MX Flux: Sixteen Months of Email Records for 422 Million Domains — 71% Never Touched Their MX, Google's Lead Grows Without Switchers, and 13 Million Domains Now Refuse Mail

Two months ago, Who Runs the World's Email took a single photograph of the mail layer: 151 million mail-capable domains, Google Workspace ahead of Microsoft 365 by 1.4 to 1, and registrar-bundled email bigger than both. A photograph tells you who holds the territory. It cannot tell you whether Google's lead is growing or shrinking, whether anyone actually switches email providers, or what happens to a domain's mail routing when its owner stops paying attention — which, for most of the Internet, is the normal state.

The MX record is the quietest record in a zone. It does one thing — name the server that accepts a domain's mail — and once it works, nobody reads it again. Vendors measure email by seats and revenue; analysts measure it by surveys of enterprises. Neither instrument sees the 150 million registered domains whose mail is handled by whoever sold them the name, nor can either say how often the routing actually changes. Measuring that requires asking the same question about every domain on the Internet, every month, and remembering the answers.

That is what this post does. It is the mail-layer companion to Who Moves the World's DNS (delegation flux), The Restless Aliases (CNAME flux), and The SaaS Ledger (TXT flux), and it is the sequel the June census asked for: the census could rank providers; it could not say whether the ranking was moving.

We ran eleven full MX-typed crawls of the DomainsProject corpus — an April 2025 baseline, then monthly from November 2025 through August 2026 — and reduced each to one record per registrable apex domain: whether it can receive mail, the full set of mail exchangers it publishes, and the operator behind the primary one, using the census's own classifier. Joined by name across all eleven passes, that is 421,855,712 apex domains tracked through sixteen months, with the June 2026 pass reproducing the published census to within 0.4% on every major provider.

The headline: the mail layer is the stillest layer we have ever measured, and the one race everyone watches is being decided by domains that did not exist yet. 70.8% of the domains that could receive mail in April 2025 publish the bit-identical MX record set sixteen months later (91.0% of those that survived), and 90.9% of persistently-observed domains never changed mail provider once. Against that stillness, Google Workspace's lead over Microsoft 365 widened at every single pass — from 1.28 to 1.43 domains per Microsoft domain — without a switching wave: 101,613 domains moved from Google to Microsoft and 92,185 moved the other way, a wash. Microsoft actually wins the migration market (904,169 domains switched to it from other providers, against Google's 638,601). Google wins the birth market: 6,611,226 new mail-capable domains arrived on Google against 2,888,963 on Microsoft, 2.3 to 1. Meanwhile the number of domains publishing the RFC 7505 null MX — "this domain accepts no mail" — quadrupled from 3.4 million to 13.4 million, and 77% of them are parked on one aftermarket platform's nameservers.

The Data

Each pass queries the full corpus for MX records and keeps only names that are themselves registrable apexes — mail to [email protected] is routed by the MX of example.com and nothing else, and counting each domain once is what makes provider shares one-domain-one-vote. The union across all eleven passes is 421,855,712 distinct apexes; 167,659,894 of them (39.7%) appear in every single pass, and 88,084,469 are mail-capable in every pass, forming the fully-observed panel behind the per-domain stability numbers. The cadence is uneven and we treat it honestly: an April 2025 baseline, a seven-month gap, then monthly. Where a change lands inside the gap, we say so rather than interpolating.

Two things in the table need flagging before any share is read off it. First, the June 2026 row restates the published census. The census counted 390,520,120 apexes; this series counts 297,860,704 for the same crawl. The difference — 92,659,414 names — is hostnames that are "apexes" only under the private section of the Public Suffix List: 12.7 million *.blogspot.com, 10.2 million *.herokuapp.com, some 30 million *.compute.amazonaws.com EC2 reverse names, 3.1 million *.myshopify.com, 1.1 million *.github.io. Only 1.44 million of them publish any MX at all (mostly *.duckdns.org and *.sakura.ne.jp self-MX), so the provider counts barely move — Google 19,963,561 → 19,888,647, Microsoft 14,184,931 → 14,183,650 — but the denominator does: among registered domains, 50.2% can receive mail, not the 38.7% the census reported. The census's "33.5 million distinct primary-MX operators" was the same artifact; under ICANN-only rules there are 449,453 distinct third-party MX registrables. We consider this series the corrected figure and the census's share a known under-statement.

Second, the July and August passes carry a corpus expansion: apexes observed jump from 297.9 million to 322.5 million while mail-capable apexes rise only 2.4 million, so "zero MX" swells by 20.6 million. Those are new names entering the crawl without mail, not domains switching mail off, and they would make the mail-capable share look like it fell from 50.2% to 47.1% in two months. It did not; the population being asked changed. Every share in this post is therefore expressed per 1,000 mail-capable apexes, which is immune to how many mail-less names the crawler discovers.

