Who reads your electronic mail?

March ninth, 2023

That is the second weblog publish on the subject of
the centralization of the web. The primary publish,
discussing range of authoritative identify servers,
will be discovered here.

In response to various
statistics,
there are someplace round 330 billion emails being
despatched daily, roughly 3.82 million per second.
Who reads all these emails?

Okay, okay, no person does. Who would need to?
Most of it’s spam anyway. However, given how private
electronic mail is, how a lot we depend on electronic mail for enterprise, how
helpful electronic mail will be in authorized discovery, and, most
importantly, how — over 40 years after RFC821
was revealed — we nonetheless use a transparent textual content
protocol and don’t have any reasonable resolution for end-to-end
encryption of this non-public content material… given all that,
who may learn that electronic mail in the event that they needed to?
Ah, effectively, that is one other query altogether.

The Easy Mail Switch Protocol (SMTP)
makes use of MX
information within the DNS to determine which server(s) it
ought to hand the mail off to. It was once widespread for
area house owners to run their very own mail server, but it surely
seems that doing that effectively whereas effectively
combating spam (each incoming and outgoing), electronic mail
abuse, and the ever growing visitors quantity isn’t
that straightforward. And what will we do when issues aren’t straightforward?
We pay any person else to do it for us. To the
cloud!

In 2023, likelihood is that, whatever the area
in query, your private and/or enterprise electronic mail is
really dealt with by e.g., Google, Microsoft, Yahoo,
Apple, Yandex, or, say, GMX. However even when these are
your electronic mail service supplier, it is also fairly probably
that your area makes use of one other layer in entrance of
that, which gives spam-, malware-,
filtering, and data-loss prevention (DLP) options.
Common service suppliers right here embody Proofpoint,
Barracuda, Sophos, Trustwave, and another choices
from large identify firms in addition to ones you probably
have by no means heard of.

So let’s check out which of those numerous
firms are fronting essentially the most domains and will
thus, in concept, anyway, learn your electronic mail!

Methodology

Very similar to I did after I seemed on the NS record diversity,
I went by way of all of the gTLD zone information (once more leaving
out ccTLDs), extracted all second-level domains, and
then went to work with nothing however my little, trusty
bind9 caching
resolver operating on my private VPS.¹

For every gTLD zone file, I extracted the total listing
of domains inside that TLD, outlined as any distinctive
label within the zone file with an NS report. This yielded a
grand complete of roughly 203 million domains:
> 164 million in .com alone, with
all different gTLDs including as much as roughly 39 million domains.
For every of these domains, I then carried out DNS
lookups for its MX information, and
a number of million queries later I ended up with an entire
bunch of mail server FQDNs.

A single area might after all have a number of MX
information which can or will not be in the identical
area (which itself might or will not be inside the
authentic area):

$ dig +brief mx netmeister.org           # <--+ 1 MX
50 panix.netmeister.org.                 # <--+ inside the identical area

$ dig +brief mx akamai.com               # <--+ 4 MX
20 mx0b-00190b01.pphosted.com.           #    |
10 mxa-00190b01.gslb.pphosted.com.       #    | all in a unique area
10 mxb-00190b01.gslb.pphosted.com.       #    |
20 mx0a-00190b01.pphosted.com.           # <--+

$ dig +brief mx twitter.com              # <--+ 5 MX
30 ASPMX3.GOOGLEMAIL.com.                #    + in two completely different domains
20 alt1.aspmx.l.google.com.              #    | (owned by the identical org)
10 aspmx.l.google.com.                   #    |
30 ASPMX2.GOOGLEMAIL.com.                #    +
20 alt2.aspmx.l.google.com.              # <--+

$ dig +brief mx whynot.espresso            # <--+ 4 MX
10 mailin.mx-hub.cz.                     #    | in 4 completely different domains
10 mailin.mx-hub.eu.                     #    | in 4 completely different TLDs
10 mailin.mx-hub.sk.                     #    |
10 mailin.mx-hub.internet.                    # <--+
$ 

So we have to flatten the information a bit and cut back
the person MX servers to their second-level
area. With the assistance of some
perl and the Public Suffix
List, I mapped the roughly 30 million distinctive MX
servers listed for the 203 million domains into round 21 million
second-level domains.

