7%) anchor the market, but "Other / self-hosted" stays huge. That long tail is exactly why deliverability is hard: every provider greylists, rate-limits and reputation-scores differently. A sender that sails into Gmail can be throttled by a self-hosted Postfix or a Proofpoint gateway. Testing against real MX behavior, not assumptions, is the only way to know an address is actually reachable.

The DMARC enforcement gap: 64.5% publish it, only 22.9% enforce it

evgeni — Mon, 03 Aug 2026 06:20:02 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

Across 50,000 of the world's most-linked domains, 64.5% publish a DMARC record. Sounds healthy, until you read the policy.

Only 22.9% of all domains are on p=reject. Of the domains that publish DMARC at all, the split is:

p=none, 36.7%
p=reject, 35.5%
p=quarantine, 27.8%

p=none is monitoring only: it asks receivers to do nothing. A domain on p=none announces a policy it doesn't enforce, spoofable in practice, even though the record exists. The takeaway for anyone sending or securing email: publishing DMARC is not the same as being protected by DMARC. The path is p=none → p=quarantine → p=reject, and most of the web stops at step one.

The IPv6 email mirage: 55.3% of MX "support" it, but two companies carry the entire story

evgeni — Mon, 27 Jul 2026 06:20:01 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

Everyone says "IPv6 is here." For the web, mostly true. For email, it is a mirage.

We resolved the MX records of 50,000 of the most-linked domains and checked whether any of their mail servers publish an AAAA record, meaning they can actually receive over IPv6. No sending, no personal data, just DNS.

55.3% of mail-enabled domains have at least one IPv6-capable MX. That sounds healthy. It is not, because two companies carry almost the whole number:

Email provider	IPv6 MX
Other / self-hosted	██░░░░░░░░ 18.4%
Google Workspace / Gmail	██████████ 100%
Microsoft 365 / Outlook	█████████░ 91.3%
Proofpoint	░░░░░░░░░░ 0.7%
Mimecast	░░░░░░░░░░ 0%
Tencent QQ	░░░░░░░░░░ 4.1%
Namecheap	░░░░░░░░░░ 0%
Cisco IronPort	░░░░░░░░░░ 3.1%
Zoho	░░░░░░░░░░ 0%
Barracuda	░░░░░░░░░░ 0%

Google (100%) and Microsoft (91.3%) run IPv6 on nearly every inbox. Remove those two, the providers that already anchor most of the world's mail, and IPv6 email adoption falls from 55.3% to 12.9%. The enterprise security gateways that gate corporate mail, such as Proofpoint, Mimecast and Barracuda, are effectively not on IPv6 at all.

Why it matters for deliverability. IPv6-only sending is a dead end. It reaches Gmail and Outlook and little else. Dual-stack is not optional. IPv4 is still the backbone of email, and that is where blocklists, FCrDNS and IP reputation are mature. The takeaway: IPv6 email is not adopted. Google and Microsoft adopted it for you. Plan your sending for an IPv4 world with two big IPv6 exceptions.

83.4% of the web's email runs on just 3 providers

evgeni — Mon, 20 Jul 2026 06:20:01 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

Across 50,000 domains, mail hosting is strikingly concentrated:

Top 1 provider handles 32.4% of mail-enabled domains
Top 3 handle 83.4%
Top 5 handle 92.1%, out of 20 distinct providers we detected

Leaders right now: Other / self-hosted (32.4%), Google Workspace / Gmail (28.3%), Microsoft 365 / Outlook (22.7%), Proofpoint (5.6%), Mimecast (3.1%).

For senders this cuts two ways. Most of your deliverability outcome is decided by a few gatekeepers, get right with them and you reach the majority of inboxes. But the long tail is where surprises live: a small self-hosted or regional gateway can silently greylist or block you with rules nothing else uses. You can't assume "it worked for Gmail" means "it works everywhere", which is why verifying against the actual receiving server matters.

Who actually enforces DMARC? Reject rates by email provider

evgeni — Thu, 16 Jul 2026 17:27:05 GMT

By the team at MailTester Ninja, a real-time email verification API that stores nothing.

DMARC enforcement isn't spread evenly, it tracks who hosts the mail. Share of each provider's domains that reach p=reject (and SPF -all):

Other / self-hosted, 18.6% on p=reject, 42% on SPF -all
Google Workspace / Gmail, 26.8% on p=reject, 25.8% on SPF -all
Microsoft 365 / Outlook, 31.2% on p=reject, 60.9% on SPF -all
Proofpoint, 61.7% on p=reject, 44% on SPF -all
Mimecast, 35.8% on p=reject, 41.9% on SPF -all
Tencent QQ, 2.5% on p=reject, 6.3% on SPF -all
Namecheap, 1% on p=reject, 1.4% on SPF -all

Proofpoint leads on enforcement (61.7% reject). Managed security gateways pull their customers toward strict policy by default, while self-hosted / other lags (18.6% reject), enforcement is a config someone has to choose, and manageds choose it for you. The practical read: the reputation and policy of an address depends heavily on its provider, which is exactly why testing against the real receiving server beats guessing from the domain alone.