Methodology

Unit of analysis. The registrable apex domain under the ICANN section of the Public Suffix List — private-section suffixes are walked past, so platform subdomains do not masquerade as registered domains. Russian-administered TLDs are excluded from all counts per project policy.

States. In each pass an apex is mail-capable (≥1 MX record naming a real host), null-MX (its only MX is the RFC 7505 null record, 0 .), zero-MX (present, NOERROR, no MX answers — the domain exists and was asked, and publishes no mail route), or absent (not in that pass). The corpus stores NOERROR responses only, so absence bundles death, resolution failure, and crawl misses: every death-shaped number in this post is an upper bound, the same caveat that governed the CNAME and NS series.

Provider. Each mail-capable apex is attributed to the operator of its lowest-preference MX host (ties broken by host name, so the primary is stable across passes regardless of answer order), reduced to its ICANN-registrable domain and classified with the census's two-tier rule set: ordered substring rules for families spanning many registrables (IONOS's ionos.de/.fr/.co.uk/.es + kundenserver.de, Hostinger, GoDaddy's secureserver), then exact registrables. Classification happens at join time, not extraction time, so the rules could be audited against the data rather than frozen before it. Nine categories follow the census — Google Workspace, Microsoft 365, other cloud suites, registrar/host-bundled, security gateways, regional, forwarders/routing, parking, broken — plus two the census folded into "unclassified" and this series separates: self-hosted, when the primary MX host lives under the apex it serves (mail.example.com), and unclassified third-party, when it lives under a registrable no rule names. Self-hosted is a description of the record, not of the operator: it is also what cPanel and Plesk write by default, so a large share of it is shared hosting with per-domain MX names rather than owners running their own mail servers. It is reported as its own row and never folded into a named provider.

Change detection. For each apex we also store the set of MX registrables and a hash of the full sorted MX record set (hosts and preferences). Between two passes a surviving mail-capable domain is classified as: same record set (bit-identical), same provider set, hosts changed (mx1 → mx2 shuffles, preference edits), provider set adjusted (primary kept, backup MX changed), or provider changed (primary moved). Flows are counted only for the last class, so provider-internal renames never masquerade as migrations.

Validation and two errata. The June 2026 pass, aggregated from the per-apex tuples, reproduces the census apex count exactly once the 92.66 million pseudo-apexes are added back (390,520,118 vs 390,520,120 — the two being duplicate rows the global sort deduplicates), and every major provider to within 0.4%. Auditing the rules against sixteen months of flows surfaced two census mislabels, both corrected here and flagged for the census: livemail.co.uk is Fasthosts (an IONOS subsidiary — its zone is served by ui-dns and administered by fasthosts.com), not 123 Reg; and hostedmxserver.com is not a security gateway but ParkLogic's parking-platform MX — 93.6% of its domains are delegated to parklogic.com nameservers (see The Corporate Steps). Six rules were added for operators the private-suffix walk made visible — All-Inkl's kasserver.com (1.28 million domains the census had fragmented into the unclassified tail), Spaceship's spacemail.com, NameBright, TransIP, Mijndomein, WEB.DE. Live-DNS spot checks in August 2026 verified the load-bearing claims: sampled null-MX domains answer 0 . from ns*.afternic.com; sampled domains in the Mailgun → GoDaddy flow published mxa/mxb.mailgun.org in the July crawl and smtp.secureserver.net today.

Measurement hazards — keys that flicker. A handful of MX registrables do not hold still between passes: h-email.net swaps more than 80% of its stock between "has MX" and "no MX" every month; above.com, kv.de and the catch-all pair eye-mail.net / secure-mailgate.com swap 20–25%. These are parked-domain catch-all mail estates (three-quarters of h-email.net's domains are delegated to ParkingCrew) whose records come and go with the inventory, not operators gaining or losing customers. We compute a flicker index (monthly in-from-zero plus out-to-zero, as a share of stock) for every tracked key, publish it in the momentum CSV, and exclude keys above 15% from every switching statistic that follows. The monthly ledgers in the next section are reported both gross and with those keys removed.

Known limitations. An MX record names the first hop, not the mailbox: domains behind Proofpoint, Mimecast or another gateway are attributed to the gateway, and — as the census explained at length — that hides Microsoft 365 mailboxes specifically, so Microsoft's counts remain a floor. This series makes the effect visible for the first time (211,378 domains moved behind a gateway from a Microsoft MX during the window, 131,616 came back out) but cannot remove it. Sixteen months support flux rates and flow attribution, not long-run survival curves — for mortality proper see The Half-Life of a Domain. Provider keys are infrastructure identities, not corporate ones (Namecheap's registrar-servers.com default, privateemail.com and spacemail.com are counted separately; GoDaddy's secureserver.net and the ISPGateway/123 Reg/Host Europe brands it owns likewise). Aggregate counts are published; per-domain enumerations are not.

