{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T15:56:05Z","timestamp":1763740565836,"version":"3.45.0"},"publisher-location":"New York, NY, USA","reference-count":51,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,10,28]]},"DOI":"10.1145\/3730567.3764488","type":"proceedings-article","created":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T15:22:38Z","timestamp":1763738558000},"page":"578-591","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Understanding and Characterizing Intermediate Paths of Email Delivery: The Hidden Dependencies"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0729-9661","authenticated-orcid":false,"given":"Ruixuan","family":"Li","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China and Beijing National Research Center for Information Science and Technology, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-3512-7612","authenticated-orcid":false,"given":"Chaoyi","family":"Lu","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9032-8063","authenticated-orcid":false,"given":"Baojun","family":"Liu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China and Beijing National Research Center for Information Science and Technology, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-8730-9832","authenticated-orcid":false,"given":"Yanzhong","family":"Lin","sequence":"additional","affiliation":[{"name":"Coremail Technology Co. Ltd, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0083-733X","authenticated-orcid":false,"given":"Haixin","family":"Duan","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8211-8242","authenticated-orcid":false,"given":"Qingfeng","family":"Pan","sequence":"additional","affiliation":[{"name":"Coremail Technology Co. Ltd, Guangdong, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8352-0973","authenticated-orcid":false,"given":"Jun","family":"Shao","sequence":"additional","affiliation":[{"name":"Zhejiang Gongshang University, Hangzhou, China and Zhejiang Key Laboratory of Big Data and Future E-Commerce Technology, Hangzhou, China"}]}],"member":"320","published-online":{"date-parts":[[2025,11,21]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"1979. The Belmont report: ethical principles and guidelines for the protection of human subjects of research. United States. National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. Department of Health Education and Welfare."},{"key":"e_1_3_2_1_2_1","unstructured":"2025. List of Country Code TLDs. https:\/\/gist.github.com\/derlin\/421d2bb55018a1538271227ff6b1299d."},{"key":"e_1_3_2_1_3_1","unstructured":"G. Akiwate K. Ruth R. Habib and Z. Durumeric. 2024. On the Centralization and Regionalization of the Web. CoRR abs\/2406.19569 (2024)."},{"key":"e_1_3_2_1_4_1","unstructured":"Barracuda. 2025. https:\/\/www.barracuda.com\/."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"crossref","unstructured":"S. Bates J. Bowers S. Greenstein J. Weinstock Y. Xu and J. Zittrain. 2018. Evidence of decreasing internet entropy: the lack of redundancy in dns resolution by major websites and services. In National Bureau of Economic Research.","DOI":"10.3386\/w24317"},{"key":"e_1_3_2_1_6_1","unstructured":"CBS. 2020. Google services including Gmail and YouTube suffer outage. https:\/\/www.cbsnews.com\/news\/google-services-restored-global-outage-today-2020--12--14\/."},{"key":"e_1_3_2_1_7_1","volume-title":"Composition Kills: A Case Study of Email Sender Authentication. In USENIX Security Symposium. 2183--2199","author":"Chen J.","unstructured":"J. Chen, V. Paxson, and J. Jiang. 