I was sort of curious yesterday and checked as well. Most were four or less. I had a number that were five or six. A couple dozen were at eight. I had one spam message that had 13 parts. It included both "_mta-sts" and "mta-sts" in there, as well as "mail" nine times. The last two parts were the org domain.
-- Alex Brotman Sr. Engineer, Anti-Abuse & Messaging Policy Comcast > -----Original Message----- > From: dmarc <dmarc-boun...@ietf.org> On Behalf Of John Levine > Sent: Monday, November 23, 2020 4:06 PM > To: dmarc@ietf.org > Cc: eric.b.chudow....@mail.mil > Subject: Re: [dmarc-ietf] tree walk and Org and PSD, Second WGLC for draft- > ietf-dmarc-psd > > In article > <553d43c8d961c14bb27c614ac48fc0312811f...@umechpa7d.easf.csd.dis > a.mil> you write: > >-=-=-=-=-=- > > > >Even for .mil, the vast majority of email domains are fairly short with > >four or fewer labels. Most of the other ones tend to be individual servers > >that > send automatic performance emails, and I think should be considered more of > an edge case and less of our concern. > > I scraped my logs for the past few months and that's what I found. > Nearly everything was four labels or less. Spot checking the few five-label > names, I found that most of the mail was all from MAILER-DAEMON@<long- > mailhost-name> and it appeared to be spam blowback. There was a trickle of > what looked like real mail from stumail.zcs.k12.in.us and > feedback.retail.voice- > your-views.hsbc.com, > > I found nothing at all with six labels or longer. > > So if we made the tree walk limit six or seven I think we'd be unlikely to > lose any > mail that anyone would miss. > > R's, > John > > > _______________________________________________ > dmarc mailing list > dmarc@ietf.org > https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/dmarc__;! > !CQl3mcHX2A!TIKw8O7ptxZvJLkZ0GxAxe4haD43V7NWTdLfVAZUiJUaCqFVIV1co > wazKVYiV8c2YXTskHmvzw$ _______________________________________________ dmarc mailing list dmarc@ietf.org https://www.ietf.org/mailman/listinfo/dmarc
