5,000+ outbound teams
We looked up the mail servers, SPF and DMARC records of 458,977 B2B company domains. Here is who handles business email, and how few domains lock it down.
Microsoft 365 receives mail for 40.8% of B2B company domains, more than any other platform, with Google Workspace at 21.6%.
See the chartAmong companies with 1 to 10 employees, Google Workspace overtakes Microsoft 365: 35.8% against 33.4%.
See the chart17.6% of B2B domains route inbound mail through a security gateway such as Proofpoint, Mimecast or Barracuda before it reaches a mailbox.
See the chartSecurity gateways front 38.1% of companies with 1,001+ employees, against 11.8% of companies with 1 to 10.
See the chartBehind those gateways, 52.8% of domains authorize Microsoft 365 in SPF, against 2.2% for Google Workspace.
See the chartOnly 15.6% of B2B domains enforce DMARC at p=reject, the one policy that tells receivers to refuse spoofed mail.
See the chart35.7% of B2B domains publish no DMARC record at all.
See the chartOf the domains that do publish DMARC, 45.6% sit at p=none, which collects reports but blocks nothing.
See the chartDMARC enforcement climbs with company size, from 25.6% of companies with 1 to 10 employees to 66.4% at 1,001+.
See the chartIndia leads on DMARC enforcement with 48.7% of domains at quarantine or reject, against 32.9% in the United States.
See the chart46.3% of B2B domains end their SPF record in a strict hardfail (-all), and 41.0% in softfail (~all).
See the chartA domain behind Zix AppRiver is 5.8 times as likely to be catch-all as one on Microsoft 365 (97.1% against 16.8%), so verifiers cannot confirm the contact.
See the chartEnter any company domain. We read its MX, SPF, DMARC, MTA-STS and BIMI records and place each one against this study.
Reads public DNS only: MX, SPF, DMARC, MTA-STS and BIMI. Nothing is stored.
Share of 458,977 B2B domains with an MX record
Share of the same domains, by the company behind the MX host
17.6% of domains route mail through a security gateway first. Their SPF records show where the mailboxes actually live.
80,976 B2B domains whose MX points to a gateway, platform read from SPF
Lower bars: share of gateway domains by gateway vendor.
Share of B2B domains with an MX record, every country with 1,000+ domains in the sample
458,855 B2B domains with an MX record whose _dmarc lookup answered
Share at p=quarantine or p=reject, countries with 1,000+ domains
Adoption across 458,977 B2B domains with an MX record
458,965 B2B domains with an MX record whose TXT lookup answered
Share of 421,962 domains with SPF that include each service
A catch-all server says yes to every mailbox, real or not, so an SMTP check cannot prove a contact exists. The share swings with the provider.
Based on 290,511 domains where our verifier checked at least one contact. Reduce the risk with the free email verifier.
Share of verified B2B domains where at least one address returned catch-all
Share of B2B domains with an MX record, by employee count
Share at p=quarantine or p=reject
| Industry | Microsoft | DMARC enforced | |
|---|---|---|---|
| Business Services | 42% | 17% | 31% |
| Real Estate and Construction | 46% | 14% | 29% |
| Retail | 36% | 22% | 27% |
| Manufacturing | 47% | 10% | 41% |
| Financial Services | 41% | 11% | 45% |
| Construction | 45% | 18% | 28% |
| Marketing and Advertising | 34% | 34% | 31% |
| Healthcare | 39% | 11% | 37% |
The checker above uses the same provider rules, so a domain you test gets the label it got in the study.
| Company domains in the Getlead B2B database, deduplicated | 471,579 |
| Domains scanned | 471,579 |
| Excluded: domain no longer exists (NXDOMAIN) | 2,014 |
| Excluded: DNS never answered after 5 attempts | 5,896 |
| Excluded: no MX record (cannot receive mail) | 4,692 |
| Domains that receive mail (provider shares) | 458,977 |
| with an answered DMARC lookup (DMARC shares) | 458,855 |
| with an answered TXT lookup (SPF shares) | 458,965 |
| with at least one verified contact (catch-all shares) | 290,511 |
| Countries with 1,000+ domains | 11 |
| Scan window | 26 and 27 October 2026 |
Every aggregate table on this page: shares, counts and denominators by provider, country, company size and industry. No per domain rows.
Aggregate CSV
Getlead (2026). State of B2B email infrastructure 2026. https://getle.ad/research/b2b-email-infrastructureFree to use under CC BY 4.0. Credit "Getlead" with a link to this page.
Every chart above has an "Embed this chart" button with a ready snippet: the chart as an image plus a source line.
Pick a chartFixing your own setup? Generate a record with the DMARC record generator or the SPF generator, then read SPF, DKIM and DMARC explained.
From the public DNS records of 458,977 company domains that receive email, taken from the company domains in the Getlead B2B database. We looked up each domain's MX, SPF, DMARC, MTA-STS and BIMI records during 26 and 27 October 2026. Only aggregate shares are published, never a list of domains.
By the MX record, the server that receives a domain's mail. Microsoft 365 domains point MX at mail.protection.outlook.com, Google Workspace domains at aspmx.l.google.com or smtp.google.com. When the MX belongs to a security gateway such as Proofpoint or Mimecast, we read the SPF record to see which platform the mailboxes sit on behind it.
A share is only as honest as its denominator. Domains that no longer exist (2,014) and domains whose DNS never answered after five attempts (5,896) are excluded instead of being counted as having no record. Each chart states the exact number of domains behind it.
They are the three DMARC policies. p=none only asks receivers for reports and changes nothing about delivery. p=quarantine asks them to send failing mail to spam. p=reject asks them to refuse it outright, which is the only setting that fully stops someone sending email as your domain.
Not necessarily. With DMARC enforced, receivers act on the DMARC result, and ~all avoids losing legitimate mail that is forwarded. Without DMARC, -all is the stronger signal. The risky settings are +all, which authorizes every server on the internet, and having two SPF records, which makes both invalid.
A catch-all domain accepts mail for any address, real or not, so an SMTP check cannot confirm whether a specific mailbox exists. Lists built from catch-all domains carry more hidden bounces. We count a domain as catch-all when our verifier returned a catch-all result for at least one contact at it.
Yes. Quote any figure, embed the charts with the snippet under each one, or download the aggregate CSV. Please credit "Getlead" with a link to this page so readers can check the method.
Once a year at this same address, so links to it keep working. The date at the top shows when the numbers were last refreshed.
Getlead verifies every contact before it sends, flags catch-all domains and writes to the decision maker for you.
See AI GTM