So… who does learn host all people’s electronic mail?

Stats by MX

No MX

As famous above, I discovered roughly 30 million distinctive
mail servers, however after all not each area
has an MX report. In
that case, SMTP assumes an “implicit MX” and
makes an attempt to ship the mail to the IP deal with (if
any) of the naked area identify.

Because it seems, no specific MX report is certainly essentially the most broadly
discovered configuration: virtually 119 million domains (58%
of all domains) are missing any such useful resource report.
Of these, 76 million (64%) do have an IP deal with and
thus may a minimum of theoretically obtain
mail; reversing these IP addresses once more, we word that
28.8 million are AWS IPs (within the amazonaws.com., awsglobalaccelerator.com., and cloudfront.internet. domains), 18 million
Google’s (1e100.internet. and googleusercontent.com.; 34.102.136.180 is utilized by 12.8
million domains alone), and seven.3 million Wix’s (wixsite.com).

That leaves round 42 million domains that don’t
have any technique of accepting mail just by not having
both an MX report, nor an IP
deal with. Nonetheless, there are different ways in which a website
proprietor might sign that it doesn’t settle for mail: 1.5
million (or 0.7% of all) domains have their MX set to localhost (and 425 to localhost.localdomain), which of
course is a bit janky a approach of telling of us to not
hassle you. As a result of this is not fairly splendid, we now
have a a lot better approach of expressing the truth that
a website doesn’t need any mail: the “Null MX”
No Service Useful resource File, laid out in RFC7505.
That’s, merely set an MX report
with a choice variety of 0
and a zero-length label (i.e., .):

$ host -t mx livemediastreaming.com
livemediastreaming.com mail is dealt with by 0 .
$ 

This strategy seems to be marginally extra well-liked
than utilizing localhost: round 2
million or simply about 1% of all domains have a Null MX
report set. (That strategy additionally has the benefit
that it will possibly assist in combating impersonation with out
having to specify an SPF
policy: a receiving mail server can reject mail
upon encountering an undeliverable MailFrom/From
deal with.)

So all in all, nearly 46 million domains or
round 23% of all domains wouldn’t have any approach of
getting mail.

Variety of MX Information

Now let’s check out the ~40% (roughly
81 million) of domains with MX information. Most domains have
between one and 5 mail change information, however of
course there are outliers: 464 domains have extra
than ten MX information, 28 extra
than 20, and 4 domains have over 100! For instance, the ever
so aptly named everymailbox.com
area has 398 MX information, whiteinbox.internet has 253, and rm02.internet has 235. All of those MX information have the identical precedence,
suggesting they’re attempting to intention for some DNS
round-robin load balancing right here.

gaodong.com is one other
outlier: 123 MX information with 117
distinct priorities, just like connectingdonors.internet with 59 information
with distinctive priorities from 1 to 58.

After which there are domains that unfold their MX information throughout a number of
second-level domains, though a few of them are
clearly misconfigured and together with what look like
non-fqdn names in addition to some that merely do not
resolve in any respect:

$ host -t mx trustedomain.com
trustedomain.com mail is dealt with by 10 imtat4.         # these look like
trustedomain.com mail is dealt with by 5 imta6.           # non-fqdn names underneath
trustedomain.com mail is dealt with by 5 imta21.          # the trustedomain.com area
[... 40 more records like that ...]
$ host -t mx dabafunk.xyz
dabafunk.xyz mail is dealt with by 10 mail.dabafunk.xyz.
dabafunk.xyz mail is dealt with by 0 smtp.dabafunk.xyz.
dabafunk.xyz mail is dealt with by 2 mail.bhargo.         # equally, some are non-fqdn
dabafunk.xyz mail is dealt with by 1 smtp.wesak.
dabafunk.xyz mail is dealt with by 1 smtp.maitreya.
dabafunk.xyz mail is dealt with by 1 smtp.shamballa.
dabafunk.xyz mail is dealt with by 2 mail.wesak.          # however others do not resolve
dabafunk.xyz mail is dealt with by 1 smtp.bhargo.
dabafunk.xyz mail is dealt with by 2 mail.maitreya.
$ 

