This page is about measuring what mail servers and mail clients have actually deployed — SPF, DKIM, DMARC, ARC, DANE, MTA-STS, STARTTLS, S/MIME and OpenPGP — and about the delivery path a message really takes. It is a methods page: which instrument answers which question, what the denominator has to be, what the field has already built, and which of its methods are current in 2026.

It is not an explanation of the protocols. RFC 7208 (SPF), RFC 6376 (DKIM), RFC 9989 (DMARC), RFC 7672 (DANE for SMTP) and RFC 8461 (MTA-STS) define them, and a fresh student can read those faster than any wiki paraphrase. What the RFCs do not tell you is that “60.9% of domains have SPF” and “56.5% of domains have SPF” are both true, in the same year, of the same protocol — because they are different populations, and the difference is bigger than most of the effects people publish.

The evidence base is 31 papers from the publication corpus — CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, 5,859 extracted papers. Those seven venues are where this subfield publishes, but they are not all of it: EuroS&P, ACSAC, RAID, AsiaCCS, TMA and the CCR/ANRW line are absent, so every count below is a count over those seven. How the 31 were selected is in Use in Publications and the full query log is on email_authentication.

Four papers, and you have the shape of the field:

• [1Durumeric, Zakir; Adrian, David; Mirian, Ariana; Kasten, James; Bursztein, Elie; Lidzborski, Nicolas; Thomas, Kurt; Eranti, Vijay; Bailey, Michael D.; Halderman, J. Alex (2015): "Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — Neither Snow Nor Rain Nor MITM, IMC 2015. The founding measurement: Alexa Top Million MX scan, an IPv4-wide SMTP scan, and a year of Gmail's own SMTP handshake logs, in one paper. Read it for the three-instrument design, and for the STARTTLS-stripping result that no purely passive study could have found.
• [2Hu, Hang; Wang, Gang (2018): "End-to-End Measurements of Email Spoofing Attacks", in: Proceedings of the USENIX Security Symposium. (Link)] — End-to-End Measurements of Email Spoofing Attacks, USENIX Security 2018. The paper that moved the question from “who publishes a record” to “what arrives in the inbox”. Registers accounts at 35 providers and sends forged mail to itself. Every account-based delivery paper since is a variant of this.
• [3Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)] — SPF Beyond the Standard, USENIX Security 2024. Seventeen months of weekly zone-file scans over 176 million domains, plus an inbound probe that asks whether receiving MTAs validate SPF at all, plus an operator survey. The best current example of the three-sided design this topic now expects.
• [4Wang, Chuhan; Kuranaga, Yasuhiro; Wang, Yihang; Zhang, Mingming; Zheng, Linkai; Li, Xiang; Chen, Jianjun; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng (2024): "BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] — BreakSPF, NDSS 2024. The 2024–2026 turn: the interesting object is no longer the record but the shared infrastructure the record authorises. 23,916 Tranco-top-million domains are spoofable because their SPF includes a cloud, CDN or CI/CD range an attacker can rent.

If your object is end-to-end encryption rather than transport, start at [5Poddebniak, Damian; Dresen, Christian; Müller, Jens; Ising, Fabian; Schinzel, Sebastian; Friedberger, Simon; Somorovsky, Juraj; Schwenk, Jörg (2018): "Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels", in: Proceedings of the USENIX Security Symposium. (Link)] (Efail) and [6Öndarö, Gurur; Kaspereit, Jonas; Umezulike, Samson; Saatjohann, Christoph; Ising, Fabian; Schinzel, Sebastian (2025): "S/MINE: Collecting and Analyzing S/MIME Certificates at Scale", in: Proceedings of the USENIX Security Symposium. (Link)] (S/MINE: 41.7 million X.509 certificates crawled from public LDAP address books, of which 38 million are S/MIME-capable).

The 31 papers use twelve identifiable instruments. The median paper runs three, the mean is 2.74, and the range is one to five; four papers run only one instrument and one runs five. Pick before you write the scanner, because the instrument decides which of the four different questions you are answering.

The remaining six, thinner but not marginal: software testbed (7 papers — run Postfix, Exim, libspf2 in a lab and see which is wrong), code analysis (3), notification experiment (3 — tell the operators and rescan, see notifying_websites), passive DNS (2), user study (2), honey domain (1).

Two instruments are new. Neither the operator survey nor the software testbed appears at all before 2020 in this population; between them they are run by eight of the sixteen 2023–2026 papers and none of the six from 2015–2019. If you are designing a study now and your only instrument is a DNS scan, you are designing a 2015 paper.

This is the whole reason the page exists. Below are adoption figures for the same five mechanisms, from papers in the same corpus, each correct in its own paper and none comparable with any other.

