Email security gateways cover 2.2% of corporate domains. Microsoft and Google run the mailboxes for 24%.

Inbound mail passes through at most two commercial layers before it reaches a mailbox. A security gateway may sit in front, filtering. Behind it sits the mailbox platform that holds the mail. Each is a dependency the domain owner cannot swap quickly, and each concentrates differently.

The gateway market behaves the way a specialist market is expected to: 80 vendors, the top three holding 61.3%, and a Herfindahl–Hirschman index of 2,581. On that index, near zero means fragmented and 10,000 means one company holds everything. It is a textbook accumulation, and worth modeling.

But it covers 2.2% of corporate domains (2,482,563). The mailbox layer covers 24%, split between Microsoft (12.0%) and Google (12.0%). It is the layer almost nobody carries as a named dependency, because it is bought as productivity software, not as security infrastructure.

A portfolio that models a gateway vendor as an accumulation and Microsoft as an IT expense has the exposure inverted by an order of magnitude.

One vendor holds 49.0% of the gateway market worldwide. That is real, and close to useless for a book written in one country, because 55.6% of the segment sits in .com: a namespace with no territory. Inside national markets, the picture changes completely.

Three of these are effectively single-vendor markets. A Swedish book is not exposed to the global leader at 49.0%. It is exposed to a domestic hosting company at 94.7%. A Slovak book is exposed to one vendor at 95.8%. Neither vendor appears near the top of a worldwide table.

The United Kingdom is the opposite shape: a genuine two-vendor market at 26.5% and 20.3%, with a long tail beneath. Territory changes not just the numbers but the kind of risk, from a diversified market to a single point of failure.

The mailbox layer splits by country too, in the other direction.

For an Australian or Canadian book, this is the largest single correlated exposure, and it is not an email-security vendor at all. Germany is the reverse: 8.8%, with mail mostly on domestic hosting. A global average of 24% describes neither market.

Where a gateway sits in front, the mailbox platform behind it can be read from the same DNS records. On a vendor list that looks like defense in depth: two suppliers, two contracts. It is one path, and if either end stops, mail stops.

about 99,600 domains depend on Barracuda and Microsoft 365 at once, and about 84,400 on Mimecast and Microsoft 365. A book holding both concentrations is less diversified than a vendor-by-vendor view shows. Proofpoint is the counter-example at 14.2%: most of its estate sits on self-hosted and third-party mail.

Mail was designed to fail over. In practice it no longer does.

98.4% of corporate domains list mail hosts that belong to exactly one operator. Where a domain lists several mail records, they are nearly always several machines of the same provider: resilient to a server failure, not to a provider-level outage. For nearly every domain, the operator delivers mail or the domain receives none.

Two operators of similar size do not front similar estates. What differs is how those domains were bought and run, and one measure of that is observable: whether the domain enforces DMARC, so that receivers refuse mail spoofing it.

The gateway segment as a whole enforces at 27.6%, against 14.5% across all corporate domains. But the range inside the segment is wider than that gap: from 43.3% down to 0.8%. Operators sold as security to an organization that went looking for it front estates enforcing at 35–43%. Those whose filtering comes bundled with hosting or a managed-service channel front estates in the low single digits.

Every figure comes from records the domains publish themselves. A domain’s mail records name the hosts that accept its mail, and its sender policy names the platforms allowed to send as it. Reading both reconstructs the delivery path without touching a mailbox or asking anyone.

• The population: 112,873,998 corporate domains on 8 September 2026. Each accepts mail through a usable mail server, is not parked, has a website address and publishes SPF: a domain deliberately operating email. The filter is not neutral across markets, because SPF is often set by the hosting provider rather than the organization.
• Domains, not organizations. One organization may hold hundreds of domains behind one gateway: one claim, not hundreds.
• Only what the mail records reveal. Email security delivered through the mailbox’s own API, not by taking over mail routing, is invisible to this method. The gateway figures are a floor on email-security vendor exposure, not a market measurement.
• Country-code domains stand in for territory; .com does not. Confirm territorial figures against a book’s own domicile data.
• 72% of domains resolve to a named operator. Most of the rest run their own mail on a host serving only their domain. The largest unattributed operator is 0.029% of the population, so nothing of accumulation size is hiding in the tail.
• One observation, no trend. The figures describe 8 September 2026. Movement between operators is not claimed here.
• A different date from our DMARC census. That census (1 October 2026) measured the same population definition later, so its corporate baselines differ slightly from the ones above.

The Datazag Observatory tracks the mail layer daily: domains that can take mail, the share that run mail on their own domain, the largest uncataloged mail host, and DMARC enforcement. Its figures use their own measurement window.