And my favourite: moshelasky.internet, which set MX information for plenty of
fully unrelated and essentially mutually
unique large identify domains, principally saying “go give
my mail to Cisco, and if that does not work out, strive
Microsoft, Intel, Google, Yahoo… no matter”:

$ host -t mx moshelasky.internet
moshelasky.internet mail is dealt with by 70 mail.fb.com.
moshelasky.internet mail is dealt with by 100 mail.thunderbird.com.
moshelasky.internet mail is dealt with by 100 mail.yahoo.com.
moshelasky.internet mail is dealt with by 90 mail.pirisoft.com.
moshelasky.internet mail is dealt with by 30 mail.moshelasky.com.
moshelasky.internet mail is dealt with by 40 mail.moshelasky.internet.
moshelasky.internet mail is dealt with by 100 mail.walla.co.il.
moshelasky.internet mail is dealt with by 20 mail.outlook.com.
moshelasky.internet mail is dealt with by 50 mail.intel.com.
moshelasky.internet mail is dealt with by 80 mail.grc.com.
moshelasky.internet mail is dealt with by 100 mail.mailchimp.com.
moshelasky.internet mail is dealt with by 100 mail.digicert.com.
moshelasky.internet mail is dealt with by 100 mail.noip.com.
moshelasky.internet mail is dealt with by 100 mail.google.com.
moshelasky.internet mail is dealt with by 60 mail.microsoft.com.
moshelasky.internet mail is dealt with by 100 mail.home windows.com.
moshelasky.internet mail is dealt with by 10 mail.cisco.com.
$ 

Legitimate MX Information

However okay, let’s take a look at the domains with cheap
MX information: Within the 30 million distinctive
servers listed, we anticipate to see a number of of the
well-liked electronic mail and internet hosting suppliers’ mail servers, however
after all much less well-liked domains may have their very own MX information which can be prone to be
distinctive. In reality, virtually 98% of all domains have a
globally distinctive mail server, making solely a single
look. Of the opposite 380K mail servers, round 2K
seem greater than 1,000 occasions. The highest 20 most
often used mail servers listed here are:

You’ll be able to see an apparent development right here: Google’s mail
servers are somewhat well-liked (though not the
most well-liked), and naturally likelihood is that
domains which have e.g., alt1.aspmx.l.google.com. as one MX will probably have additionally alt2.aspmx.l.google.com. as a second
report. This implies that we will achieve extra insights
by decreasing them to their area identify:

MX File Domains

To higher perceive who the operators
of those mail servers are, I flattened the information
such {that a} area that incorporates MX information pointing to, say, aspmx.l.google.com., alt1.aspmx.l.google.com., and smtp.secureserver.internet. can be
counted as soon as every for the domains google.com and secureserver.internet..

This breaks down our knowledge set to 21 million distinctive
domains, and the highest 20 domains through which we discover most
MX information are:

Clearly we will mix a few of the domains by
firm or group to higher replicate the
focus of the mail servers. With that, we discover
that Google takes the lion’s share of domains with
about 34%, GoDaddy round 14%, Namecheap 13.5%, and
Microsoft trailing behind with about 4.7%⁴:

To notice: All of that is for all generic
second-level domains however excluding
country-code TLDs. Essentially, this skews the
findings a bit, as we would anticipate e.g., European
nations to make use of non-American service suppliers.

