German email sovereignty

In the current debate regarding EU’s independence of US software providers, I asked myself: how far is Germany?

Germany is not only my country of birth. It also has the largest GDP in Europe (3rd largest in the world), and the largest number of citizens in the EU. That makes it an interesting country to investigate.

So how far are we really to full email sovereignty? I can confidently say that we are 93% there. A much higher number than I had anticipated!

The Data

As a source, I used the repository german-gov-domains. Even though this dataset is neither official nor complete, it is the most accurate representation of public domains that I’ve found.

The dataset uses the term “City” for the category of data that I analyzed. I am not sure which definition they followed, and I am not an expert for this type of categorization.

Usually, those domains are linked to email addresses. If you have the city mycity.de, they might accept emails at info@mycity.de. In that case they have an MX DNS record similar to MX 10 email.mycity.de. That gives us the chance to observe their underlying email infrastructure.

If a city hosts their emails with Microsoft Outlook, their MX record looks usually like mail.protection.outlook.com.

We can query the MX records for all cities and do some simple pattern matching for the largest US providers. There’s no guarantee for false negatives, but we can exclude false positives. That means the actual numbers for non-sovereign city halls can be higher, but not smaller.

US email providers

The dataset consists of 8055 cities that resolve to at least one MX. 560 of those cities resolve to email providers of non-EU countries, including Microsoft, Barracuda, Mimecast and Google Workspace. That is about 7%.

Microsoft        ╢████████████████████████████████████████████████████████████████████████████████████████████████████ 527
Barracuda        ╢██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 11
Mimecast         ╢██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 9
Google Workspace ╢█░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 6

Geographic differences

Bavaria (Free State)          ╢████████████████████████████████████████████████████████████████████████████████████████████████████ 312
Rhineland-Palatinate          ╢█████████████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 53
Hesse                         ╢██████████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 43
Lower Saxony                  ╢█████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 28
Baden-Württemberg             ╢████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 26
Schleswig-Holstein            ╢███████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 22
Thuringia (Free State)        ╢██████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 19
Mecklenburg-Western Pomerania ╢█████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 17
Saxony (Free State)           ╢█████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 16
Saxony-Anhalt                 ╢████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 13
Brandenburg                   ╢████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 11
Berlin                        ╢░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 0
Bremen (Hanseatic City)       ╢░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 0
Hamburg (Hanseatic City)      ╢░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 0
North Rhine-Westphalia        ╢░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 0
Saarland                      ╢░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 0

Bavaria stands out by far. 299 of the 312 city’s MX point to Microsoft. Bavaria contributes to more than half of the 560 non-sovereign email city halls. Microsoft’s Bavaria office in Munich used to be its Europe Headquarters.

You can check which cities are affected in the CSV aggregation I created under non_eu_cities.csv.

The Parliament

Of the 5 parties that are part of the parliament, CDU/CSU, SPD, Bündnis 90/Die Grünen and Die Linke all host email on the same infrastructure as the parliament itself (dbtg.de). Only the AfD hosts email with Microsoft Outlook.

Email is not all

When it comes to digital sovereignty, email is not all. We should also ask which operating systems are purchased, which office tools are used and on what infrastructure these applications run. Hosting email on one of the three US hyperscalers Amazon AWS, Microsoft Azure or Google Cloud is not sovereign. The above analysis does not include research about this.

For your own emails

If you want to gain sovereignty for your own emails, then p25.dev is for you.

I created this purely EU-hosted service to solve deliverability and monitoring for you. Self-hosting emails really never was easier than it is now.