Four in five Dutch heavy-industry operators run their mail on Microsoft 365. Lindstead checked the public DNS records of all 145 manufacturers in the Dutch Emissions Authority's list of EU ETS installations, published on 25 September 2026.1 113 of the 144 whose domain receives mail show strong evidence of Microsoft 365. Together they emit 81.4 percent of the 35.0 megatonnes of CO2 that these manufacturers reported for 2025.
Summary
- Four in five industrial operators run their mail on Microsoft 365. 113 of 144 show strong evidence, 135 any signal. 20 of the 25 largest emitters are among them, from Tata Steel IJmuiden to Dow Benelux.
- More than half manage devices through Microsoft's cloud. 78 of 144 publish Entra or Intune records, the layer of laptops and phones around the plants. Dutch and foreign groups score the same.
- One in five verified a domain with a US AI vendor; none with Mistral. 29 of 145 carry an Anthropic, OpenAI or Cursor record. Not one has a record for the French model maker Mistral.
How many manufacturers run their mail on Microsoft?
Lindstead counted strong evidence when an operator's mail is delivered to Microsoft, or signed in a Microsoft 365 tenant.2 113 of the 144 operators with a mail-receiving domain meet that test (78.5 percent). With weaker signals it is 135, and 141 show some Microsoft tenant signal. For 142 of 144, a US-controlled company sits somewhere in the mail chain, often a filter such as Proofpoint or Mimecast in front of the mailbox.
Building materials, paper and metals lead
Chemicals and refining score lower, often because a mail filter hides the mailbox behind it.
Nine in ten Dutch building-materials and paper manufacturers in the EU ETS run their mail on Microsoft 365.
Manufacturing operators with strong evidence of Microsoft 365 mail, by sector (number with mail), %
1 Strong evidence: mail delivered to Microsoft, or DKIM signed in a Microsoft 365 tenant. Other manufacturing (4 of 4) not shown. A third-party filter in front of the mailbox can hide Microsoft, so these shares are floors.
Source: NEa EU ETS 2025 list and public DNS, 4 October 2026; Lindstead analysis
View data table
| Category | Value | Group |
|---|---|---|
| Metals (7) | 100.0% | 1 |
| Building materials (44) | 93.2% | 1 |
| Paper and board (13) | 92.3% | 1 |
| All manufacturers (144) | 78.5% | 2 |
| Food and drink (31) | 67.7% | 1 |
| Chemicals (39) | 64.1% | 1 |
| Refining (6) | 50.0% | 1 |
Group 1: Sector. Group 2: All manufacturers. Unit: %.
The lower shares in chemicals and refining are partly a measurement effect. 37 of the 144 operators put a third-party filter in front of their mail, most often Proofpoint (20), Mimecast (9) and Trend Micro (3). Counting each mail domain once, because group companies share domains, the Microsoft share is 98 of 123 (79.7 percent).
What do the largest emitters use?
Weighted by emissions, the picture is sharper than by count. 20 of the 25 largest emitters show strong evidence of Microsoft 365. The ten largest together account for more than three quarters of manufacturing ETS emissions.
The ten largest manufacturing emitters in the Dutch EU ETS list, 2025
| Operator | Mt CO2 | Group head office | Microsoft 365 mail | Device records |
|---|---|---|---|---|
| Tata Steel IJmuiden | 5.69 | India | ||
| Shell Nederland Raffinaderij | 4.20 | United Kingdom | ||
| Yara Sluiskil | 3.14 | Norway | ||
| Dow Benelux | 3.01 | United States | ||
| Chemelot Site Permit | 2.83 | Netherlands | ||
| Esso Nederland | 2.54 | United States | ||
| Shell Nederland Chemie | 2.19 | United Kingdom | ||
| BP Raffinaderij Rotterdam | 2.07 | United Kingdom | ||
| Zeeland Refinery | 1.42 | France | ||
| Air Liquide Industrie | 0.99 | France |
Microsoft signal presentNot shown, other platform or hidden behind a filter
Source: NEa EU ETS 2025 list, emissions including biomass; public DNS, 4 October 2026. Device records: Microsoft Entra device registration or Intune enrolment. Esso puts a Proofpoint filter first and still publishes device records; Air Liquide runs its mail on Google Workspace; Zeeland Refinery routes mail through Cloudflare.