Reproducibility. Every chart links its CSV below; the full provider × pass matrix is mxflux-scorecard.csv, the category rollup mxflux-categories.csv, the pair ledgers mxflux-monthly.csv, the flows mxflux-flows.csv, the momentum and flicker table mxflux-momentum.csv, and the per-TLD panel mxflux-tld.csv. The pipeline is ~250 lines of Go per stage: a per-shard extractor emitting one tuple per apex, an external sort, and an 11-way streaming merge-join that classifies against a rules file. The active dataset is available at domainsproject.org/dataset.

The Scorecard in Motion

Primary-provider counts at the endpoints, with share per 1,000 mail-capable apexes — the normalization that removes the corpus's own growth (138.6M → 152.0M mail-capable).

Download: mxflux-scorecard.csv — top 40 providers × 11 passes, with per-1,000 shares · mxflux-categories.csv

Google Workspace is the only large provider gaining share at speed: from 115.1 to 136.0 domains per 1,000 — 4.73 million more domains (+29.6%) in sixteen months — and the Google-to-Microsoft ratio widened at every one of the ten steps, 1.279, 1.327, 1.336, 1.342, 1.357, 1.364, 1.373, 1.386, 1.403, 1.418, 1.433. Microsoft grew too, by 1.96 million domains (+15.7%), but its share moved only +4.9 per 1,000: it is growing with the Internet, not faster than it. Where the June census gave a ratio of 1.41 and called it an upper bound on Google's advantage, the series shows the bound itself moving outward by about 0.01 a month. The next section decomposes why.

The second story is the slow retreat of the self-addressed MX. Domains whose mail exchanger lives under their own name fell from 236.6 to 210.9 per 1,000 while staying flat in absolute terms (32.8M → 32.1M): all of the Internet's new mail routing is going to named platforms. The RIPE Labs study of the Tranco top million, published three weeks before this post, puts self-hosted mail at 22.4% of popular domains in July 2026 and declining about half a point a month; our whole-Internet figure — 21.1% in August 2026, declining about two points a year — lands within two points of it from a population four hundred times larger, which is about as good as cross-study triangulation gets in this field. The flows show what "decline" means in practice: 691,103 domains went from self-addressed MX to a registrar or hosting platform, 500,683 to a smaller unclassified host, 241,826 to Microsoft, 181,339 to Google — and the largest single self-hosted departures are not customers leaving but hosts centralizing: Fasthosts moving 181,177 of its shared-hosting domains onto livemail.co.uk in December and January, Hostinger moving 152,493 onto its own mail platform, hosttech and manitu doing the same at Swiss and German scale. The per-domain MX record was the artifact of a hosting era in which every cPanel account ran its own Exim; the platforms are quietly retiring it.

GoDaddy's secureserver.net lost 10.5 per 1,000 without a migration behind it. Its outflows to Microsoft (30,608) and Google (28,738) over sixteen months are small; the estate shrank by attrition — 1,032,838 of its April 2025 domains have left the crawl, 401,689 stayed but lost their MX, and 111,794 moved to a null MX on GoDaddy's own aftermarket landers — while only 903,008 new domains arrived on it, far below the rate new registrations arrive elsewhere — its share of newly mail-capable domains over the monthly window is 2.7%, against a stock share of 6.3%. Namecheap's default MX is the mirror image: +12.5 per 1,000 from new registrations arriving on registrar-servers.com (4.2 million arrivals against 1.6 million departures), with only 54% of its April 2025 cohort still mail-capable in August 2026. One default is fed by a fast-growing registrar's new names; the other is the residue of an older customer base. Hostinger (+8.2), Porkbun (78,790 → 478,586, six-fold) and Spaceship (18,222 → 100,787) are the same mechanism at different scales: a registrar's MX default reads as a proxy for its registration growth rather than for anyone choosing an email product.

The category rollup

Host-bundled email — the census's real winner — is exactly flat at 34%, and that flatness is the sum of opposite motions: GoDaddy, IONOS, OVH, Strato and Open-Xchange's hostedemail.com (−6.4, an estate that lost 885,376 domains to the crawl's exit and replaced 369,482) drifting down; Namecheap, Hostinger, Porkbun, All-Inkl and Titan rising to meet them. The cloud duopoly's combined share rose from 205.1 to 230.9 per 1,000 — and Google supplied 81% of that rise. Other cloud suites (+4.6: Zoho 1.39M → 2.01M, Proton 291K → 487K, Apple iCloud 344K → 485K) and forwarders (+8.7, almost entirely Cloudflare Email Routing's 786K → 2.12M, a 2.7× rise in sixteen months on a product that had passed a million zones by October 2023) are the two categories growing faster than Google in relative terms, from much smaller bases. The gateway layer is nearly static (+0.7 per 1,000): Proofpoint +30.8% (partly the Hornetsecurity acquisition closing in December 2025 — Hornetsecurity's own MX grew 61,620 → 95,502 alongside), Mimecast flat at 187K, Barracuda and Cisco shrinking by 3–4%. Where the A-record layer's long tail held 66% and the NS layer's defaults held 48%, the mail layer's host-bundled block holds its 34% through churn, not stillness.

