Mail service associations

Visible inbound mail-routing and first-order SPF service associations across the fixed .auDO panel.

Fixed observation panelLatest run 11 Sep 202630/90-day windows

Latest available data: 11 Sep 2026

Current observation

Visible mail service associations

This view uses two public signals: MX routing for inbound mail and first-order SPF include: / redirect= references for sending services.

Observed 2026-09-11 across the 100-domain fixed panel · Provider Catalogue 1.5.0

Inbound mail routing

Documented providers linked from visible MX routing targets.

85of 94 target-bearing domains had at least one documented association.

Documented providers seen across 5+ target-bearing domains

  • Google11 of 94 target-bearing domains
  • Microsoft41 of 94 target-bearing domains
  • Mimecast11 of 94 target-bearing domains
  • Proofpoint18 of 94 target-bearing domains

Provider counts can overlap because one domain may show several associations. They are not market share.

Evidence and coverage
98usable evidence
94target-bearing domains
85domains with a documented association
11domains with unresolved targets
  • 2 panel domains had insufficient evidence for this role.
  • 4 usable domains had no first-order target for this role.
  • 163 of 198 visible targets matched documented Provider Catalogue associations; 35 remained unresolved.
  • 6 documented providers were visible; 0 target-bearing domains showed more than one.

SPF service references

Documented providers linked from first-order SPF include and redirect targets.

65of 83 target-bearing domains had at least one documented association.

Documented providers seen across 5+ target-bearing domains

  • Amazon Web Services13 of 83 target-bearing domains
  • Campaign Monitor6 of 83 target-bearing domains
  • Google8 of 83 target-bearing domains
  • Mailchimp11 of 83 target-bearing domains
  • Mailgun6 of 83 target-bearing domains
  • Microsoft44 of 83 target-bearing domains
  • Mimecast8 of 83 target-bearing domains
  • Salesforce18 of 83 target-bearing domains
  • SAP5 of 83 target-bearing domains
  • Twilio SendGrid5 of 83 target-bearing domains

Provider counts can overlap because one domain may show several associations. They are not market share.

Evidence and coverage
98usable evidence
83target-bearing domains
65domains with a documented association
56domains with unresolved targets
  • 2 panel domains had insufficient evidence for this role.
  • 15 usable domains had no first-order target for this role.
  • 160 of 275 visible targets matched documented Provider Catalogue associations; 115 remained unresolved.
  • 29 documented providers were visible; 43 target-bearing domains showed more than one.

MX shows inbound routing; SPF references show sending-service links. Neither proves a supplier relationship or complete mail architecture.

The 30/90-day section below is existing State history. It does not track Mail Service Association change.

Inbound routing detail

MX routing context

These MX-based metrics are retained for continuity. The association view above separately presents inbound MX and first-order SPF service-reference evidence.

Current observation

Email providers or gateways were inferred for 87 of 100 panel domains, across 7 distinct inferred providers or gateways.

Observed 11 Sep 2026. Public MX was observed for 94 of 100 panel domains.

94Public MX observed
6No public MX observed
0Insufficient MX evidence
87Provider visible
13Provider unavailable or unclassified
7Distinct inferred providers or gateways
100Active Domains

Email Providers

  • Microsoft4141%
  • Proofpoint1818%
  • Google1111%
  • Mimecast1111%
  • Cisco33%
  • [unavailable]22%
  • Atmail11%

MX Visibility

  • Public MX observed9494%
  • No public MX observed66%
  • Insufficient evidence00%

Recent inbound-routing movement

These windows show the existing MX/provider event history. They do not track SPF service-reference or Mail Service Association change.

30-day window

13 Aug 2026 to 11 Sep 2026

3 material trust-posture observations and 3 supporting infrastructure observations were visible across the fixed panel during the selected 30-day window.

3Material
3Supporting
0Routine churn
3Affected domains
0Repeated domains

Continuous per-domain coverage cannot be established from the public manifest artefacts alone; counts use available generated event records.

Retained event types

  • Email Provider Changed3email_provider_changed
  • MX Changed3mx_changed

90-day window

14 Jun 2026 to 11 Sep 2026

53 material trust-posture observations and 29 supporting infrastructure observations were visible across the fixed panel during the selected 90-day window.

53Material
29Supporting
0Routine churn
19Affected domains
14Repeated domains

Continuous per-domain coverage cannot be established from the public manifest artefacts alone; counts use available generated event records.

Retained event types

  • MX Changed53mx_changed
  • Email Provider Changed29email_provider_changed

What this means

Mail-service associations are derived from visible infrastructure evidence. MX associations describe inbound routing; SPF associations describe literal first-order sending-service references. Neither establishes a complete mail architecture, primary provider, supplier or contractual relationship, service quality or security maturity. Existing State movement remains MX/provider movement and does not imply SPF association movement.

Evidence

30-day evidence

90-day evidence

Cohort views

Eligible cohorts show Mail posture and service associations. Small cohorts and sensitive cells remain suppressed; cohorts are descriptive, not rankings.

Australian government domains

14 domains observed

Public MX observed
13
No public MX observed
1
Insufficient MX evidence
0
30d events
0
30d affected
0
30d repeated
0
90d events
6
90d affected
2
90d repeated
2
View cohort

Australian not-for-profit domains

16 domains observed

Public MX observed
15
No public MX observed
1
Insufficient MX evidence
0
30d events
2
30d affected
1
30d repeated
0
90d events
8
90d affected
3
90d repeated
1
View cohort

Australian higher education domains

10 domains observed

Public MX observed
10
No public MX observed
0
Insufficient MX evidence
0
30d events
2
30d affected
1
30d repeated
0
90d events
14
90d affected
2
90d repeated
1
View cohort

Australian media domains

8 domains observed

Public MX observed
8
No public MX observed
0
Insufficient MX evidence
0
30d events
0
30d affected
0
30d repeated
0
90d events
6
90d affected
2
90d repeated
2
View cohort

Retail and marketplace domains

14 domains observed

Public MX observed
14
No public MX observed
0
Insufficient MX evidence
0
30d events
2
30d affected
1
30d repeated
0
90d events
23
90d affected
4
90d repeated
3
View cohort

Financial services domains

8 domains observed

Public MX observed
7
No public MX observed
1
Insufficient MX evidence
0
30d events
0
30d affected
0
30d repeated
0
90d events
0
90d affected
0
90d repeated
0
View cohort

Public-interest domains

21 domains observed

Public MX observed
20
No public MX observed
1
Insufficient MX evidence
0
30d events
0
30d affected
0
30d repeated
0
90d events
16
90d affected
5
90d repeated
5
View cohort

Australian software platforms

5 domains observed

Public MX observed
4
No public MX observed
1
Insufficient MX evidence
0
30d events
0
30d affected
0
30d repeated
0
90d events
6
90d affected
1
90d repeated
1
View cohort

About this view

Which mail-service associations are visible through public MX routing and first-order SPF references, and where has inbound routing changed?

Show current documented mail-service associations visible through inbound MX routing and first-order SPF references, while retaining bounded inbound MX/provider movement from the existing State history.

Published limitations

  • Derived from public .auDO observations generated from the canonical observatory dataset.
  • Counts describe the observed .auDO panel, not the whole .au namespace.
  • Missing optional fields are counted as missing rather than inferred.
  • Email provider inference is based on visible public mail routing and related records.
  • Provider choice is not a quality judgement.
  • DMARC, SPF and MX signals are public posture signals, not proof of email security maturity or compliance.

Data quality and availability

  • Required public event scope: observatory.
Email ProviderMX RecordsDMARCSPFWhy DMARC MattersState of .auReportsMethodology