2020. Composition Kills: A Case Study of Email Sender Authentication. In USENIX Security Symposium. 2183--2199."},{"key":"e_1_3_2_1_8_1","unstructured":"CodeTwo. 2025. https:\/\/www.codetwo.com\/."},{"key":"e_1_3_2_1_9_1","unstructured":"Coremail. 2025. https:\/\/www.coremail.cn\/."},{"key":"e_1_3_2_1_10_1","volume-title":"Lazy Gatekeepers: A Large-Scale Study on SPF Configuration in the Wild. In IMC. ACM, 344--355.","author":"Czybik S.","year":"2023","unstructured":"S. Czybik, M. Horlboge, and K. Rieck. 2023. Lazy Gatekeepers: A Large-Scale Study on SPF Configuration in the Wild. In IMC. ACM, 344--355."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"crossref","unstructured":"T. Doan J. Fries and V. Bajpai. 2021. Evaluating Public DNS Services in the Wake of Increasing Centralization of DNS. In IFIP. IEEE 1--9.","DOI":"10.23919\/IFIPNetworking52078.2021.9472831"},{"key":"e_1_3_2_1_12_1","unstructured":"Exclaimer. 2025. https:\/\/exclaimer.com\/."},{"key":"e_1_3_2_1_13_1","unstructured":"GoDaddy. 2025. https:\/\/www.godaddy.com\/en\/offers\/email\/sem-email-domainbundle."},{"key":"e_1_3_2_1_14_1","unstructured":"Google. 2025. Automatically forward Gmail messages to another account. https:\/\/support.google.com\/mail\/answer\/10957?hl=en."},{"key":"e_1_3_2_1_15_1","unstructured":"Google. 2025. Google Workspace. https:\/\/workspace.google.com\/."},{"key":"e_1_3_2_1_16_1","unstructured":"Guardio. 2024. EchoSpoofing \u2014 A Massive Phishing Campaign Exploiting Proofpoint's Email Protection to Dispatch Millions of Perfectly Spoofed Emails. https:\/\/labs.guard.io\/echospoofing-a-massive-phishing-campaign-exploitingproofpoints-email-protection-to-dispatch-3dd6b5417db6."},{"key":"e_1_3_2_1_17_1","unstructured":"Wei H. Van T. Vincent R. Z. Wang A. Dasbach-Prisk M. H. Afifi J. Yang E. Katz-Bassett and A. Cidon G. Ho. 2025. Do Spammers Dream of Electric Sheep? Characterizing the Prevalence of LLM-Generated Malicious Emails. In IMC. ACM."},{"key":"e_1_3_2_1_18_1","volume-title":"Drain: An Online Log Parsing Approach with Fixed Depth Tree","author":"He P.","year":"2017","unstructured":"P. He, J. Zhu, Z. Zheng, and M. Lyu. 2017. Drain: An Online Log Parsing Approach with Fixed Depth Tree. In ICWS. IEEE, 33--40."},{"key":"e_1_3_2_1_19_1","volume-title":"Simple: Email Delivery in the 21st Century","author":"Holzbauer F.","year":"2022","unstructured":"F. Holzbauer, J. Ullrich, M. Lindorfer, and T. Fiebig. 2022. Not that Simple: Email Delivery in the 21st Century. In USENIX ATC. USENIX Association, 295--308."},{"key":"e_1_3_2_1_20_1","unstructured":"G. Huston. 2022. Looking at centrality in the DNS. https:\/\/blog.apnic.net\/2022\/11\/22\/looking-at-centrality-in-the-dns\/."},{"key":"e_1_3_2_1_21_1","unstructured":"IANA. 2025. Root Zone Database. https:\/\/www.iana.org\/domains\/root\/db."},{"key":"e_1_3_2_1_22_1","unstructured":"ip api. 2023. IP Geolocation API. https:\/\/ip-api.com\/."},{"key":"e_1_3_2_1_23_1","volume-title":"A. Botta, G. Voelker, R. Rijswijk-Deij, and S. Savage.","author":"Jonker M.","year":"2022","unstructured":"M. Jonker, G. Akiwate, A. Affinito, k. claffy, A. Botta, G. Voelker, R. Rijswijk-Deij, and S. Savage. 2022. Where .ru?: assessing the impact of conflict on russian domain infrastructure. In IMC. ACM, 159--165."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"crossref","unstructured":"A. Kashaf V. Sekar and Y. Agarwal. 2020. Analyzing Third Party Service Dependencies in ModernWeb Services: HaveWe Learned from the Mirai-Dyn Incident?. In IMC. ACM 634--647.","DOI":"10.1145\/3419394.3423664"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"crossref","unstructured":"E. Kenneally and D. Dittrich. 2012. The menlo report: Ethical principles guiding information and communication technology research.","DOI":"10.2139\/ssrn.2445102"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"crossref","unstructured":"S. Kitterman. 2014. Sender Policy Framework (SPF) for Authorizing Use of Domains in Email Version 1. RFC 7208.","DOI":"10.17487\/rfc7208"},{"key":"e_1_3_2_1_27_1","volume-title":"Own Pace: Third-Party Dependency and Centralization Around the World. In SIGMETRICS. ACM, 43--44.","author":"Kumar R.","year":"2023","unstructured":"R. Kumar, S. Asif, E. Lee, and F. Bustamante. 2023. Each at its Own Pace: Third-Party Dependency and Centralization Around the World. In SIGMETRICS. ACM, 43--44."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2023.3262651"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"crossref","unstructured":"R. Li S. Xiao B. Liu Y. Lin H. Duan Q. Pan J. Chen J. Zhang X. Liu X. Lu and J. Shao. 2024. Bounce in theWild: A Deep Dive into Email Delivery Failures from a Large Email Service Provider. In IMC. ACM 659--673.","DOI":"10.1145\/3646547.3688425"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"crossref","unstructured":"X. Li Y. Zhu X. Zhang Z. Jie and Q. Liu. 2023. SpoofingGuard: A Content agnostic Framework for Email Spoofing Detection via Delivery Graph. In CSCWD. IEEE 1098--1105.","DOI":"10.1109\/CSCWD57460.2023.10152850"},{"key":"e_1_3_2_1_31_1","volume-title":"Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy. In EuroS&P","author":"Liu E.","year":"2023","unstructured":"E. Liu, G. Akiwate, M. Jonker, A. Mirian, G. Ho, G. Voelker, and S. Savage. 2023. Forward Pass: On the Security Implications of Email Forwarding Mechanism and Policy. In EuroS&P. IEEE, 373--391."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"crossref","unstructured":"E. Liu G. Akiwate M. Jonker A. Mirian S. Savage and G. Voelker. 2021. Who's got your mail?: characterizing mail service provider usage. In IMC. ACM 122--136.","DOI":"10.1145\/3487552.3487820"},{"key":"e_1_3_2_1_33_1","volume-title":"STAMP: SMTP Server Topological Analysis by Message Headers Parsing","author":"Lochin E.","year":"2010","unstructured":"E. Lochin. 2010. STAMP: SMTP Server Topological Analysis by Message Headers Parsing. In CCNC. IEEE, 1--2."},{"key":"e_1_3_2_1_34_1","volume-title":"Characterizing the Networks Sending Enterprise Phishing Emails. In PAM","volume":"15567","author":"Luo E.","unstructured":"E. Luo, L. Young, G. Ho, M. Afifi, M. Schweighauser, E. Katz-Bassett, and A. Cidon. 2025. Characterizing the Networks Sending Enterprise Phishing Emails. In PAM, Vol. 15567. Springer, 437--466."},{"key":"e_1_3_2_1_35_1","unstructured":"Microsoft. 2025. Microsoft 365. https:\/\/www.microsoft.com\/en-us\/microsoft-365."},{"key":"e_1_3_2_1_36_1","unstructured":"Microsoft. 2025. Use rules to automatically forward messages. https:\/\/support.microsoft.com\/en-us\/office\/use-rules-to-automatically-forward-messages-45aa9664--4911--4f96--9663-ece42816d746."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"K. Moriarty and S. Farrell. 2021. Deprecating tls 1.0 and tls 1.1. RFC 8996.","DOI":"10.17487\/RFC8996"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"crossref","unstructured":"G. Moura S. Castro W. Hardaker M.Wullink and C. Hesselman. 2020. Clouding up the Internet: how centralized is DNS traffic becoming?. In IMC. ACM 42--49.","DOI":"10.1145\/3419394.3423625"},{"key":"e_1_3_2_1_39_1","unstructured":"Netstar. 