Do manufacturers manage their devices through Microsoft?
78 of the 144 operators (54.2 percent) publish DNS records for Microsoft Entra device registration or Intune enrolment.3 These records let laptops and phones sign in and receive policies from Microsoft's cloud. Dutch groups (53.6 percent) and foreign groups (54.5 percent) score the same.
In April 2026 Bert Hubert's report for Energy Innovation NL asked whether staff in energy-intensive industry could still log in if Entra ID failed, and found that the most critical plant systems run locally.4 This count shows how widespread the Microsoft identity layer is. It does not show that plant equipment is managed from the cloud.
Are Dutch-owned manufacturers less dependent?
No. 89 of the 145 operators belong to groups with a head office abroad, and they emit 87.1 percent of manufacturing ETS emissions. Dutch-owned operators, such as Chemelot, FrieslandCampina, Cosun, Avebe and NXP, run their mail on Microsoft as often as foreign ones.
Strong evidence of Microsoft 365 mail by country of the group head office
| Group head office | Microsoft 365 mail | Share of emissions |
|---|---|---|
| Dutch head office (56) | 46 of 56 (82.1%) | 12.9% |
| Foreign head office (88) | 67 of 88 (76.1%) | 87.1% |
| of which US head office (33) | 22 of 33 (66.7%) | 23.2% |
Source: NEa EU ETS 2025 list; group head office from company sources, as of October 2026; public DNS, 4 October 2026. US groups more often put Proofpoint in front of their mailboxes, which lowers their measured share.
Ownership keeps moving. Examples since 2023 include Viterra to Bunge, JDE Peet's to Keurig Dr Pepper and FNsteel to Saarstahl. Subsidiaries use their parent's mail domain, so the group's IT choice decides the result.
Which manufacturers verified AI accounts?
29 of the 145 operators (20.0 percent) carry a domain verification record for an AI vendor: Anthropic 24, OpenAI 8 and Cursor 2.5 Weighted by emissions it is 28.7 percent. Foreign groups do so more often (22 of 89) than Dutch groups (7 of 56). Not one operator has a record for Mistral.
Dutch manufacturers use AI more than most in Europe: 28.6 percent of manufacturing firms with ten or more staff did so in 2025, against 17.3 percent in the EU.6 The records suggest that this AI comes from US vendors. A record shows a domain claim, not usage, and Copilot or Azure OpenAI leave no record at all.
What do these records show, and what not?
The records show where mail, user accounts and office devices run. They do not show where process control, plant data or production planning run. Mail still carries orders, drawings, safety reports and sign-in links. The US CLOUD Act lets US authorities order a provider under US jurisdiction to hand over data in its possession, custody or control, wherever it is stored.7 Chemicals and parts of manufacturing fall under the Cyberbeveiligingswet, which requires firms to manage supply-chain risk.8
37 of the 144 operators publish no enforcing policy against spoofed mail. Lindstead does not name them.
How was this measured, and what are the limits?
Population. The Dutch Emissions Authority's list of EU ETS stationary installations with 2025 emissions has 329 installations from 228 operators.1 Lindstead classified each operator by sector; 145 manufacturing operators with 190 installations and 35.0 megatonnes remain. Site utilities are excluded.
Domains and DNS. Each operator was matched to its website and mail domain, with a source per row: 61 confirmed on the operator's own page, 66 through a group site and 18 unconfirmed. 158 domains were queried through a public resolver. No company's systems were contacted.
Limitations
- One DNS snapshot; configuration, not contracts or volume.
- Third-party filters hide mailboxes, so the Microsoft counts are floors.
- Without the 18 unconfirmed matches, the Microsoft share is 103 of 127 (81.1 percent).
- For eight operators the result depends on whether the mail or the website domain is used, including Tata Steel and Yara.
- Head-office country and sector are desk work with sources. The population is process industry; high-tech makers such as ASML are not in the ETS list.
Earlier work: Bert Hubert described the dependency of energy-intensive industry on US clouds from interviews, without counts.4,9 This analysis adds a count for every ETS manufacturer, emission weighting, device-management records and AI records.
Download the data
Download the data (CSV): one row per operator whose domain was confirmed, 127 rows. Each row has the KvK number, sector, installations, 2025 emissions, group and head office, domains, first mail server, Microsoft and Google signals, device-management and AI records, and sources. DMARC results are left out on purpose.
