Mail Provider Market Share: Google and Microsoft Route 54% of the World's Email

Update — 2026-06-29: Refreshed against LLMSE's current index of 3.4 million classified URLs (up from ~1.4M at first publication); the set of domains with an identified mail provider has grown from 462,057 to 1,051,461. The broader crawl reshaped the picture: the Google + Microsoft duopoly fell from 65.9% to 54.4%, the bundled web-hosting tier roughly doubled to a quarter of all domains, IONOS replaced Proofpoint as the third-largest provider (Proofpoint slipped to tenth), and ProtonMail overtook Fastmail as the leading privacy provider. The core thesis — a two-company duopoly sits atop a long, fragmented tail — holds, but the duopoly is measurably less dominant than the original reported, and the curated per-segment adoption claims that could not be reproduced read-only have been dropped.

Every domain that handles its own email publishes MX records — the DNS entries that tell the world where to deliver mail. Those records are a fingerprint: they reveal whether a domain routes mail through Google Workspace, Microsoft 365, a web host's bundled mailbox, a security gateway, or a privacy-focused provider. Surveys ask companies what they use; MX records show what they actually run.

The conventional wisdom is that business email is a straight Google-versus-Microsoft contest, with everyone else rounding to noise. That is half right. The two cloud giants do sit far above the field — but "the field" is larger and more structured than the duopoly framing suggests, and the share held by the top two depends heavily on which slice of the web you look at.

We resolved the MX records for every enriched domain in LLMSE's index and matched the resulting hostnames against 370 MX patterns mapped to 187 known providers, using suffix matching against the outermost mail exchanger. After excluding domains with no recognizable provider and mail for blocked TLDs (.ru, .su), 1,051,461 domains carry an identified mail provider across 158 active providers. Counts are aggregate; no individual domain is named.

Google Workspace (28.4%) and Microsoft 365 (26.0%) together route 54.4% of those domains' email — a commanding lead, but down sharply from the 65.9% the original analysis reported, because the index has more than doubled and now captures far more of the long-tail hosting, regional, and parked domains that sit beneath the duopoly. Below the top two, the third slot is no longer a security vendor: IONOS is now the third-largest provider, and bundled hosting email has grown into one of every four domains.

The Data

The 1,051,461 domains break into functional layers defined by what each provider is — a dedicated business platform, a web host, a security gateway, a privacy service — not by the industries those domains belong to. (MX-derived provider keys are bare-domain keyed and cannot be cross-referenced against LLMSE's URL-keyed content categories; see Methodology.)

The single biggest change since the original analysis is the rise of the hosting tier. Bundled web-hosting email has grown from 13.9% of identified domains to 25.8% — now one in four. This is not a sudden migration; it is a sampling effect. The original sample of 462,057 domains skewed toward active, content-bearing sites where dedicated business email is more common. As the index more than doubled and reached deeper into the long tail, it captured proportionally more small-business and registrar-default domains that simply use whatever mail came with their hosting plan. The same broadening pushed Business Email's share down from 68.8% to 57.6% — still a clear majority, but no longer the overwhelming one the first cut implied.

Methodology

This post reports market shares from set cardinalities, so the definitions and limits matter.

• What "identified provider" means. For each domain, LLMSE resolves MX records with dnspython and matches each mail-exchanger hostname against 370 suffix patterns mapped to 187 providers. A domain is counted once, under the outermost MX provider. Domains with no resolvable or recognizable MX are excluded, so shares are computed over the 1,051,461 domains that carry an identified provider, not all indexed domains.
• Segment labels. Each provider is assigned to one segment (Business Email, Web Hosting, Security Gateway, Regional/ISP, Cloud/Consumer, Domain Parking, Transactional, Privacy, Email Forwarding, Collaboration, Help Desk/CRM) by its identity in LLMSE's provider map. Segment totals are sums of per-provider domain counts — they describe what kind of provider a domain uses, not what industry the domain is in.
• Reproducibility. Every figure here is a Redis sorted-set cardinality (ZCARD of mail-{Provider}) or a sum of them. The full ranking is browsable at /browse/mail, and mail: filters in advanced search reproduce any single provider's domain set.
• What is not reproducible — and was dropped. MX-derived provider keys are bare-domain keyed, while LLMSE's content categories, grades, and CMS/server indices are URL-keyed. The two key spaces do not intersect (ZINTERCARD returns 0), so claims of the form "what share of finance domains use Google Workspace" or "security-gateway users are the most regulated industries" cannot be verified read-only. The original's curated per-industry and per-tier adoption narratives have therefore been removed; this post reports only provider and segment cardinalities, which are fully reproducible.
• Known limits. Only providers visible in the public MX chain are detected; a domain running a security gateway in front of Google Workspace is counted under the gateway, not Google. Self-hosted servers without a recognizable pattern are excluded. Transactional platforms (Amazon SES, Mailgun) are counted only when they appear as a domain's primary MX, which understates their true sending footprint. Counts are a live snapshot and drift as enrichment continues.
• Why these numbers differ from the original. The original analyzed 462,057 domains; this refresh covers 1,051,461. The added domains are disproportionately long-tail (hosting, regional, parked), which compressed the top-two share (65.9% → 54.4%), grew the hosting tier (13.9% → 25.8%), and reshuffled the lower ranks — moving IONOS ahead of Proofpoint and ProtonMail ahead of Fastmail.