2025. URL Categorization and Threat Intelligence Solution. https:\/\/incompass.netstar-inc.com\/urlsearch."},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"crossref","unstructured":"J. Postel. 1982. Simple Mail Transfer Protocol. RFC 821.","DOI":"10.17487\/rfc0821"},{"key":"e_1_3_2_1_41_1","unstructured":"Proofpoint. 2025. https:\/\/www.proofpoint.com\/."},{"key":"e_1_3_2_1_42_1","volume-title":"Unfiltered: Measuring Cloud-based Email Filtering Bypasses. In The Web Conference (WWW). ACM, 1702--1711","author":"Rao S.","unstructured":"S. Rao, E. Liu, G. Ho, G. M. Voelker, and S. Savage. 2024. Unfiltered: Measuring Cloud-based Email Filtering Bypasses. In The Web Conference (WWW). ACM, 1702--1711."},{"key":"e_1_3_2_1_43_1","volume-title":"Address Allocation for Private Internets. RFC","author":"Rekhter Y.","year":"1918","unstructured":"Y. Rekhter, B. Moskowitz, D. Karrenberg, G. J. de Groot, and E. Lear. 1996. Address Allocation for Private Internets. RFC 1918."},{"key":"e_1_3_2_1_44_1","unstructured":"J. Rijn. 2023. Email is not dead. But email IS changing. https:\/\/www.emailisnotdead.com\/."},{"key":"e_1_3_2_1_45_1","unstructured":"F. Sanchez Z. Duan and Y. Dong. 2010. Understanding Forgery Properties of Spam Delivery Paths. https:\/\/www.cs.fsu.edu\/~duan\/publications\/2010_ceas_sdp.pdf. In CEAS."},{"key":"e_1_3_2_1_46_1","unstructured":"Tranco. 2024. Top 1M Domains. https:\/\/tranco-list.eu\/."},{"key":"e_1_3_2_1_47_1","volume-title":"H. Duan, Y. Lin, and Q. Pan.","author":"Wang C.","year":"2024","unstructured":"C. Wang, Y. Kuranaga, Y. Wang, M. Zhang, L. Zheng, X. li, J. Chen, H. Duan, Y. Lin, and Q. Pan. 2024. BreakSPF: How Shared Infrastructures Magnify SPF Vulnerabilities Across the Internet. In NDSS."},{"key":"e_1_3_2_1_48_1","unstructured":"Wikipedia. 2025. Herfindahl--Hirschman index. https:\/\/en.wikipedia.org\/wiki\/Herfindahl-Hirschman_index."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","unstructured":"C. Xu Y. Zhang F. Shi H. Shan B. Guo Y. Li and P. Xue. 2023. Measuring the Centrality of DNS Infrastructure in the Wild. Applied Sciences 13 9 (2023). doi:10.3390\/app13095739","DOI":"10.3390\/app13095739"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"crossref","unstructured":"L. Zembruzki A. Jacobs L. Granville and R. Pfitscher. 2023. Examining the Centralization of Email Industry: A Landscape Analysis for IPv4 and IPv6. In ISCC. IEEE 360--366.","DOI":"10.1109\/ISCC58397.2023.10217834"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"crossref","unstructured":"L. Zembruzki R. Sommese L. A. Jacobs M. Jonker and G. Moura. 2022. Hosting Industry Centralization and Consolidation. In NOMS. IEEE 1--9.","DOI":"10.1109\/NOMS54207.2022.9789881"}],"event":{"name":"IMC '25:ACM Internet Measurement Conference","location":"Madison WI USA","sponsor":["SIGMETRICS ACM Special Interest Group on Measurement and Evaluation","SIGCOMM ACM Special Interest Group on Data Communication"]},"container-title":["Proceedings of the 2025 ACM Internet Measurement Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3730567.3764488","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,21]],"date-time":"2025-11-21T15:29:18Z","timestamp":1763738958000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3730567.3764488"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,28]]},"references-count":51,"alternative-id":["10.1145\/3730567.3764488","10.1145\/3730567"],"URL":"https:\/\/doi.org\/10.1145\/3730567.3764488","relation":{},"subject":[],"published":{"date-parts":[[2025,10,28]]},"assertion":[{"value":"2025-11-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}