Cite: Lindstead (2026), Dutch heavy industry runs its mail on Microsoft, NEa EU ETS list and public DNS of 4 October 2026. CC BY 4.0 applies to Lindstead's analysis. Research questions and corrections.
What should manufacturers do with these findings?
Lindstead recommends four checks:
- Test what happens to mail, sign-in and shift handover if the Microsoft tenant is unavailable for a day.
- Keep plant networks and process control independent of cloud identity, and document that in the Cyberbeveiligingswet risk assessment.
- Check which AI vendors staff have verified the domain with, and what plant data reaches them.
- Ask the group IT function which data stays in the EU, and under which jurisdiction.
How can a manufacturer reduce the dependency?
Lindstead is an independent advisory firm as well as a research firm, and takes no fees or commissions from cloud or software vendors. It helps manufacturers decide which systems to move to European providers and guides the move: first an assessment of each system's provider, jurisdiction and criticality, then a choice of European options, then a staged migration. AI workloads on plant and product data are often the best place to start, on European or the company's own infrastructure. For subsidiaries of foreign groups the advice focuses on what the Dutch site can decide itself.
Organisations that want a first answer can start with the AI Sovereignty Scan: readiness, regulation and hosting in 10 working days, at a fixed price of €6,500 excluding VAT. The industrial and manufacturing page covers the rules that apply.
Frequently asked questions
-
113 of the 144 manufacturing operators in the Dutch EU ETS list whose domain receives mail (78.5 percent) show strong evidence of Microsoft 365 mail in public DNS on 4 October 2026. Together they account for 81.4 percent of manufacturing ETS emissions in 2025. With weaker signals included it is 135 of 144.
-
This study measures mail and user identity, not process control. Earlier interviews by Bert Hubert for Energy Innovation NL found that the most critical plant systems run locally. More than half of the operators publish Microsoft device-management records, which shows that laptops and phones are managed through Microsoft's cloud, not plant equipment.
-
29 of 145 operators carry a domain verification record for an AI vendor: Anthropic 24, OpenAI 8, Cursor 2. None has a record for the French model maker Mistral. A record shows that someone proved control of the domain, not how much the service is used.
-
Yes. The CSV on this page has one row per operator whose domain was confirmed, with emissions, group, mail platform, device-management and AI records and sources. Lindstead's analysis is published under CC BY 4.0. Cite Lindstead (2026) with a link to this page.
Sources
- Nederlandse Emissieautoriteit, Emissiecijfers EU ETS stationair 2025 incl. biomassa, 25 September 2026. www.emissieautoriteit.nl/documenten/2026/09/25/emissiecijfers-eu-ets-stationiar-2025-incl-biomassa
- Microsoft, Set up DKIM to sign mail from your cloud domain. learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure
- Microsoft, External DNS records for Microsoft 365 (Entra device registration and Intune enrolment). learn.microsoft.com/en-us/microsoft-365/enterprise/external-domain-name-system-records
- Bert Hubert, Digitale autonomie binnen de energie-intensieve industrie, Energy Innovation NL for RVO, 9 April 2026. berthub.eu/articles/KSD_TopsectorEnergie_Rapport_DigitaleAutonomie_vDEF_print.pdf
- Anthropic, Set up single sign-on (domain verification record). support.claude.com/en/articles/13132885-set-up-single-sign-on-sso
- Eurostat, isoc_eb_ain2, enterprises using AI technologies by NACE, updated 15 June 2026. ec.europa.eu/eurostat/databrowser/view/isoc_eb_ain2/default/table
- 18 U.S.C. 2713, Required preservation and disclosure of communications and records (CLOUD Act). www.law.cornell.edu/uscode/text/18/2713
- NCSC, Cyberbeveiligingswet (NIS2). www.ncsc.nl/cyberbeveiligingswet-nis2
- Computable, Energie-intensieve industrie gevaarlijk afhankelijk van Amerikaanse clouds, 10 April 2026. www.computable.nl/2026/04/10/energie%E2%80%91intensieve-industrie-gevaarlijk-afhankelijk-van-amerikaanse-clouds/
Method: all figures from Lindstead's analysis of the NEa EU ETS 2025 list and public DNS records of 4 October 2026; context sources opened on the same date. This page is general information, not legal advice. Corrections: contact@lindstead.com. Research policy.