The Ranking

The top of the table is unchanged in shape and dramatic in scale: two providers, then a steep cliff.

Google Workspace and Microsoft 365 are the only providers above 5% — and either one alone outweighs the next ten providers combined (Microsoft's 273,205 domains exceed the 259,266 held by ranks 3 through 12). The market is still extraordinarily top-heavy, just less so than the original cut: the top two hold 54.4%, the top three 59.0%, and the top ten 75.9%. The remaining 148 active providers split the final 24.1%, and most are vanishingly small — dozens serve fewer than 100 domains each.

The most consequential change in the table is at #3. In the original analysis the third-largest provider was Proofpoint, an email-security gateway — a striking finding that suggested security filtering was a top-tier infrastructure layer. With broader coverage, that no longer holds: IONOS (48,529 domains) is now #3, and Proofpoint has fallen to #10 (18,179, 1.7%). The third slot is once again a mail host, not a security appliance. Three of the top five providers (IONOS, OVH, GoDaddy) are now hosting/registrar businesses, reflecting the same long-tail broadening that lifted the hosting segment overall.

The Duopoly: Two Companies, Half the Web's Email

The headline is durable even as the number moves: a single pair of companies routes the majority of business email. The interesting question is how dominant, and the answer depends entirely on the sampling frame.

Two independent MX-based measurements agree on the shape and disagree only on the magnitude. An OpenINTEL scan of 660,114 domains from the Tranco top-1M (January 2026) found Google Workspace at 21.7% and Microsoft 365 at 16.3% — a combined 37.9%. LLMSE's figure is higher (54.4%) because LLMSE computes share over domains with an identified provider, whereas the Tranco study divides by all top-1M domains, roughly half of which fall into "unknown" or generic shared-hosting MX patterns. Normalize for that denominator and the two datasets converge. Critically, both put Google ahead of Microsoft by domain count — Google holds 52.2% of the duopoly in our data, 57.2% in the Tranco study.

That by-domain lead inverts when the unit changes from domains to seats. Microsoft's strength is the enterprise: industry estimates put Microsoft 365 at roughly 58% of the large-enterprise segment with around 446 million paid seats and 75% of the Fortune 500, while Google Workspace leads by raw domain count on the strength of small businesses, schools, and the free-tier-to-paid pipeline. A domain-count market share like ours therefore over-weights small organizations and under-weights enterprise scale — Google "wins" the domain count while Microsoft wins the seat count and the revenue. Both framings are true; they measure different things, and the MX record only sees the domain.

The Hosting Tier: IONOS Takes Third as Bundled Email Grows

Beneath the duopoly sits the bundled-hosting layer — domains using the mailbox that came with their hosting or registrar plan. At 271,137 domains (25.8%), it is now the second-largest segment, and unlike the duopoly it is deeply fragmented across 57 providers.

No hosting provider dominates the way Google and Microsoft dominate overall — IONOS leads the tier with 48,529 domains, but European incumbents (IONOS, OVH, One.com, Infomaniak, Hostpoint, Hetzner, Gandi) crowd the top of the table alongside the global registrars. This mirrors the structure of the hosting market itself, where regional incumbents hold strong positions: IONOS in Germany, OVH in France, Hostinger across emerging markets, Lolipop in Japan. The presence of Newfold Digital (#9 overall, 19,051) reflects parked and default-MX domains across its large registrar portfolio, which is why it sits in the Domain Parking segment rather than active hosting.

These domains are using email they did not specifically choose. For many small organizations the bundled mailbox is adequate, but it is also the tier least likely to have the sender-authentication posture that dedicated platforms configure by default — and authentication is no longer optional. Even among the Tranco top-1M, the OpenINTEL scan found only about 65% of domains publish a DMARC record (431,133 of 660,114), and bundled-hosting domains are over-represented in the gap. That is a deliverability and spoofing exposure that scales with the size of this tier.

Security Gateways: Proofpoint Still Leads Its Lane, but Slipped Overall

Security gateways — services that filter spam, malware, and phishing before forwarding clean mail to the real mailbox — account for 54,769 domains (5.2%), down from the 8.0% the original reported as the broader index diluted their relative weight.

Within its own lane Proofpoint remains the clear leader at 33.2%, with Mimecast (21.7%) and Barracuda (12.1%) rounding out a top three that controls two-thirds of the gateway segment — a ranking consistent with the analyst view of the category, where Proofpoint was named a Leader and placed highest in execution in the 2025 Gartner Magic Quadrant for Email Security and Proofpoint, Mimecast, and Barracuda consistently top third-party email-security market-share trackers. What changed is not Proofpoint's standing among gateways but its standing among all mail providers: at #10 overall it is now a specialist layer sitting behind the duopoly, not a top-three infrastructure player. The MX-only view also undercounts the category, because many modern gateways operate as API integrations that never appear in the public MX chain.

