Email is the most decentralized protocol still in mass daily use — on paper. Anyone can run a mail server; no company owns the standard. In practice, our nightly scan of the Tranco top-1M shows that as of the 2026-07-05 snapshot, 21.75% of domains with an MX record hand inbound mail to Google Workspace and 16.68% to Microsoft 365. Combined: 38.4% of the world's notable business domains, judged by two spam filters, governed by two policy teams, run out of two companies' clouds.
A decade ago the picture was different. In 2016, self-hosted servers held 42.76% of the market and Microsoft held 4.46%. The consolidation happened quietly, one IT migration at a time.
And the consolidation is not finished. Since 2022, Microsoft 365 has added 4.31 percentage points against Google's 1.64 — growing 2.6× faster, pulled by enterprise bundling. The duopoly is becoming less symmetric, not less dominant.
Spam filters as private regulation
When two receivers cover 38% of business domains, their filtering rules stop being product features and start functioning as regulation. Nobody voted on them, no court reviews them, but every sender on earth complies with them.
The February 2024 Google/Yahoo bulk-sender requirements are the cleanest example. A blog post from two mailbox providers did what fifteen years of RFC advocacy could not: it pushed DMARC publication into the mainstream. Our dataset shows the wave directly — a surge of new p=none records right after the mandate, large enough that the share of enforced policies temporarily fell even as absolute numbers grew. That is regulatory power: unilateral, global, effective within months.
Is that bad? The rules themselves — authenticate your mail, honor unsubscribes, keep complaint rates low — are rules a reasonable regulator might have written. The concern is procedural, not substantive: there is no appeal process, no notice-and-comment period, and the next rule arrives whenever a product team decides it does.
Blast radius
Concentration converts small events into systemic ones. Consider what a single bad afternoon at either company now touches:
- Outages. An inbound-mail incident at Google or Microsoft delays or bounces mail for over a fifth of top-1M domains each — simultaneously, worldwide, with no failover the customer controls.
- Filtering regressions. A misfiring classifier update does not affect one inbox; it affects hundreds of thousands of domains in the same hour, in the same way. Homogeneity means errors are correlated.
- Policy coupling. When both giants adopt similar requirements — as they did in 2024 — the "market" response is not diversification but synchronized compliance. There is nowhere else large enough to route around them.
Ecologists call this a monoculture problem: efficient, high-yield, and fragile in correlated ways. Email in 2016, with 42.76% of domains on idiosyncratic self-hosted servers, was messier and worse-filtered — but its failures were uncorrelated.
The moat around the inbox
The third effect is the hardest to see because it shows up as absence: new mailbox providers barely exist. Building one now means matching a decade of machine-learned filtering, warming reputation systems that distrust new infrastructure by default, and convincing customers to leave suites their documents and calendars already live in.
The exception proves the rule. The fastest-growing newcomer in our dataset is Cloudflare Email Routing — from zero before 2021 to 1.60% of MX domains today. But it is a forwarding service, not a mailbox: most of that mail ultimately lands in — Gmail. Even the disruption routes into the duopoly.
The case for calm
Two things keep this from being a doom piece. First, the monoculture is not total: 22.53% of MX domains remain self-hosted and another 12.45% resolve to providers too small or too local for our 310+ patterns to name. Roughly a third of receiving infrastructure still sits outside the big clouds, and the protocol's openness means it can stay there indefinitely.
Second, the duopoly has delivered genuine public goods: baseline security for millions of organizations that ran unpatched mail servers in 2016, and the authentication push that lifted DMARC to 459,124 top-1M domains. Private regulation is still regulation — and email needed some.
The honest summary: email's decentralization is now a legal fiction maintained by a technical minority. Whether that minority holds at a third of the internet or erodes further is one of the quieter, more consequential infrastructure questions of the next decade — and one you can watch move, week by week, in our daily email infrastructure report.
The concentration series behind this article — provider shares, DMARC counts, long-tail composition — are updated nightly and exposed as machine-readable JSON at api/latest.json.