The Stillness: What Sixteen Months Does to an MX Record

The fate of the 138,579,399 domains that were mail-capable in April 2025, by August 2026:

Download: mxflux-fates.csv · mxflux-monthly.csv

Among domains that survived the sixteen months, 91.03% sit on the bit-identical MX record set — not the same provider, the same hosts and the same preferences. Another 2.19% stayed with their providers through host renames and 0.40% kept their primary while changing a backup, leaving 6.39% of survivors that actually changed mail provider in sixteen months — about 4.8% a year. The comparison across our longitudinal set is now complete, and the mail layer is the stillest of the four: the NS layer moved 14.8% of survivors to a different operator over fifteen months (Who Moves the World's DNS), the A layer about 10.2% a year (Where the Web Moves), the CNAME layer retargets 1.25% of aliases a month (The Restless Aliases). Delegation is where registrars and parking platforms move domains by fiat; hosting is where sites get rebuilt; mail is where, once it works, the owner has every incentive never to touch it again — a change to MX risks losing mail, and nothing about a working mailbox prompts one.

The monthly ledgers put a pulse on it. Across the nine true month-over-month pairs, 98.5–99.4% of surviving domains keep their exact MX record set every month, and the gross provider-change rate runs 1.17%, 0.85%, 0.80%, 0.86%, 1.14%, 0.98%, 0.81%, 0.45%, 0.88% — a 0.88% monthly average, against 2.3% at the NS layer. "Gross" is the operative word: that figure includes the bulk estates and flickering catch-all keys described in Methodology, whose month-to-month re-pointing counts as a provider change each way. With flicker keys removed the organic rate is lower still — see the note below the Corporate Steps table — and the difference between the 0.88% monthly gross and the 6.39% sixteen-month net is exactly those round trips: a domain that toggles away and back ends where it started and is correctly not counted as having moved.

The per-domain view is the starkest. Of 175,175,012 apexes with at least two mail-capable observations, 159,216,591 — 90.89% — never changed mail provider once; 8.15% changed exactly once; just 103,291 changed four or more times, and 12 domains changed at every single observation. Tightening the test from provider to record set barely moves it: 88.78% never changed a single byte of their MX record set across every pass in which they were observed.

Where Google's Lead Comes From

If almost nobody switches, how does a ratio move from 1.28 to 1.43? The flow ledger answers this directly, because it separates four ways a provider's count can change: domains arriving new, domains leaving the crawl, domains migrating in from another provider, and domains migrating out.

Direct switching, pass by pass

Direct switching between the two suites is roughly symmetric — within 20% in eight of the ten intervals, with the widest gap in November–December 2025 (20,049 vs 12,151) — and if anything it leans slightly toward Microsoft. Roughly 7,500–20,000 domains a month move each way; across sixteen months, 9,428 more domains went Google → Microsoft than the reverse. Against Google's 4.7-million-domain gain, the switching market between the two is a rounding error with the wrong sign. Okta's 2025 workforce data reported that 48% of its Microsoft 365 customers also deploy Google Workspace — co-existence, not defection — and the MX layer, which can only see one primary per domain, agrees: nobody is winning the other one's installed base.

Sources of the gap, April 2025 → August 2026

Download: mxflux-lead-sources.csv · mxflux-duopoly.csv — per-interval switching and totals.

Microsoft wins the migration market and Google wins the birth market, and the birth market is six times bigger (9.5 million arrivals against 1.54 million switch-ins). Across every kind of provider switch, 904,169 domains moved to Microsoft 365 in sixteen months against 638,601 to Google — Microsoft took more domains out of self-hosting (241,826 vs 181,339), out of the gateways (131,616, mostly enterprises dropping Proofpoint for Microsoft's own filtering), and out of Google itself. Microsoft's domains also survive better: 86.8% of its April 2025 cohort is still mail-capable in August 2026 against Google's 83.0%, consistent with an enterprise-weighted base versus a small-business one. On every measure that involves an existing domain making a decision, Microsoft is at parity or ahead.

Google's entire lead is manufactured by domains that did not exist in April 2025: 6,611,226 newly mail-capable domains arrived on Google's MX against 2,888,963 on Microsoft's — 2.29 to 1, against a stock ratio of 1.43. Net of departures, Google added 4.52 million domains through births and Microsoft 1.71 million. The mechanism is the one the census hypothesized from a single frame and the series now shows in motion: counting domains weights the new small business, the side project, the agency client, the domain registered this morning — and for that population the arrivals suggest the default answer to "where does my email go" is Workspace, by two to one and widening. Seat counts measure the opposite end of the market, which is why Microsoft reports more than 450 million paid commercial seats while Google reports 13 million paying Workspace customers: different units, different Internets, both true. Two other domain-counting instruments land where we do — BuiltWith's August 2026 technology census finds 19.3 million sites on Google Apps against 15.2 million on Exchange Online, and the RIPE Labs Tranco-1M study finds Google 21.8% to Microsoft 16.8% among popular domains with MX — while the seat-weighted and SPF-weighted instruments (Gartner, DMARCguard's SPF-include census) put Microsoft first. The instrument decides the winner; ours counts domains, and by domains the gap is growing.

