How much public code breaks in December 2026

At least 25,728 public files on GitHub still contain a Microsoft 365 SMTP hostname. Every one of them is a place where somebody wrote down a setting that stops working when Basic authentication is switched off by default at the end of December 2026.

Measured 2026-08-24. The measurement runs every Monday, and the series below has 2 samples so far: a single number says the problem is large, a series says whether anyone is fixing it.

Current count

Hostname	Public files	Change since first measurement
smtp.office365.com	25,728	+3.1%
smtp-mail.outlook.com	22,208	+0.6%

The two are not added together: a single file can contain both hostnames, so a total would double-count.

What this number is

Public files, indexed by GitHub code search, containing a Microsoft 365 SMTP hostname.

What it is not

It is not a count of systems that will break. The same file might be a live deployment, a configuration template, a tutorial, or a fork of one of those. Some of those repositories are abandoned. Some of the hostnames sit in commented-out lines.

This distinction is not modesty. A figure that claims more than it can support is a figure the first informed reader throws out, and then the number stops being useful to anybody. What can be defended is this: each of these files is a place where a working SMTP setting was written down, and that setting is on a clock.

It is also a floor rather than a ceiling. It sees only public repositories, only default branches, and only what GitHub has indexed. Private repositories, internal configuration management, and the printer control panel in the corner of the office — which is where most of the real exposure lives — are all invisible to it.

Method

One authenticated GitHub code search per query, weekly, recording the reported total:

• smtp.office365.com — "smtp.office365.com" NOT example
  The commercial Microsoft 365 SMTP endpoint. NOT example is doing two jobs: the bare phrase returns so many matches that GitHub's search API times out counting them, and excluding 'example' drops a large share of tutorials and placeholder templates. The remainder skews towards real configuration.

• smtp-mail.outlook.com — "smtp-mail.outlook.com"
  The consumer Outlook.com endpoint, widely used by small deployments, hobby projects and devices set up with a personal account.

GitHub's totals are approximate and move slightly between identical queries, so small week-to-week changes mean nothing. A query that times out is recorded as null, never as zero — a failed measurement rendered as a drop would look like progress that never happened.

The raw data is data/blast-radius.json, and every measurement is a commit, so the history can be checked rather than taken on trust.

The series

Date	smtp.office365.com	smtp-mail.outlook.com
2026-08-24	25,728	22,208
2026-08-16	24,960	22,080

Reusing this

The figure and the data are free to cite, quote and republish under the repository's MIT licence — a link back is appreciated but not required. If you are writing about the December 2026 deadline and need a defensible number, this is one, along with everything above about its limits.

If one of these files is yours

• What the error will look like when it starts failing
• Whether your hardware has an OAuth path, with a link to every vendor statement
• Every migration option, including the ones that are not this project
• npx zerosmtp-check — no install; checks in two seconds whether your network even lets SMTP out, before you assume it is the credentials. ./check-connection.sh and check-connection.ps1 in the repository do the same without Node.