Cloud and Consumer: Cloudflare's Quiet Climb

Cloudflare Email Routing — a free service that forwards mail for domains already on Cloudflare DNS without running a mailbox — leads the cloud/consumer segment and is the 12th-largest provider overall.

Cloudflare Email Routing alone accounts for 62.2% of the cloud/consumer segment and has nearly doubled its domain count since the original analysis — consistent with Cloudflare's enormous DNS footprint and the appeal of free, zero-maintenance forwarding. It is not a mailbox provider and does not compete with Google or Microsoft for hosted email, but it has quietly become the default routing layer for a large slice of the long tail. iCloud Mail with custom domains (4,107) shows continued, modest uptake of Apple's iCloud+ offering; Yahoo (2,181) and AOL (42) are legacy configurations.

Privacy Email: ProtonMail Overtakes Fastmail

Privacy-focused providers — end-to-end encrypted or privacy-first services — route 12,747 domains, just 1.2% of the market. The segment is small, and within it the leadership has flipped.

ProtonMail now leads the privacy segment with 5,574 custom-domain mailboxes against Fastmail's 4,632 — a reversal of the original, which had Fastmail narrowly ahead. The gap is roughly 940 domains, and ProtonMail's lead at the domain level is consistent with its scale at the account level: Proton has reported more than 100 million accounts and bills itself as the world's first end-to-end encrypted email service, far larger than Fastmail's paid base. The two still serve different buyers — Fastmail emphasizes a polished, standards-based client experience, ProtonMail emphasizes encryption and Swiss jurisdiction — but on custom-domain adoption the encryption-first option has pulled ahead.

Behind the leaders the drop-off is severe: Mailbox.org (1,129) is the only other privacy provider with four-digit adoption, and the remaining dozen split fewer than 1,600 domains. Privacy email remains a 1.2% niche — a share that has barely moved as the overall index doubled, which tells its own story about how rarely privacy is the deciding factor in a domain's mail choice.

What's at Stake

• Concentration risk is real but smaller than headlined. Two companies route 54.4% of identified domains' email; a major Google or Microsoft outage degrades mail for a quarter to a third of the web at once. But the duopoly is 11 points looser than the original implied, and the long tail (148 providers, 24.1%) is a genuine resilience reservoir, not noise.
• Bundled hosting email is a growing deliverability liability. A quarter of domains now use a hosting provider's mailbox — the tier least likely to ship correct SPF/DKIM/DMARC alignment by default. With DMARC adoption around 65% even among the most prominent domains, the unauthenticated long tail is where spoofing and deliverability failures concentrate.
• Domain count is the wrong lens for enterprise decisions. Google leads by domains while Microsoft leads by seats and revenue. Buyers and analysts who cite a single "market share" number without stating the unit will reach opposite conclusions from the same MX data.
• Privacy email is structurally marginal. At 1.2% and flat, encrypted/privacy providers are not displacing the mainstream for domain-level mail, regardless of consumer-account growth. ProtonMail's lead is a win within a niche, not evidence of a privacy shift in business email.
• Security filtering is more common than the MX view shows. The 5.2% gateway share is a floor: API-based and inline filters that don't alter MX records are invisible here, so real adoption of dedicated email security is higher than the cardinalities suggest.

What Would Help

1. Site owners: check what your MX records actually say. Most organizations cannot name their mail provider from memory, and bundled-hosting defaults are easy to outgrow without noticing. Look up your domain in the mail provider browser or run a mail: filter in advanced search, then confirm your SPF, DKIM, and DMARC records match it.
2. Small businesses on bundled hosting: treat authentication as mandatory, not optional. If your mail came with your hosting plan, publish DMARC (start at p=none to monitor, then enforce) and verify SPF/DKIM alignment. This is the cheapest fix with the largest deliverability and anti-spoofing payoff for the fastest-growing segment of the market.
3. Analysts and journalists: state the unit before quoting a share. "Google leads email" and "Microsoft leads email" are both true — by domains and by seats respectively. Pair any market-share claim with its denominator (domains, seats, revenue, sampling frame) or it misleads.
4. Enterprises evaluating gateways: read MX-based shares as a floor. Proofpoint, Mimecast, and Barracuda lead the visible gateway market, but inline and API-integrated security never appears in MX data. Size the category from analyst reports, not DNS scans alone.
5. Privacy advocates: adoption, not availability, is the gap. Privacy providers are abundant and capable, yet hold 1.2% of domain-level mail. Closing that gap is a question of switching cost and default inertia, not of product — the providers exist, but the long tail keeps whatever its host or registrar handed it.

Explore the Data

The mail provider browser lets you explore the full dataset — all 158 active providers, their domain counts, and the domains each serves. Use mail: filters in advanced search to find domains by provider, and the companion DNS provider browser maps the same domains' nameserver infrastructure.

This analysis was conducted using LLMSE, which has classified over 3.4 million websites across SEO, EEAT, AEO, WCAG accessibility, readability, GARM brand safety, and privacy dimensions. Mail provider figures reflect 1,051,461 domains with an identified provider in the index as of June 2026. To analyze your own site, visit llmse.ai/classify.