The gateway toggle is the one duopoly flow that changed direction inside the window. In the seven months to November 2025, 84,937 Microsoft-MX domains moved behind Proofpoint while 39,021 came out — enterprises adding a gateway in front of Exchange Online at more than two to one. By mid-2026 the two flows had converged: 8,409 in / 9,450 out in May–June, 8,034 in / 7,447 out in June–July, 12,132 in / 11,489 out in July–August. We cannot see why from a DNS record, but the timing is consistent with the industry's shift toward API-integrated email security that leaves the MX pointing at Microsoft — Gartner expected a fifth of anti-phishing to move to API-based products by 2025 — and it has a measurement consequence for this series: the rate at which Microsoft mailboxes disappear behind non-Microsoft MX records, which made the census's Microsoft share a floor, has stopped accelerating. Microsoft's true domain count is still above its MX count; the gap is no longer widening.

Apple's entry into this market is the null result of the window. Apple Business launched on April 14, 2026 with free custom-domain email; iCloud MX grew 344,461 → 485,421 (+41%) over the sixteen months, but the monthly arrivals (28,411 in January–February, 20,769 in March–April, 10,124 in April–May, 13,066 in July–August) show no launch step at all — four months in, Apple Business has not produced a wave an MX census can see.

The Corporate Steps: When a Quarter-Million Domains Move in a Month

The largest provider-to-provider flows over the final month and the seven-month gap, flicker keys excluded (the ParkLogic ↔ plingest.com portfolio moves are discussed below rather than tabulated, because ParkLogic's parking MX is itself a flicker key):

July 2026 → August 2026 (39 days)

April 2025 → November 2025 (the seven-month gap)

Download: mxflux-flows.csv — top flows for every interval.

The single largest move of the final month — and the largest owner-independent flow of the entire series — is a quarter of a million GoDaddy-managed zones changing their inbound mail route in 39 days. 249,722 apexes, 98.5% of them .com and every one delegated to GoDaddy's domaincontrol.com nameservers, published Mailgun's inbound-routing exchangers (60 mxa.mailgun.org / 60 mxb.mailgun.org) in the July crawl and GoDaddy's own smtp.secureserver.net / mailstore1.secureserver.net in August, with identical record sets across the whole population; the raw July records and today's live answers were checked by hand. DNS cannot say which product sat behind the Mailgun routes — a GoDaddy service built on Mailgun, or a third-party service provisioning GoDaddy zones — and the direction is the surprising one, since GoDaddy has spent two years publicly retiring the legacy platform those domains landed on. What DNS can say is that no owner of a small-business .com decided this 249,722 times in five weeks. Mailgun's count fell 894,681 → 639,708 and GoDaddy's rose 9,393,630 → 9,583,490 in the same step, which is why the scorecard's GoDaddy line ticks up in its final month after fifteen months of decline: a platform moved a route, and a market-share chart would have recorded it as a customer win.

The April-to-November gap is dominated by a bulk portfolio moving between a parking platform and its own servers. hostedmxserver.com — the catch-all MX that ParkLogic's parking nameservers publish for the domains they monetize — held 581,263 domains in April 2025 and 1,272 in November; plingest.com, which did not exist in April, held 1,627,873 — fed by 262,215 straight off ParkLogic, 186,209 off Namecheap's default MX, 71,004 off self-addressed records and 28,130 off Google. Joined against the delegation layer, 91.5% of the June plingest.com estate sits on Namecheap's default nameservers, spread across .com, .xyz, .info, .org, .site and .pro: one registrant's bulk portfolio on a registrar's DNS, not a hosting company. In January 314,724 of those domains flowed back onto ParkLogic's MX. Then, between the June and July crawls, the plingest.com estate vanished: 664,323 domains left the crawl and 495,229 stayed but lost their MX, leaving 1,132. A 1.6-million-domain mail estate — bigger than Zoho's, bigger than Cloudflare Email Routing's — was assembled, parked, un-parked and dissolved entirely inside our window, and the census, which photographed the pair in June at 1,182,030 plus 481,231, labelled the ParkLogic half a security gateway. This is the MX-layer face of the burner-domain conveyor The Restless Aliases found at the CNAME layer and the expiry conveyors the NS series found: the tail is organic and the steps are corporate — or, here, industrial.

The rest of the table is hosts consolidating their own estates, the pattern that drives the self-hosted decline. Fasthosts moved 181,177 shared-hosting domains from per-domain MX onto livemail.co.uk in two monthly steps (90,013 November–December, 91,164 December–January), a platform that held 2,643 domains in April 2025 and 218,731 in August 2026. ISPGateway — the domainFactory mail platform GoDaddy acquired with Host Europe Group — shed a quarter of its estate in the gap (413,176 → 311,921), 50,774 of it to Microsoft 365 and 18,746 to GoDaddy's own secureserver.net: a parent consolidating an acquired brand onto the products it resells. one.com moved 52,100 domains to hostnet.nl and 14,806 to uniweb.no — its Dutch and Norwegian sister brands under the group.one umbrella — all inside the gap. And kv.de, a key that did not exist before March 2026, acquired 283,450 domains in two months (70,131 in March–April, 213,319 in April–May) — every one of them a domain that previously had no MX at all, and 94.4% of them delegated to a single operator's nameservers (kv-gmbh.de): one German portfolio holder switching on a mail route for its entire estate, the same kind of event as Afternic's null-MX template below but with the opposite sign.

On the organic rate. Removing every flow that touches a flicker key or a bulk estate from the monthly ledgers lowers the provider-change rate among survivors from the 0.88% gross average to 0.51% a month (0.36–0.77% by month), and the sixteen-month endpoint figure from 6.39% to 5.84% of survivors — the share of the mail layer where a person or a company, rather than an inventory system, decided to move. Even the gross figure is well under half of the NS layer's 2.3%; the organic one is less than a quarter of it.

The Rise of Null MX: Thirteen Million Domains Refuse Mail, and One Platform Decided for Most of Them

RFC 7505, published in 2015, lets a domain state that it accepts no mail at all by publishing a single MX of preference 0 pointing at the root — 0 .. A sending server that sees it fails immediately instead of retrying for days against a domain that was never going to answer, and a spoofer impersonating the domain finds fewer places to hide. No public Internet-wide adoption figure existed before the June census measured 11.75 million null-MX apexes from one frame. This is the first series.

Download: mxflux-nullmx.csv · mxflux-tld.csv — null-MX, mail-capable and observed counts per TLD per pass.

Null MX nearly quadrupled — 3.39 million to 13.38 million apexes, from 1.3% to 4.2% of every registered domain we can see — and two-thirds of the rise landed in the seven-month gap. The ledger decomposes the gap: of November's 9,995,550 null-MX domains, 2,830,132 already had one in April; 3,843,620 had no MX at all in April; 2,789,908 arrived in the crawl new with one; 531,890 dropped a working MX for it — while 561,771 of April's null-MX domains left the state (most of them leaving the crawl or losing the record), for the net +6.6 million. The adopters were not, in other words, administrators who read an RFC. They were domains whose zones were rewritten in bulk.

Joining every null-MX apex in the July 2026 pass against the same pass's NS delegation says who held the pen. Of the 12,528,204 null-MX apexes that also appear in that month's NS crawl (12,544,882 in all), 9,643,702 — 77.0% — are delegated to afternic.com nameservers, GoDaddy's aftermarket platform; another 479,613 (3.8%) sit on GoDaddy's cashparking.com, for a GoDaddy-family total of 80.8%. Among .xyz null-MX domains the Afternic share is 91.4%. The same join on the April 2025 pass puts Afternic at 1,801,961 of 3,373,577 NS-matched null-MX domains (53.4%) at the start of the window: its null-MX estate grew 5.4× in sixteen months and accounts for 86% of the entire rise. Afternic's landers publish 0 . by template, and Afternic's delegated estate — which Who Moves the World's DNS watched grow from 2.1 million to 9.75 million domains as GoDaddy consolidated its NameFind portfolio and parking defaults onto Afternic nameservers between April and December 2025 — is essentially coextensive with the null-MX population: 9.75 million delegations, 9.64 million null MX. The most dramatic line in RFC 7505's adoption curve is a single company's zone template, applied to inventory it already controlled, in the same corporate consolidation the delegation layer recorded four months before the MX layer did. The two series describe one event from two record types.

The same join shows what genuine adoption looks like, and how small it is. After Afternic and CashParking, the largest null-MX delegations are nameshift.com (199,099), one.com (167,714 — a host defaulting its unused domains to "no mail"), dns.br, the DNS service operated by Brazil's registry, which publishes the null record by default when no mail server is configured (160,463 — the reason .com.br null-MX runs 7.0%, the highest of any major ccTLD), GMO's expiry pool onamae-expired.com (153,516), and Cloudflare (109,675 — the closest thing in the data to a population of owners who chose it). Registries, hosts, and expiry conveyors account for the next tier; individual decisions are a rounding error on a rounding error. The .xyz column is the purest case: 65.2% of every .xyz apex we observe publishes a null MX, up from 14.8% sixteen months ago — because most of .xyz's numeric and short-name inventory sits on Afternic landers — and .us went from 1.1% to 11.8% for the same reason.

