Mailbox on one platform, sender authorised on another

In the September 2026 census, 59,727,661 domains publish an SPF (Sender Policy Framework) record and a primary MX (Mail Exchange) host that each name a mail vendor the census recognises. For 7,789,035 of them, 13.0%, the two name different vendors: mail arrives at one company, and SPF authorises another to send the domain’s mail.

Most of that is how the setups are built. 4,798,720 of the mismatched domains, 61.6%, use a host’s SPF include that carries the mailbox platform’s own include inside it, and 4,606,741 of those are GoDaddy records on Microsoft 365 mailboxes. Another 1,085,935 receive mail through a filtering gateway such as Proofpoint or Mimecast, and 366,675 are one company listed under two names.

The group that matters is smaller: 757,118 domains, 1.3% of those with both labels, receive mail at Google Workspace or Microsoft 365 and publish an SPF record that names neither the platform nor a host whose include carries it. 709,253 of them are on Google Workspace, 5.4% of its mailboxes in the base. Mail those mailboxes send can’t pass SPF unless the record authorises the platform some other way, and in a sample checked live most records didn’t.

Figure 1. What the mismatches are. The blue bar is the group whose SPF record leaves the mailbox platform out.

How the two labels were read

The census reads each domain’s TXT (Text) and MX records. For this page each domain got two labels: the vendor its SPF record names, and the vendor running its primary MX host, the one with the lowest preference number. A label is the first vendor in a fixed list whose include or host name appears in the record. The list has 59 match strings for SPF, such as _spf.google.com and secureserver.net, and 39 for MX hosts.

81,886,646 SPF records and 81,772,136 primary MX hosts got a label. 59,727,661 domains got both, and that is the base for every share on this page. 43,741,459 of them sit under gTLDs and 15,977,756 under ccTLDs; the 8,446 under internationalised endings are in the totals and aren’t split out.

Each SPF record gets one label, even when it includes several vendors. The list is checked in order, Google first and Microsoft second, so a record that includes Google and Mailgun counts as Google. That order is what lets this page say a record leaves a platform out: a record labelled with any vendor except Google doesn’t contain Google’s include, and one labelled with anything except Google or Microsoft doesn’t contain Microsoft’s. It also means a record labelled Google or Microsoft may name other vendors the label doesn’t show.

Where the mail lands and who may send it

Each row of the matrix is a mailbox vendor, and each cell is the share of that vendor’s domains whose SPF record carries the label in the column. On the diagonal the two agree. At the large hosting companies they agree for nearly all domains: 99.8% at Namecheap, 99.8% at Hostinger and 99.5% at IONOS. Google Workspace agrees for 93.2%. Microsoft 365 agrees for 66.9%, the lowest of the ten, because 32.0% of its mailboxes carry GoDaddy’s SPF record.

Figure 2. The matrix. Rows are where mail arrives, columns are what SPF names, and each row adds to 100%. The outlined cells are the diagonal.

The same ten vendors, and Proofpoint, read from both sides. Each share is of that vendor’s own domains in the base.

Read from the SPF side, GoDaddy’s label sits on a GoDaddy mailbox for 21.4% of its 7,008,627 domains. Proofpoint’s MX hosts carry a Proofpoint SPF label for 2.4% of theirs. The next section explains both.

Mismatches that work as built

Host records that carry the mailbox platform

GoDaddy resells Microsoft 365. In the three country-code endings re-read in full for this page (.ac, .ie and .nz), 7,556 of the 8,011 domains with a GoDaddy record and a Microsoft 365 mailbox publish exactly v=spf1 include:secureserver.net -all. That include names one more, and that one names spf.protection.outlook.com, Microsoft’s own. So that record authorises Microsoft 365 through GoDaddy’s include, although its label says GoDaddy. The pair covers 4,606,741 domains.

HostGator’s include, websitewelcome.com, carries more. It includes both _spf.google.com and spf.protection.outlook.com, and 182,718 Google Workspace mailboxes and 9,261 Microsoft 365 mailboxes carry a HostGator record. The two includes apply whether or not a domain uses either service: 25,209 of the 217,188 domains in the base whose record carries HostGator’s label receive their mail somewhere else.