Four traps are visible in that table, and all four have been published wrong somewhere:

1. “Domains” almost never means domains. Five of the twelve rows restrict to domains that have an MX record — and one of those five says it as “mail-enabled domains” instead, so you cannot even grep for the filter. That filter removes most registered names, and it is the right filter — a domain with no MX receives no mail — but a figure computed with it is not comparable to one computed without it. Say which you did, in the sentence that carries the number.
2. A top list is not a sample of the web, and the list changed. Alexa is the frame in 7 of the 31 papers; Tranco in 9; TLD zone files in 3. The last Alexa use in this population is 2023 and no paper from 2024 onwards uses it — Alexa's site shut down on 1 May 2022 and its APIs on 15 December 2022.¹⁾ A 2026 paper using an Alexa list is using a four-year-old snapshot of a dead ranking, and reviewers now say so. Use Tranco with a pinned list ID [12Le Pochat, Victor; Van Goethem, Tom; Tajalizadehkhoob, Samaneh; Korczy´nski, Maciej; Joosen, Wouter (2019): "Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation", in: Proceedings of the 26th Annual Network and Distributed System Security Symposium. (DOI)], or a zone file, and see website_selection.
3. “Top 1M” and “top 10M” and “all of a zone” give different answers to the same question, in the same year. SPF is 60.2% of the top million and 56.5% of twelve million in one 2023 paper; 41.7% of a top-ten-million list in another 2023 paper. The gradient is real — popular domains deploy more — so a percentage without its rank window says nothing.
4. DKIM has no denominator you can enumerate. SPF, DMARC and MTA-STS live at fixed DNS names; DKIM lives at <selector>._domainkey.<domain> and the selector is arbitrary. [7Wang, Chuhan; Shen, Kaiwen; Guo, Minglei; Zhao, Yuxuan; Zhang, Mingming; Chen, Jianjun; Liu, Baojun; Zheng, Xiaofeng; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng (2022): "A Large-scale and Longitudinal Measurement Study of DKIM Deployment", in: Proceedings of the USENIX Security Symposium. (Link)] scanned the Alexa top million with 40 selectors harvested from passive DNS and reports 28.1% as an explicit lower bound. Any DKIM deployment number is a lower bound; say what your selector list was and where it came from, or use passive DNS and say the archive's coverage is your denominator.

The single most consistent finding across eleven years of this literature, and the one a new study most often forgets to measure: the sender side and the receiver side are different populations, and the receiver side is far weaker.

That 6.8% is the number to remember. It is a 2024 measurement of whether receiving mail servers so much as look SPF up before accepting the message body — and it is the only figure in this whole population that measures inbound enforcement at internet scale rather than at 20–50 hand-picked providers. Deployment-rate papers count the left column of a two-column problem.

The corpus spans 2015–2026 for this topic. It is unusually well-distributed for a corpus-derived page — 21 of the 31 papers are 2022 or later, so “what the literature did” and “what is current” are closer here than on most pages. Still, date them.

• Zone-file scanning rather than a top list. First appears in this population in 2023 and is in three papers by 2025 ([15Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2023): "You've Got Report: Measurement and Security Implications of DMARC Reporting", in: Proceedings of the USENIX Security Symposium. (Link)], [3Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)], [11Ashiq, Md. Ishtiaq; Fiebig, Tobias; Chung, Taejoong (2025): "Unraveling the Complexities of MTA-STS Deployment and Management in Securing Email", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]). It converts “the top N domains” into “every second-level domain in .com/.net/.org/.se” — 176 million in [3Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)] — which removes the rank-window problem entirely. Access is through ICANN's Centralized Zone Data Service; Verisign now directs .com/.net requests there rather than running its own process.²⁾
• Measuring the receiver, not the sender. The inbound-validation probe of [3Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)] and the sender-side MTA-STS test of [11Ashiq, Md. Ishtiaq; Fiebig, Tobias; Chung, Taejoong (2025): "Unraveling the Complexities of MTA-STS Deployment and Management in Securing Email", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] are the current frontier, and both are under-used.
• Shared infrastructure as the unit of analysis. [4Wang, Chuhan; Kuranaga, Yasuhiro; Wang, Yihang; Zhang, Mingming; Zheng, Linkai; Li, Xiang; Chen, Jianjun; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng (2024): "BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (2024), [16Wang, Chuhan; Wang, Chenkai; Yang, Songyi; Liu, Sophia; Chen, Jianjun; Duan, Haixin; Wang, Gang (2025): "Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability", in: Proceedings of the USENIX Security Symposium. (Link)] (SMTP smuggling, 2025) and [17Li, Ruixuan; Lu, Chaoyi; Liu, Baojun; Lin, Yanzhong; Pan, Qingfeng; Shao, Jun (2026): "CoordMail: Exploiting SMTP Timeout and Command Interaction to Coordinate Email Middleware for Convergence Amplification Attack", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (2026) all ask what an attacker can do by renting a piece of infrastructure that thousands of domains have already authorised. This is the newest coherent line in the population and it is three papers old.
• Operator surveys alongside the scan. None before 2020; five by 2025, with 39, 74, 16, 95 and 117 respondents ([18Lee, Hyeonmin; Ashiq, Md. Ishtiaq; Müller, Moritz; Rijswijk-Deij, Roland van; Kwon, Taekyoung "Ted"; Chung, Taejoong (2022): "Under the Hood of DANE Mismanagement in SMTP", in: Proceedings of the USENIX Security Symposium. (Link)], [15Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2023): "You've Got Report: Measurement and Security Implications of DMARC Reporting", in: Proceedings of the USENIX Security Symposium. (Link)], [9Blechschmidt, Birk; Stock, Ben (2023): "Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)], [3Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)], [11Ashiq, Md. Ishtiaq; Fiebig, Tobias; Chung, Taejoong (2025): "Unraveling the Complexities of MTA-STS Deployment and Management in Securing Email", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]). Recruitment is from MailOP, NANOG, DENOG, NLNOG and MESSEU in every case where it is stated — a specific, self-selecting, unusually competent population. Report it as such; it is not a sample of operators.
• Notification-and-rescan as a built-in second phase. [19Bennett, Nathaniel; Sowards, Rebekah; Deccio, Casey T. (2022): "SPFail: Discovering, Measuring, and Remediating Vulnerabilities in Email Sender Validation", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], [10Czybik, Stefan; Horlboge, Micha; Rieck, Konrad (2023): "Lazy Gatekeepers: A Large-Scale Study on SPF Configuration in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] and [9Blechschmidt, Birk; Stock, Ben (2023): "Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)] all notify and remeasure. Only [9Blechschmidt, Birk; Stock, Ben (2023): "Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)] has a comparison arm: domains whose notification bounced remediated at 20.7% against 39.7% for domains that were reached (Fisher exact p = 7.8 × 10^-43). That arm is what makes the result more than a trend — but it is not a randomised control, and the authors say so themselves: “we cannot conclude a causal relation since the lack of deliverable emails may be a hidden variable which influences fix rates”. Undeliverable postmaster addresses are plausibly a proxy for an unattended domain. If you run a notification experiment, randomise.
• Client matrices. Still current — [20Tang, Ka Fun; Tu, Che Wei; Mak, Sui Ling Angela; Chau, Sze Yiu (2025): "A Multifaceted Study on the Use of TLS and Auto-detect in Email Ecosystems", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (49 clients, 2025) and [21Wen, Shushang; Zhang, Yiming; Shen, Yuxiang; Li, Bingyu; Duan, Haixin; Lin, Jingqiang (2025): "Automatic Insecurity: Exploring Email Auto-configuration in the Wild", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] (29 clients, 2025) are recent — but they are a vulnerability census, not a prevalence measurement, and should not be written as one.

• A single DNS snapshot over Alexa, reported as a deployment rate. This is the 2015–2018 design and it is what a naive 2026 study reproduces. It survives only as one panel of a larger study.
• The Adobe 2013 breach address list as a popularity proxy for mail providers. Used by [13Foster, Ian D.; Larson, Jon; Masich, Max; Snoeren, Alex C.; Savage, Stefan; Levchenko, Kirill (2015): "Security by Any Other Name: On the Effectiveness of Provider Based Email Security", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] and [2Hu, Hang; Wang, Gang (2018): "End-to-End Measurements of Email Spoofing Attacks", in: Proceedings of the USENIX Security Symposium. (Link)] to rank providers by user count, and genuinely clever in 2015. It is now a thirteen-year-old snapshot of one company's users; five of the 31 papers still lean on it.
• “X% of domains publish a record” as the headline. It was the finding in 2015. It is background in 2026.

• BIMI is measured by nobody in these seven venues. A full-text probe over all 5,859 papers finds BIMI named in exactly 5, all of them in this population's 31, and all five are related-work sentences (“BIMI is built on DMARC and has not …”). Read by hand on 2026-09-09: zero measure it. [15Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2023): "You've Got Report: Measurement and Security Implications of DMARC Reporting", in: Proceedings of the USENIX Security Symposium. (Link)] points outside the corpus, to Yajima et al.'s BIMI study, for a 19%-of-Tranco DMARC figure. SMTP REQUIRETLS (RFC 8689) is named in zero papers, corpus-wide. If you want a first measurement paper, those are two.
• TLS-RPT is named in 3 of the 31, and only one of them measures it. [15Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2023): "You've Got Report: Measurement and Security Implications of DMARC Reporting", in: Proceedings of the USENIX Security Symposium. (Link)] does three things with it: exploits it (a crafted TLS-RPT record is half of its 1,460× reflection attack), asks its surveyed operators whether they send reports, and measures provider support directly — its Table 4 finds 2 of 8 email hosting providers support TLS-RPT reporting, and “no open-source software” at all. What nobody has done is scan a domain population for _smtp._tls records, the way four papers here scan for SPF. Provider-granularity and population-granularity are different claims and this is a clean example of the difference.
• The corpus stops at the venues it stops at. Long-running national measurement programmes — SIDN Labs' .nl statistics, the Dutch government's internet.nl-based compliance survey — publish deployment series these seven venues do not, and are cited below rather than in the tables above, because they are not part of the population this page counts.

The corpus cannot know any of this: the newest paper in it went to press before most of it happened. Every item here was fetched on 2026-09-09, not recalled.