Spot-checking 100,000 domains every from .ch, .fr, and
.se — three of the one 17
ccTLD zone information / area identify listings I used to be in a position to
entry — reveals OVH and Gandi forward of Google in .fr, Hostpoint AG and Infomaniak in
the highest 3 in .ch, and the
Swedish One.com not surprisingly taking the highest spot
in .se, however a full evaluation of
all ccTLD zones would clearly be wanted to get a
full view.

See Also

Reversing and Tooling a Signed Request Hash in Obfuscated JavaScript

Stats for Prime 1M Domains

all domains tells us which mail
servers are listed most often, however that after all
contains a whole bunch of hundreds if not tens of millions of
parked domains, spam domains, one-time or dormant
domains and many others. So let’s as a substitute have a look at the Tranco Top 1 Million
listing and see if our distribution adjustments.

For these 1 million domains, we discover round 433K
distinct MX servers in 230K
domains. The highest 20 mail server domains there are
barely completely different from these for all
domains:

We observe that amongst the highest 1M domains, many
outsource mail not simply to the massive suppliers (Google
and Microsoft collectively account for 60% of all!), however
usually add one other layer of electronic mail safety by way of
completely different, extra specialised service gives resembling
Proofpoint, Barracuda Networks, or Cisco / IronPort.
These might then effectively additionally hand the mail to e.g.,
Google or Microsoft, additional growing their share,
however that is still opaque to us from the skin.

Abstract

In abstract, a few of the data have been we in a position to
pull out of our MX knowledge
assortment contains:

• 58% of all domains (119 million) don’t have any MX report (42 million of these don’t have any IP)
• 1% of all domains (~2 million) use a RFC7505 “Null MX” (0 .)
• 0.7% of all domains (~1.5 million) use localhost
• 40% of all domains (81 million) have an MX report, yielding
  round 30 million distinctive information in 21 million distinctive domains
• 98% of these are distinctive, and round 380K mail servers a used
  by multiple area
• ~2,000 mail servers are utilized by >1,000 domains every;
  essentially the most often used MX information are GoDaddy’s mailstore1.secureserver.internet. and smtp.secureserver.internet. (utilized by 10.6 million domains every) and Google’s aspmx.l.google.com. (utilized by 9.6 million domains)
• 34% of all domains (53.7 million) use one among Google’s mail servers,
  14% (22.5 million) one among GoDaddy’s, 13.5% (~21.3 million) one among Namecheap’s
• for the Prime 1M domains, over 60% use Google’s (41%) and Microsoft’s (20%) mail servers
• many mail safety companies dominate the rest

So all in all, the reply to the query of who can
learn your electronic mail just about boils right down to — yep —
“Google and Microsoft”. Even when your area
does not use one among their mail servers, likelihood is
that whoever you might be sending mail to
does.

To be honest: these firms are going to be doing
a a lot higher job at operating and securing
your electronic mail than you might be, and outsourcing this essential
performance usually makes good sense. And but,
that is one other instance of the constantly growing
centralization of the web. Our companies simply
like our private on-line lives are concentrated within the
palms of just some firms.

March ninth, 2023

Footnotes:

[1] Performing tens of millions of
parallel DNS lookups results in some interesting
issues in different
areas, that are in all probability price a separate weblog
publish all on their very own.

[2] In nations the place
“gmail” was already trademarked, Google makes use of the googlemail.com area. This
contains e.g., the UK, Germany, Russia, and Poland.

[3] h-email.internet seems to be a website
used primarily or completely for parked domains by
e.g., ParkingCrew.
A peculiarity of the area is it is SPF report (ip6:fd96:1c8a:43ad::/48 -all), which
permits solely visitors on an IPv6 Distinctive Native Deal with
(ULA), regardless of mail.h-email.internet
having solely IPv4 addresses that belong to Digital
Ocean and Hetzner On-line GmbH.

[4] The chances right here
usually are not fairly correct, since they’re over solely these
mail servers which can be utilized by 1,000 or extra domains.
Over all 21 million mail servers, they’re decreased
considerably, however the proportional dominance of the highest
domains stays.

Hyperlinks:

Elsewhere: