By ByteBot
A RIPE Labs report published July 30, 2026 put a hard number on what developers have quietly felt for years: Google Workspace and Microsoft 365 now handle inbound mail for 38.6% of the measured internet’s top domains, while self-hosted email has dropped from 44.6% of domains to just 22.4% over the past decade. Email — a protocol specifically designed to be federated — is quietly becoming a duopoly. That should concern you even if you haven’t run a mail server in years.
The Self-Hosted Email Numbers Are Stark
The RIPE Labs analysis, which tracks OpenINTEL DNS snapshots of the Tranco top-1M domains, shows Google Workspace controlling inbound mail for 21.8% of measured domains. Microsoft 365 handles another 16.8%. Together they account for 38.6% of all measured inbound email infrastructure. The next-largest provider — Proofpoint — sits at just 1.9%. That’s not a competitive market. That’s a duopoly with a long tail of marginal providers.
Meanwhile, self-hosted email has been cut in half. In 2016, 44.6% of domains ran their own mail infrastructure. By July 2026, that number is 22.4%. The decline is steady, not cliff-shaped — roughly 2.2 percentage points per year — which makes it easy to miss. However, the cumulative effect is that email, the open internet’s foundational communication layer, is more concentrated than it has ever been.
Why Self-Hosting Got This Hard
The authentication requirements that drove this consolidation started with good intentions. Google and Yahoo’s 2024 mandates made SPF, DKIM, and DMARC non-negotiable for high-volume senders. By November 2025, Gmail escalated from soft rejections to permanent 550 SMTP blocks for authentication failures. Microsoft followed with 550 5.7.515 codes. DMARCbis (RFC 9989) formalized stricter requirements in May 2026. The bar for reaching Gmail and Outlook inboxes from a self-hosted server now includes not just authentication records but correct PTR records, MTA-STS, TLS enforcement, and — most critically — a clean IP reputation that cheap VPS ranges almost never have.
The DMARC picture deserves its own callout. The RIPE Labs data shows 458,467 domains publishing DMARC records, but only 46.9% actually enforce them. The most common DMARC record in the dataset — verbatim copy-pasted by 58,064 domains — is v=DMARC1; p=none;. That record does nothing. It’s compliance theater for Google’s 2024 checklist, not real enforcement. DMARC enforcement actually declined 0.44 percentage points in the prior 30 days. The adoption curve is stalling exactly where it’s least useful.
The Risk Nobody Talks About
Centralized email isn’t just a privacy trade-off — it’s a systemic fragility. Between late 2025 and early 2026, Gmail’s spam filter collapsed and Microsoft’s Outlook backup servers buckled under load. When email goes down at that scale, MFA tokens fail, developer pipelines break, and business operations stall — because a protocol originally designed to route around failure now routes through two companies. Email was supposed to be resilient by design. Concentrated in two providers, it’s now a single point of failure wearing a distributed protocol’s clothing.
A Google or Microsoft policy change — accidental or deliberate — can now strand a third of the internet’s inbound email with no recourse. That’s not a theoretical concern. It happened in 2025 and 2026, and it will happen again.
The Practical Verdict for Developers
Self-hosting email in 2026 is doable, but not for most people. If you go this route, Mailcow and Mail-in-a-Box are the realistic starting points — Mailcow for multi-domain setups with serious filtering, Mail-in-a-Box for small groups under 20 users. The pragmatic path most experienced operators land on: self-host for receiving (IMAP, storage, data sovereignty) and relay outbound through a service like Postmark or Mailgun. You keep custody of your mail without fighting an IP reputation war you’ll likely lose.
The broader question isn’t “should I self-host?” It’s whether developers as a community are comfortable with email — the open internet’s most important protocol — converging on a Google-Microsoft duopoly. At 38.6% and growing, the answer is becoming a fait accompli. The Hacker News discussion from today shows developers are still debating it, which means the conversation isn’t closed.
Key Takeaways
- Google Workspace and Microsoft 365 now control 38.6% of all measured internet inbound email — self-hosted mail dropped from 44.6% to 22.4% over a decade
- Gmail’s permanent 550 SMTP rejections (November 2025) and Microsoft’s 550 5.7.515 enforcement raised the authentication floor to a height most VPS-hosted servers cannot clear without relaying outbound
- DMARC adoption is stalling at p=none — 53.1% of domains publishing DMARC records don’t enforce them, and enforcement declined month-over-month in the RIPE data
- Email centralization is a systemic risk: when Gmail and Outlook fail, MFA tokens and developer pipelines break — a federated protocol now behaves like a centralized service
- The practical hybrid — self-host IMAP for data sovereignty, relay SMTP outbound through Mailgun or Postmark — is how serious self-hosters avoid the deliverability trap
