How much public code breaks in December 2026

At least 24,960 public files on GitHub still contain a Microsoft 365 SMTP hostname. Every one of them is a place where somebody wrote down a setting that stops working when Basic authentication is switched off by default at the end of December 2026.

Measured 2026-08-16. The measurement runs every Monday, and the series below has 1 sample so far: a single number says the problem is large, a series says whether anyone is fixing it.

Current count

Hostname	Public files	Change since first measurement
`smtp.office365.com`	24,960	no meaningful change
`smtp-mail.outlook.com`	22,080	no meaningful change

The two are not added together: a single file can contain both hostnames, so a total would double-count.

What this number is

Public files, indexed by GitHub code search, containing a Microsoft 365 SMTP hostname.

What it is not

It is not a count of systems that will break. The same file might be a live deployment, a configuration template, a tutorial, or a fork of one of those. Some of those repositories are abandoned. Some of the hostnames sit in commented-out lines.

This distinction is not modesty. A figure that claims more than it can support is a figure the first informed reader throws out, and then the number stops being useful to anybody. What can be defended is this: each of these files is a place where a working SMTP setting was written down, and that setting is on a clock.

It is also a floor rather than a ceiling. It sees only public repositories, only default branches, and only what GitHub has indexed. Private repositories, internal configuration management, and the printer control panel in the corner of the office — which is where most of the real exposure lives — are all invisible to it.

Method

One authenticated GitHub code search per query, weekly, recording the reported total:

smtp.office365.com — "smtp.office365.com" NOT example
The commercial Microsoft 365 SMTP endpoint. NOT example is doing two jobs: the bare phrase returns so many matches that GitHub’s search API times out counting them, and excluding ‘example’ drops a large share of tutorials and placeholder templates. The remainder skews towards real configuration.
smtp-mail.outlook.com — "smtp-mail.outlook.com"
The consumer Outlook.com endpoint, widely used by small deployments, hobby projects and devices set up with a personal account.

GitHub’s totals are approximate and move slightly between identical queries, so small week-to-week changes mean nothing. A query that times out is recorded as null, never as zero — a failed measurement rendered as a drop would look like progress that never happened.

The raw data is data/blast-radius.json, and every measurement is a commit, so the history can be checked rather than taken on trust.

The series

Date	`smtp.office365.com`	`smtp-mail.outlook.com`
2026-08-16	24,960	22,080

Reusing this

The figure and the data are free to cite, quote and republish under the repository’s MIT licence — a link back is appreciated but not required. If you are writing about the December 2026 deadline and need a defensible number, this is one, along with everything above about its limits.

If one of these files is yours

What the error will look like when it starts failing
Whether your hardware has an OAuth path, with a link to every vendor statement
Every migration option, including the ones that are not this project
npx zerosmtp-check — no install; checks in two seconds whether your network even lets SMTP out, before you assume it is the credentials. ./check-connection.sh and check-connection.ps1 in the repository do the same without Node.

Updated 22 Aug 2026