Understanding Forgery Properties of Spam Delivery Paths

It is well known that spammers can forge the header of an email, in particular, the trace information carried in the Received: fields, as an attempt to hide the true origin of the email. Despite its critical importance for spam control and holding accountable the true originators of spam, there has been no systematic study on the forgery behavior of spammers. In this paper, we provide the first comprehensive study on the Received: header fields of spam emails to investigate, among others, to what degree spammers can and do forge the trace information of spam emails. Towards this goal, we perform empirical experiments based on two complementary real-world data sets: a 3 year spam archive with about 1.84M spam emails, and the MX records of about 1.2M network domains. In this paper, we report our findings and discuss the implications of the findings on various spam control efforts, including email sender authentication and spam filtering.