• DMARC is no longer RFC 7489. It was republished on the standards track in May 2026 as RFC 9989 (protocol), RFC 9990 (aggregate reporting) and RFC 9991 (failure reporting). RFC 9989 states “Obsoletes: 7489, 9091” and “Category: Standards Track” on its title page.³⁾ Every paper in this population cites the Informational RFC 7489. If you are writing now, cite 9989.
• The pct= tag is gone. RFC 9989 §A.6, “Removal of the 'pct' Tag”: “Operational experience showed that the 'pct' tag was usually not accurately applied … This version of the DMARC mechanism, therefore, introduces the 't' tag as shorthand for 'testing'”. The DMARC tag registry now marks pct historic. A 2026 parser that treats pct=0 as a valid partial-rollout signal is parsing a dead tag; a 2026 measurement that reports pct distributions is measuring a legacy artefact, which is a legitimate thing to do provided you say so. p=none is unchanged and is still where the RFC tells domain owners to start.
• ARC (RFC 8617) is still Experimental, and an IETF DMARC working-group document is moving it to Historic.⁴⁾ [22Wang, Chenkai; Wang, Gang (2022): "Revisiting Email Forwarding Security under the Authenticated Received Chain Protocol", in: Proceedings of the ACM Web Conference. (DOI)] is the only ARC measurement in this population.
• A DKIM revision is in progress. draft-ietf-dkim-dkim2-spec is an Active Internet-Draft in the rechartered IETF dkim working group, last revised 2026-08-28. The driver is DKIM replay — the weakness [23Chen, Jianjun; Paxson, Vern; Jiang, Jian (2020): "Composition Kills: A Case Study of Email Sender Authentication", in: Proceedings of the USENIX Security Symposium. (Link)] demonstrated in 2020 with the l= tag and message re-signing.
• BIMI is still not an RFC. draft-brand-indicators-for-message-identification is an Active Internet-Draft with no working-group ownership, last updated 2026-05-01. Anything describing BIMI as a standard is wrong.
• The three largest consumer mailbox providers now mandate authentication, on different terms. Google has required SPF, DKIM and DMARC of senders above 5,000 messages a day since 1 February 2024, and its page now adds that “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections.” Yahoo mirrors the same requirements and the same February 2024 date but never states a numeric volume threshold anywhere on its senders page. Microsoft's Outlook.com requirement took effect 5 May 2025 above 5,000 messages a day, and as of today Microsoft still describes outright rejection as pending a future date rather than in force.⁵⁾ This matters to your sampling: since 2024 the incentive to publish a DMARC record depends on how much mail a domain sends to Gmail, which is not a variable any of the 31 papers controls for. A post-2024 adoption series that does not separate bulk senders from everyone else is measuring a policy change, not a security trend.

Checked 2026-09-09. Version and date come from the project's own release feed, not from memory.

Rejected as citable sources of deployment statistics, after checking each: dmarcian, Valimail (acquired by DigiCert in September 2025), EasyDMARC, Red Sift OnDMARC, PowerDMARC, DuoCircle and dmarcreport.com. All are commercially alive; none publishes a deployment figure with a stated population and method. Valimail's “2026 State of DMARC Report” puts its methodology behind a lead-capture form. A vendor blog post with a percentage and no denominator is not a citation, and this literature is unusually well supplied with them.

Usable instead, with stated methods:

• SIDN Labs, stats.sidnlabs.nl/en/mail.html — a full census of .nl via OpenINTEL, updated roughly monthly. At the 2026-09-01 data point, 84.24% of .nl domains with MX publish DMARC, and 37.24% publish a TLSA record for mail. Sanity-check the DANE figure before citing it: it moved from 26.57% to 37.24% in a single month, which is either a real registrar-driven jump or a methodology change, and the page does not say which.
• Forum Standaardisatie, Meting Informatieveiligheidstandaarden overheid begin 2026 (12 May 2026) — a bulk internet.nl test over Dutch government domain registers (n = 12,116 / 3,038 depending on the standard): DKIM 66%, DMARC at quarantine or reject 86%, strict SPF 69%, STARTTLS 92%, DANE 56%.
• Both are national censuses of unusually well-governed populations. They are the ceiling, not the world.

This topic has a harder ethics profile than most web measurement, because half its instruments touch third-party production infrastructure and one of them delivers a forged message to a real mailbox. What the 31 papers report about themselves:

• 12 of 31 mention no ethics review at all; 6 explicitly discuss the question and state that no review was sought or required; only 5 report an approval. That is 38.7% silent against 64.2% corpus-wide (of the 4,965 papers carrying an ethics object) — so this population is better than the corpus, not worse, and 5 report an approval against 20.1% corpus-wide. n = 31, so read neither gap as a difference. Better than a low bar is still not good enough for an instrument that delivers forged mail to a live provider.
• 19 of 31 notified affected parties, 6 partially, 2 not, 3 do not say. Disclosure is the norm in this population — usefully so, since these are protocol and implementation flaws with named vendors.
• 20 of 31 report a public artifact and 18 give a code URL, including several long-lived project sites (dane-study.github.io, spf-measurement.github.io, mta-sts.netsecurelab.org, github.com/chenjj/espoofer). By the standards of this corpus that is good practice.

Four decisions you will have to make and defend:

1. Spoofed mail is delivered to a real inbox. Every account-based delivery paper sends messages that fail authentication into a live provider. Send only to accounts you control, register them yourself, and say how many messages you sent and over what period. [2Hu, Hang; Wang, Gang (2018): "End-to-End Measurements of Email Spoofing Attacks", in: Proceedings of the USENIX Security Symposium. (Link)] additionally ran a deceptive user study with 488 MTurk participants; if you do that, the bar is ethics, not a footnote.
2. Probing inbound validation means completing an SMTP conversation with a stranger's server. [3Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)] stops before DATA precisely so that no message is ever accepted, and says so. That design choice is the ethical argument; make it explicit.
3. Notification is a research intervention on 20,000 unwitting operators. [11Ashiq, Md. Ishtiaq; Fiebig, Tobias; Chung, Taejoong (2025): "Unraveling the Complexities of MTA-STS Deployment and Management in Securing Email", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] mailed 20,144 postmaster addresses and had over 5,000 bounce. See notifying_websites for what the response rates actually look like and how to phrase it.
4. Amplification and reflection research is live-fire. [17Li, Ruixuan; Lu, Chaoyi; Liu, Baojun; Lin, Yanzhong; Pan, Qingfeng; Shao, Jun (2026): "CoordMail: Exploiting SMTP Timeout and Command Interaction to Coordinate Email Middleware for Convergence Amplification Attack", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] coordinates real bounce servers to a 3,801× bandwidth concentration. If your target is a DoS primitive, the disclosure and rate-limiting plan is part of the method section, not an afterthought.

A reviewer who works in this area will look for these. Most rejected drafts are missing three or more.

• The frame, versioned. Which list, which day, which version. A Tranco list ID, a zone-file date, a passive-DNS window. “The Alexa top 1M” is not a frame in 2026.
• Whether you filtered to domains with an MX record, and how many that removed. State the numerator and both candidate denominators.
• The resolver and where it sat. Recursive or authoritative, your own or the provider's, and from what network. DNS answers to SPF include chains are geo- and resolver-dependent.
• For DKIM: the selector list and its provenance. And the words “lower bound”.
• For SPF: whether you recursively expanded include and redirect, whether you counted the 10-lookup limit, and what you did with PermError. [10Czybik, Stefan; Horlboge, Micha; Rieck, Konrad (2023): "Lazy Gatekeepers: A Large-Scale Study on SPF Configuration in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] found 34.7% of SPF-publishing domains authorise more than 100,000 IPv4 addresses and [4Wang, Chuhan; Kuranaga, Yasuhiro; Wang, Yihang; Zhang, Mingming; Zheng, Linkai; Li, Xiang; Chen, Jianjun; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng (2024): "BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] found 51.7% cover more than 65,536 — both figures exist only because the record was expanded, not just parsed.
• Sender-side or receiver-side. Say which one your number is about, in the sentence with the number.
• Snapshot or series, and the cadence. DANE and MTA-STS misconfiguration is largely a rollover problem — [18Lee, Hyeonmin; Ashiq, Md. Ishtiaq; Müller, Moritz; Rijswijk-Deij, Roland van; Kwon, Taekyoung "Ted"; Chung, Taejoong (2022): "Under the Hood of DANE Mismanagement in SMTP", in: Proceedings of the USENIX Security Symposium. (Link)] needed hourly snapshots to see that, of the 2,569 DANE SMTP servers whose certificates were ever valid, more than 87% in each management category botch at least one key rollover — and a single snapshot cannot see it at all.
• What you did to the servers you probed, and your opt-out. See ethics.
• The software versions in your own testbed. Postfix, Exim, libspf2, OpenDKIM: name them and pin them, because the interesting results in this literature are usually one implementation disagreeing with another.

The 31 papers are the INFRA verdict of scripts/msg_fold.mjs, the published hand map behind email_tracking (2026-09-02). That map screened a 354-paper candidate pool built from message-channel vocabulary and split it by what the paper measures: tracking inside a message, the address as an identifier, marketing mail, spam, SMS abuse, the mailbox as an instrument — and this page's slice, the machinery that carries the message. Each of the 31 carries its one-line reason in the map. The population is not re-derived here: this page's report script imports the map and throws if the INFRA slice is no longer 31 papers, so changing the map breaks the report rather than silently moving the denominator.

31 of 5,859 is not a rate. It is a hand-mapped topical slice, and the only honest denominator for it is the candidate pool it came out of.

Generated from the report script's own citekey map, oldest first. The one-line description is the reason recorded in msg_fold.mjs when the paper was admitted.

2025–2026 are provisional — CCS 2026 and IMC 2026 have not been held and two other 2026 venue-years are under-represented by construction (see corpus), so read the 2026 cell as a floor. 28 of 31 are 2018 or later; 21 are 2022 or later.

By venue: USENIX Security 16, IMC 7, NDSS 4, and one each from CCS, IEEE S&P, TheWebConf and PETS. This is a USENIX-and-IMC topic, more concentrated than almost anything else on this wiki, and that concentration is itself a caveat: three of the 31 share a first author and several share a lab.

Mechanism, hand-mapped from each paper's own results section. Multi-valued; denominator 31 papers.