For the security reader this is good news with a caveat. A parked domain with a null MX is a parked domain that fails fast for senders and closes one spoofing avenue — the State of TXT found 22 million domains publishing SPF without any MX and 17 million publishing DMARC without MX — largely the v=spf1 -all / p=reject brand-protection posture seen from the TXT side — and those populations overlap this one heavily. The caveat is inheritance: when 80% of a protective record is one vendor's template, its presence tells you where a domain is parked, not what its owner intends, and its removal will be just as wholesale as its arrival — exactly the lesson the mailbox-provider security study drew about DMARC. Null MX has become, overwhelmingly, a property of the GoDaddy aftermarket.

The parking layer's other MX signature is the opposite of null: a mail exchanger that accepts everything. Above.com's park-mx.above.com is the largest parking platform running an MX estate in its own name (1.23 million domains, 93.4% of them delegated to abovedomains.com; ParkLogic's hostedmxserver.com carries about half a million, while Bodis, Dan.com and Sedo never carried more than a few hundred), and it behaves like the conveyor the Parking Lot series described: 3.2 million domains arrived and 3.2 million left over eight monthly pairs against a stock of 1.2 million — a 260% gross monthly turnover, 27.8% of its April 2025 cohort still mail-capable. Its neighbours in the flow table are a family of AWS-hosted catch-all registrables — h-email.net, alltheemails.com, hope-mail.com — that trade parked and expired names among themselves (Above → alltheemails 27,341; alltheemails → h-email 62,251) and flicker between "has MX" and "no MX" for most of their stock every month. Joining h-email.net's 375,907 July domains against their delegation says what they are: 76.3% sit on ParkingCrew's nameservers and most of the rest on other parking DNS (redfoxdns, fastpark, parkingspa) — the mail side of the parking business, switched on and off with the inventory. These are the keys we fence out of switching statistics; they are also a reminder that a non-trivial slice of the Internet's MX records exists to harvest mail sent to domains nobody lives at any more.

The Loyalty League: Stickiness Is a Business Model

Of the April 2025 cohort's survivors — domains still mail-capable in August 2026 — the share still on the same primary MX operator (cohorts ≥ 750K):

Download: mxflux-loyalty.csv

Every major mail provider keeps more than 90% of the domains that survive — the league is compressed into a ten-point band in a way the NS and A layers never were — and the differences inside the band are consistent with business models rather than service quality. The top is registrar and hosting bundles where mail is welded to the domain and the invoice (GoDaddy 98.3%, All-Inkl, Strato, OVH, IONOS — the same European incumbents that topped both the A-layer and NS-layer leagues). Google (96.7%) edges Microsoft (95.1%) on loyalty while Microsoft edges Google on survival (86.8% vs 83.0%): Google's domains leave the Internet more often, Microsoft's domains leave Microsoft more often — and the Proofpoint row shows where they go. Proofpoint has the highest survival in the table (91.5% still mail-capable: enterprises do not let domains lapse) and nearly the lowest loyalty (86.8%), because the gateway toggle runs both ways.

The bottom half reads as a survival table more than a loyalty one. Namecheap's and Hostinger's defaults lose roughly half their cohort to the crawl's exit in sixteen months — the registrar-default MX is attached to the most mortal domains on the Internet — yet 90–94% of those that survive stay put. Cloudflare Email Routing repeats the paradox the NS series found for Cloudflare's nameservers: worst survival among named platforms (62.9%), high loyalty among survivors (90.2%), fastest organic growth of any provider — a free product is a magnet for short-lived domains, and growth and churn are the same business. Above.com is the floor on both axes, as a parking conveyor should be.

The TLD Panel: Mail Capability Is Falling Everywhere Except Italy

Mail-capable share of observed apexes and null-MX share, April 2025 → August 2026, with cohort loyalty:

The mail-capable share fell in every TLD in the panel but one, and the exception is informative. Part of the fall is the denominator effect already flagged — the July–August corpus expansion brought in names without mail — but the ccTLD rows, whose observed counts grew only 5–10%, show a genuine drift too: .nl 78.0 → 74.1, .co.uk 69.8 → 64.1, .com.br 71.5 → 63.2. Italy's .it rose 81.7 → 84.4 against the tide. The European national namespaces remain the most mail-dense on the Internet — four in five .de, .fr and .it domains can receive mail, against fewer than half of .com and under a tenth of .xyz and .top — and also among the most loyal (94–95% in .fr, .it, .com), consistent with the bundle-driven stillness of the loyalty league. .xyz is the panel's outlier in every column: its mail-capable share collapsed from 22.2% to 8.9% as its observed apex count nearly tripled and 65% of it came to rest on Afternic's null-MX template. A .xyz domain that can receive mail is now a one-in-eleven event.