We looked up these include records on 4 October 2026, a month after the census captured the domains’ own records. Most domains name the standard include. Across the census, secureserver.net itself appears in 7,372,957 domains’ records. Every other include name containing it, misspellings included, appears 699,989 times, and the most common of those, spf.em.secureserver.net (677,414), doesn’t carry Microsoft’s. websitewelcome.com itself appears 3,218,089 times, and other names containing it 7,333.

On the same day we took fixed samples of each group from those three endings, fetched each domain’s SPF record, kept the records unchanged since the census and evaluated them for one real sending address of the mailbox platform: 209.85.220.41 for Google Workspace and 40.107.22.50 for Microsoft 365. 192 of 192 GoDaddy records on Microsoft 365 mailboxes passed, and so did 175 of 180 HostGator records.

A carried include can still fail. Bluehost’s include reaches Microsoft’s only at its ninth DNS (Domain Name System) lookup, and SPF allows ten per check. A record that spends lookups first, such as v=spf1 a mx ptr include:bluehost.com ?all, runs out before it gets there and returns a permanent error, which all 5 sampled Bluehost records on Microsoft 365 mailboxes did. This page counts those 787 domains with the mailboxes SPF leaves out; the lookup limit explains the arithmetic.

Gateways and two names

Proofpoint and Mimecast filter mail before it reaches the mailbox: their MX hosts take mail in and pass it on to the mailbox platform. Of the 1,085,935 gateway domains whose labels differ, 1,053,385 (97.0%) carry a GoDaddy or Microsoft 365 record, which authorises Microsoft 365 to send, directly or through GoDaddy’s standard include. A gateway that also relays outgoing mail needs its own include as well, and the label can’t show whether a record has one.

Two more pairs come from the list itself. Tencent’s SPF include and its MX hosts appear under different names in the two lists, on 354,237 domains, and so do Alibaba’s, on 12,438.

The mailbox SPF leaves out

757,118 domains receive mail at Google Workspace or Microsoft 365 and publish an SPF record that names neither the platform nor a host whose include carries it: 709,253 Google Workspace mailboxes, 5.4% of those in the base, and 47,865 Microsoft 365 mailboxes, 0.3%.

Figure 3. What SPF names for the two largest mailbox platforms. Blue is the share left out.

Most of these records name a web host instead. 52.8% carry a host or registrar label, led by Hostinger’s include on 94,154 domains, GoDaddy’s on 79,064 (its include carries Microsoft’s, which doesn’t help a Google mailbox) and OVH’s on 42,454.

27.3% name a bulk or transactional mail service such as Mailgun, MailerLite or Mailchimp. Those services send newsletters and receipts, while the mail people write leaves from the mailbox. 8.2% name a relay or forwarding service, and 11.6% another mailbox provider, including 35,591 Google Workspace mailboxes whose record names Microsoft 365.

When someone at one of these domains sends an email, it leaves from the mailbox platform’s servers. The receiving server looks up the domain’s SPF record, doesn’t find those servers in it, and gets softfail, fail or neutral depending on how the record ends, or a permanent error if the record breaks SPF’s own rules. DMARC (Domain-based Message Authentication, Reporting and Conformance) can still pass on a DKIM (DomainKeys Identified Mail) signature for the domain itself. Google Workspace signs with a gappssmtp.com key until an admin turns on DKIM for the domain, and that signature doesn’t count for DMARC.

Moving a mailbox and leaving the old SPF record in place is one way to arrive here. The census can’t tell how any domain got there, and a domain may send no mail from its mailbox at all.

The live sample agrees with the labels. Of 182 Google Workspace records unchanged since the census, 175 didn’t pass SPF for Google’s sending address, and the 7 that did authorise Google some other way, such as raw address ranges or an older Google include. The Microsoft group is less clear: 81 of 98 didn’t pass, and 17 reached Microsoft’s address through ranges or an organisation’s own include.