Sampling frames, folded from population[].sourceList and paper-counted: hand-built list 13, Tranco 9, Alexa 7, the Adobe 2013 breach address list 5, operator logs 5, passive DNS or OpenINTEL 3, university lists 3, TLD zone files 3, Enron corpus 2, another top list (Majestic / Umbrella / DomCop) 2, IPv4 address space 1. 43 distinct strings did not fold and are printed in full on email_authentication rather than dropped.

• 29 of 31 report descriptive statistics only. Two run a hypothesis test ([2Hu, Hang; Wang, Gang (2018): "End-to-End Measurements of Email Spoofing Attacks", in: Proceedings of the USENIX Security Symposium. (Link)], [9Blechschmidt, Birk; Stock, Ben (2023): "Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)]), one a regression ([25Szurdi, Janos; Christin, Nicolas (2017): "Email Typosquatting", in: Proceedings of the ACM Internet Measurement Conference. (DOI)]). For a literature whose central claims are comparisons — notified against control, this provider against that one, this year against last — that is thin. If your result is a difference, test it; see hypothesis_testing.
• 19 of 31 coded something by hand and not one reports an inter-rater agreement metric. Zero of nineteen. Vulnerability labelling in a client matrix is a coding task, and “we manually analysed the identified behaviours” is not a method. See interrater_agreement.
• 12 of 31 mention no ethics review, against instruments that send forged mail and probe strangers' servers.
• Eight of the 31 recruited people; the five operator surveys carry n of 39, 74, 16, 95 and 117. The extraction records a recruitment channel for only three of the five — but that undercounts by one: [15Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2023): "You've Got Report: Measurement and Security Implications of DMARC Reporting", in: Proceedings of the USENIX Security Symposium. (Link)] names MailOP, NANOG and MESSEU in its own text and the extractor recorded not-stated. Four of five, and the fifth is [9Blechschmidt, Birk; Stock, Ben (2023): "Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)], whose 16 respondents are operators who replied to a notification email rather than a recruited sample at all.

These are near-misses the recall probe surfaced. Each carries a different verdict in msg_fold.mjs, and where I think the boundary is genuinely arguable, it says so.

A widened full-text probe over all 5,859 papers — admitting any paper with four or more mentions summed across SPF, DKIM, DMARC, DANE/TLSA, MTA-STS, BIMI and ARC, or four or more across STARTTLS and S/MIME, or fifteen SMTP mentions with at least two mechanism mentions — admits 77 papers and adds nothing to the population: the extra hits are DANE-for-HTTPS, DNSSEC registrar studies, ALPACA, DROWN and a DNS toolkit paper. The full list, read by hand, is on the provenance page.

Every count above is a count of papers, never of extraction tuples, with its denominator named in the same sentence or table cell. Free-text fields were folded before aggregating and the unmapped residue is published rather than dropped. The report script that produces every figure on this page is scripts/report_email_authentication.mjs; it hand-keys the mechanism map, the instrument map and all 49 published figures, and it fails if any of those maps stops covering all 31 papers.

Two limitations specific to this page:

• Quote verification hits the two-column problem. All 49 figures above were checked against paper.cols.txt; 53 quote fragments were needed to do it. Four figures carry a second fragment, and three of those four are genuine splices — a sentence interrupted by a table row, a figure caption or a column break, and unlocatable as one string in any of the three available renderings. The fourth second fragment is an independent corroborating quote, not a split sentence. At least one figure stated in the prose rather than in a table (the DANE rollover figure) sits on a spliced sentence too, so three is a floor for this page, not a total. Across the 31 papers' 206 extracted evidence quotes, 130 locate contiguously and 76 do not; a hand-read sample of the 76 found real sentences broken by page furniture, plus one case where the extractor's quote merges two adjacent sentences. Details and the sample on the provenance page.
• The mechanism and instrument maps are mine, not the extraction's. The schema has no field for “which deployed mail mechanism is this paper's object”, so both tables are hand maps over 31 papers, made by reading each results section. They are reproducible in the sense that they are written down in the script; they are not independent of my judgement.

The full query log, the folds, the residue, the quote spot-checks, the external sources that were rejected and the reviewer findings are on email_authentication. Corpus-level caveats — how the 5,859 were selected, why 2025–2026 are provisional — are on corpus.

• email_tracking — the other half of the message-channel literature: tracking pixels, the address as an identifier, marketing mail and spam. It scopes this page out and links here.
• phishing — mail as an attack vector, and the feeds that label it.
• tls_certificates — the web PKI, CT logs and the scanning instruments this page borrows.
• internet_scanning — ZMap, ZGrab and the ethics and rate limits of internet-wide probing.
• website_selection — Tranco, zone files, and why a top list is not a sample.
• longitudinal — snapshot cadence, which is what DANE and MTA-STS rollover measurement lives or dies by.
• notifying_websites — notification-and-rescan, and what response rates actually look like.
• ethics — active probing, disclosure, and the review question 12 of these 31 papers did not answer.
• email_authentication — the query log behind this page.

[1]

Durumeric, Zakir; Adrian, David; Mirian, Ariana; Kasten, James; Bursztein, Elie; Lidzborski, Nicolas; Thomas, Kurt; Eranti, Vijay; Bailey, Michael D.; Halderman, J. Alex (2015): "Neither Snow Nor Rain Nor MITM...: An Empirical Analysis of Email Delivery Security", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Hu, Hang; Wang, Gang (2018): "End-to-End Measurements of Email Spoofing Attacks", in: Proceedings of the USENIX Security Symposium. (Link)

[3]

Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2024): "SPF Beyond the Standard: Management and Operational Challenges in Practice and Practical Recommendations", in: Proceedings of the USENIX Security Symposium. (Link)

[4]

Wang, Chuhan; Kuranaga, Yasuhiro; Wang, Yihang; Zhang, Mingming; Zheng, Linkai; Li, Xiang; Chen, Jianjun; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng (2024): "BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[5]

Poddebniak, Damian; Dresen, Christian; Müller, Jens; Ising, Fabian; Schinzel, Sebastian; Friedberger, Simon; Somorovsky, Juraj; Schwenk, Jörg (2018): "Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Öndarö, Gurur; Kaspereit, Jonas; Umezulike, Samson; Saatjohann, Christoph; Ising, Fabian; Schinzel, Sebastian (2025): "S/MINE: Collecting and Analyzing S/MIME Certificates at Scale", in: Proceedings of the USENIX Security Symposium. (Link)

[7]

Wang, Chuhan; Shen, Kaiwen; Guo, Minglei; Zhao, Yuxuan; Zhang, Mingming; Chen, Jianjun; Liu, Baojun; Zheng, Xiaofeng; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng (2022): "A Large-scale and Longitudinal Measurement Study of DKIM Deployment", in: Proceedings of the USENIX Security Symposium. (Link)

[8]

Lee, Hyeonmin; Girish, Aniketh; Rijswijk-Deij, Roland van; Kwon, Taekyoung "Ted"; Chung, Taejoong (2020): "A Longitudinal and Comprehensive Study of the DANE Ecosystem in Email", in: Proceedings of the USENIX Security Symposium. (Link)

[9]

Blechschmidt, Birk; Stock, Ben (2023): "Extended Hell(o): A Comprehensive Large-Scale Study on Email Confidentiality and Integrity Mechanisms in the Wild", in: Proceedings of the USENIX Security Symposium. (Link)

[10]

Czybik, Stefan; Horlboge, Micha; Rieck, Konrad (2023): "Lazy Gatekeepers: A Large-Scale Study on SPF Configuration in the Wild", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[11]

Ashiq, Md. Ishtiaq; Fiebig, Tobias; Chung, Taejoong (2025): "Unraveling the Complexities of MTA-STS Deployment and Management in Securing Email", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[12]

Le Pochat, Victor; Van Goethem, Tom; Tajalizadehkhoob, Samaneh; Korczy´nski, Maciej; Joosen, Wouter (2019): "Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation", in: Proceedings of the 26th Annual Network and Distributed System Security Symposium. (DOI)

[13]

Foster, Ian D.; Larson, Jon; Masich, Max; Snoeren, Alex C.; Savage, Stefan; Levchenko, Kirill (2015): "Security by Any Other Name: On the Effectiveness of Provider Based Email Security", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[14]

Shen, Kaiwen; Wang, Chuhan; Guo, Minglei; Zheng, Xiaofeng; Lu, Chaoyi; Liu, Baojun; Zhao, Yuxuan; Hao, Shuang; Duan, Haixin; Pan, Qingfeng; Yang, Min (2021): "Weak Links in Authentication Chains: A Large-scale Analysis of Email Sender Spoofing Attacks", in: Proceedings of the USENIX Security Symposium. (Link)

[15]

Ashiq, Md. Ishtiaq; Li, Weitong; Fiebig, Tobias; Chung, Taejoong (2023): "You've Got Report: Measurement and Security Implications of DMARC Reporting", in: Proceedings of the USENIX Security Symposium. (Link)

[16]

Wang, Chuhan; Wang, Chenkai; Yang, Songyi; Liu, Sophia; Chen, Jianjun; Duan, Haixin; Wang, Gang (2025): "Email Spoofing with SMTP Smuggling: How the Shared Email Infrastructures Magnify this Vulnerability", in: Proceedings of the USENIX Security Symposium. (Link)

[17]

Li, Ruixuan; Lu, Chaoyi; Liu, Baojun; Lin, Yanzhong; Pan, Qingfeng; Shao, Jun (2026): "CoordMail: Exploiting SMTP Timeout and Command Interaction to Coordinate Email Middleware for Convergence Amplification Attack", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[18]

Lee, Hyeonmin; Ashiq, Md. Ishtiaq; Müller, Moritz; Rijswijk-Deij, Roland van; Kwon, Taekyoung "Ted"; Chung, Taejoong (2022): "Under the Hood of DANE Mismanagement in SMTP", in: Proceedings of the USENIX Security Symposium. (Link)

[19]

Bennett, Nathaniel; Sowards, Rebekah; Deccio, Casey T. (2022): "SPFail: Discovering, Measuring, and Remediating Vulnerabilities in Email Sender Validation", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[20]

Tang, Ka Fun; Tu, Che Wei; Mak, Sui Ling Angela; Chau, Sze Yiu (2025): "A Multifaceted Study on the Use of TLS and Auto-detect in Email Ecosystems", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[21]

Wen, Shushang; Zhang, Yiming; Shen, Yuxiang; Li, Bingyu; Duan, Haixin; Lin, Jingqiang (2025): "Automatic Insecurity: Exploring Email Auto-configuration in the Wild", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[22]

Wang, Chenkai; Wang, Gang (2022): "Revisiting Email Forwarding Security under the Authenticated Received Chain Protocol", in: Proceedings of the ACM Web Conference. (DOI)

[23]

Chen, Jianjun; Paxson, Vern; Jiang, Jian (2020): "Composition Kills: A Case Study of Email Sender Authentication", in: Proceedings of the USENIX Security Symposium. (Link)

[24]

Li, Ruixuan; Xiao, Shaodong; Liu, Baojun; Lin, Yanzhong; Duan, Haixin; Pan, Qingfeng; Chen, Jianjun; Zhang, Jia; Liu, Ximeng; Lu, Xiuqi; Shao, Jun (2024): "Bounce in the Wild: A Deep Dive into Email Delivery Failures from a Large Email Service Provider", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[25]

Szurdi, Janos; Christin, Nicolas (2017): "Email Typosquatting", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[26]

Müller, Jens; Brinkmann, Marcus; Poddebniak, Damian; Böck, Hanno; Schinzel, Sebastian; Somorovsky, Juraj; Schwenk, Jörg (2019): "“Johnny, you are fired!” – Spoofing OpenPGP and S/MIME Signatures in Emails", in: Proceedings of the USENIX Security Symposium. (Link)

[27]

Poddebniak, Damian; Ising, Fabian; Böck, Hanno; Schinzel, Sebastian (2021): "Why TLS is better without STARTTLS: A Security Analysis of STARTTLS in the Email Context", in: Proceedings of the USENIX Security Symposium. (Link)

[28]

Stransky, Christian; Wiese, Oliver; Roth, Volker; Acar, Yasemin; Fahl, Sascha (2022): "27 Years and 81 Million Opportunities Later: Investigating the Use of Email Encryption for an Entire University", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[29]

Fiebig, Tobias; Gürses, Seda; Gañán, Carlos H.; Kotkamp, Erna; Kuipers, Fernando; Lindorfer, Martina; Prisse, Menghua; Sari, Taritha (2023): "Heads in the Clouds? Measuring Universities’ Migration to Public Clouds: Implications for Privacy & Academic Freedom", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[30]

Ising, Fabian; Poddebniak, Damian; Kappert, Tobias; Saatjohann, Christoph; Schinzel, Sebastian (2023): "Content-Type: multipart/oracle - Tapping into Format Oracles in Email End-to-End Encryption", in: Proceedings of the USENIX Security Symposium. (Link)

[31]

Ma, Jinrui; Chen, Lutong; Xue, Kaiping; Luo, Bo; Huang, Xuanbo; Ai, Mingrui; Zhang, Huanjie; Wei, David S.L.; Zhuang, Yan (2024): "FakeBehalf: Imperceptible Email Spoofing Attacks against the Delegation Mechanism in Email Systems", in: Proceedings of the USENIX Security Symposium. (Link)

[32]

Li, Ruixuan; Lu, Chaoyi; Liu, Baojun; Lin, Yanzhong; Duan, Haixin; Pan, Qingfeng; Shao, Jun (2025): "Understanding and Characterizing Intermediate Paths of Email Delivery: The Hidden Dependencies", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[33]

Rao, Sumanth; Liu, Enze; Ho, Grant; Voelker, Geoffrey M.; Savage, Stefan (2024): "Unfiltered: Measuring Cloud-based Email Filtering Bypasses", in: Proceedings of the ACM Web Conference. (DOI)

[34]

Li, Ruixuan; Lu, Chaoyi; Liu, Baojun; Zhang, Yunyi; Hong, Geng; Duan, Haixin; Lin, Yanzhong; Pan, Qingfeng; Yang, Min; Shao, Jun (2025): "HADES Attack: Understanding and Evaluating Manipulation Risks of Email Blocklists", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[35]

Wu, Mengying; Hong, Geng; Chen, Jiatao; Liu, Baojun; Liu, Mingxuan; Yang, Min (2026): "One Email, Many Faces: A Deep Dive into Identity Confusion in Email Aliases", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[36]

Zhang, Jiahe; Chen, Jianjun; Wang, Qi; Zhang, Hangyu; Wang, Chuhan; Zhuge, Jianwei; Duan, Haixin (2024): "Inbox Invasion: Exploiting MIME Ambiguities to Evade Email Attachment Detectors", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[37]

Jeitner, Philipp; Shulman, Haya (2021): "Injection Attacks Reloaded: Tunnelling Malicious Payloads over DNS", in: Proceedings of the USENIX Security Symposium. (Link)

[38]

Yajima, Masanori; Chiba, Daiki; Yoneya, Yoshiro; Mori, Tatsuya (2023): "A First Look at Brand Indicators for Message Identification (BIMI)", in: Proceedings of the 24th International Conference on Passive and Active Measurement, pp. 479-495. Springer Nature Switzerland. (DOI)