What's at Stake

• Email market share by domain count is now a two-speed statistic — the installed base barely moves (6.4% of survivors switched provider in sixteen months), so the entire motion of the Google–Microsoft ratio comes from the 39 million domains born into the crawl during the window. Any vendor or analyst reading the ratio as "customers choosing Google over Microsoft" is reading the birth rate of small domains, not a migration.
• The Microsoft floor has stopped sinking — the flow of Microsoft-MX domains disappearing behind third-party gateways fell from 2:1 to parity inside the window. Every MX-based census of Microsoft 365 published before 2026 undercounted it by a growing margin; the margin is now stable, and the correction should be stated as a constant rather than a trend.
• Null MX is a parking signal, not a security posture — 80.8% of the 12.5 million null-MX domains are on GoDaddy-family aftermarket nameservers. Tools that score a domain's abuse potential by the presence of a null MX are scoring whether it is listed on Afternic. Conversely, the 13 million domains that now fail fast for senders are a real, if accidental, reduction in the Internet's backscatter surface.
• A platform can move more mail routes in five weeks than the two suites trade in sixteen months — 249,722 GoDaddy-managed zones were re-pointed off Mailgun in 39 days, more than every Google ↔ Microsoft switch in both directions over the whole window (193,798); a bulk portfolio assembled and dissolved a 1.6-million-domain estate inside the window; Fasthosts, ISPGateway, one.com and kv.de each moved six figures by fiat. Incident-response and threat-intel teams that alert on MX changes need a whitelist of these re-plumbs, which the flow ledger supplies.
• The census's own numbers needed correcting, and only a second pass could show it — the June 2026 denominator was 24% private-suffix pseudo-apexes (mail capability is 50.2% of registered domains, not 38.7%), livemail.co.uk belonged to Fasthosts, and hostedmxserver.com was ParkLogic's parking MX, not a gateway. Single-crawl censuses of the mail layer, including ours, carry classification errors that only longitudinal flows expose.

What Would Help

1. Email providers and analysts: report domain counts and seat counts as different markets, and stop netting them. By domains Google leads 1.43 to 1 and widening; by seats Microsoft leads by a wider margin still; both are correct because they measure opposite ends of one distribution. The flow table shows which end moves: the seat end switches at ~10,000 domains a month in each direction, the domain end is born 2.3-to-1 Google. A vendor claiming momentum from either number without saying which market it is describing is saying nothing.

2. Aftermarket and parking platforms: publish your zone template. Afternic's 0 . is, on balance, a public good — it is the largest single contribution to RFC 7505 deployment in the standard's history — but nobody outside GoDaddy knew that 9.6 million domains had acquired it until a measurement series found it. A one-paragraph statement of what a platform's default zone contains (MX, SPF, DMARC) would let registries, security vendors and researchers read those records correctly, instead of treating template-wide defaults as nine million individual decisions.

3. Hosting providers centralizing mail: announce the migration. Fasthosts, Hostinger, ISPGateway, one.com and kv.de together moved close to a million domains' MX records onto new platforms in this window, mostly inside a month or two and mostly without a public note. Each of those steps is a false positive for every customer who monitors their own MX, and a real failure mode for anyone whose SPF include: still names the old platform. A dated migration notice costs a blog post; its absence costs bounced mail.

4. Security teams: treat an MX change as the rare event it is. Among persistent domains 90.9% never changed provider in sixteen months and 88.8% never changed a byte of their MX set; the organic monthly switching rate is 0.51%. An unexpected MX change on a monitored domain is therefore a very low-noise signal — provided the known platform re-plumbs (this post's flow table), the flicker keys (the momentum CSV's flicker column) and the Afternic null-MX template are subtracted first.

5. Researchers: walk the private suffixes and never classify from one frame. A quarter of what a naive PSL call returns as "apexes" in a crawl of this size are platform hostnames with no mail at all, and the census's provider taxonomy carried two mislabels that only sixteen months of flows could reveal. The corrected rule set, the per-provider flicker index and the pair ledgers are published with this post; the next MX census should start from them, and every MX-derived security score should be validated against the delegation layer before a null MX is read as intent.

Methodology: eleven full MX-typed crawls of the DomainsProject corpus (April 10, 2025; November 2, 2025; then monthly December 17, 2025 – August 19, 2026; ~2,500–3,250 result shards and ~52 GB of compressed responses per pass), reduced to one record per ICANN-registrable apex — mail-capability state, full MX record set, and primary-MX operator per the published census classifier with the corrections noted in Methodology — and merge-joined by name across all passes: 421,855,712 distinct apexes, 167.7M observed in every pass. The June 2026 pass reproduces the published census's provider counts to within 0.4% and restates its denominator (50.2% of registered apexes are mail-capable, not 38.7%). Null-MX attribution by joining against the July 2026 NS crawl. Russian-administered TLDs excluded throughout. Full data: provider series, categories, pair ledgers, fates, flows, duopoly switching, lead sources, momentum and flicker, null MX, TLD panel, loyalty. Explore the dataset at domainsproject.org/dataset and the live numbers at /stats.