More of the Microsoft group had changed, too: 102 of the 200 sampled records differed from the census by the time of the check, against 5 of 200 records already matched to Microsoft 365.

So treat 709,253 as an upper limit. Some records authorise Google in a form the label list doesn’t look for. Across the census, 58,851 domains name aspmx.googlemail.com, which redirects to Google’s include, 14,182 name google.com, and up to 7,333 name Google’s netblock records directly; the census doesn’t say how many of those fall in this group. On the Microsoft side, 6 other Microsoft includes that carry its sending range appear 15,785 times across the census.

Figure 4 puts the two groups on one scale. Gateway domains name the platform behind the gateway, or GoDaddy’s record that carries it; the left-out domains name hosts and mail services.

Figure 4. The left-out group (blue) and the gateway group (grey) on one scale, by the vendor the SPF record names.

The 25 largest pairs

Together the 25 largest pairs cover 6,970,859 domains, 89.5% of the mismatch. 12 of them leave the mailbox platform out, 6 work as built, and 7 can’t be settled from one label.

Figure 5. The 25 largest mismatched pairs. Blue pairs leave the mailbox platform out, mid grey pairs work as built, and light grey pairs can’t be settled from one label.

103,833 Microsoft 365 mailboxes carry a record labelled Google. The label shows the record includes Google, and it can’t show whether the record includes Microsoft too. In the sample most did: 181 of 188 unchanged records passed for Microsoft’s address.

The remaining 676,754 mismatched domains pair hosts, forwarders and smaller mailbox providers. For those, the mailbox vendor’s include may come later in the list than the vendor the label names, so one label can’t say whether the record carries it. The largest of these pairs is Google Workspace records on Cloudflare Email Routing mailboxes, with 51,348 domains.

By ending

Mismatches are more common under gTLDs, 14.3%, than under ccTLDs, 9.6%, and most of the difference is GoDaddy’s record on Microsoft 365 mailboxes: 8.6% of the gTLD base against 5.2% of the ccTLD base. The left-out group is a similar size in both, 1.2% and 1.4%.

Each row is a share of that ending’s own domains with both sides labelled.

Among the 15 endings with the most labelled domains, .ca, .au and .com have the highest mismatch rates, and in each of the three GoDaddy’s record on a Microsoft 365 mailbox makes up at least 61.2% of the mismatch. The left-out share stays between 0.2% and 2.1% in all fifteen.

Figure 6. Labels that differ, by ending, as a share of each ending’s labelled domains. Blue is the share whose SPF record leaves the mailbox platform out.

What the census can’t see

• The census reads records and doesn’t send mail, so it can’t tell whether any message was delivered, filtered or rejected. A DKIM signature for the domain can carry DMARC when SPF doesn’t pass.
• Each SPF record carries one label, chosen in a fixed order, so a record that includes several vendors shows as the first. The left-out group rests on that order, and the Google records on Microsoft 365 mailboxes can’t be read from it.
• Only the primary MX host is labelled. When two hosts share the lowest preference, or a domain has two scan rows, the pick between them is arbitrary, so running the same query twice on the same data moves the counts by a few domains. The pass’s two output files differ by 435 domains for that reason.
• .com ran in 24 parts, so a .com domain with scan rows in two parts can be counted twice: at most 86,951 domains, 0.1% of the base.
• Misspelt includes count under the vendor they name. Across the census, 9,240 domains name spf.google.com without the leading underscore, which doesn’t exist, and 1,218 name _spf.protection.outlook.com, which doesn’t either.
• The include records and the sample were checked on 4 October 2026, a month after the census. A provider can change its include at any time.
• A domain with more than one SPF record is labelled from one of them, although SPF itself treats two records as an error.

See your own

The free scan reads your SPF record live. If your mailbox is at Google Workspace or Microsoft 365, the Google Workspace SPF setup and the Microsoft 365 SPF setup give the include to add, and SPF after switching provider covers what to take out.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. The include records and the sample check were looked up on 4 October 2026. Census numbers move every month; the current values are on the data page.