A map showing which provider handles official email for municipalities across Europe — based on public DNS records. US-based providers (Microsoft, Google, AWS) are subject to the US CLOUD Act, which allows US authorities to request stored data regardless of where it is hosted. This conflicts with GDPR and the Schrems II ruling.
For each municipality domain, DNS records (MX, SPF, CNAME, DKIM, autodiscover) are queried and classified in priority order: MX hostname or CNAME matching a known provider; gateway look-through via SPF, autodiscover, and DKIM when MX points to a security gateway (FortiMail, Barracuda, Hornetsecurity, etc.) — SPF is only trusted when exactly one backend provider is found; DKIM check for unrecognized MX hosts to detect hidden backends (e.g., self-hosted MX with Microsoft 365 DKIM); local provider by matching MX server ASN to known European ISPs and municipal IT cooperatives; or self-hosted if no known provider or ISP is detected. DKIM is the most reliable signal — a CNAME proving a provider signs mail for the domain is definitive proof of mail hosting.