Who's got your mail? Google and Microsoft, mostly

Who truly sends, receives and, astir importantly perhaps, stores your business' email? Most apt Google and Microsoft, unless you unrecorded successful China oregon Russia. And the marketplace stock for these 2 companies keeps growing.

That's the decision reached by a radical of machine scientists astatine the University of California San Diego, who studied the email work providers utilized by hundreds of thousands of Internet domains—between 2017 and 2021.

"Our probe squad empirically showed the grade to which email has been outsourced and concentrated to a tiny fig of providers and work providers," said Stefan Savage, a prof successful the UC San Diego Department of Computer Science and Engineering and 1 of the paper's elder authors.

The squad presented their findings astatine the Internet Measurement Conference 2021, which took spot virtually Nov. 2 to 4, 2021.

This attraction has respective consequences: it increases the interaction of work failures and information breaches; and it exposes companies and users extracurricular the United States to imaginable subpoenas from U.S. authorities agencies.

A speedy explainer of the quality betwixt domains and work providers: The 2nd fractional of your email code is your institution oregon agency's domain—for example, ucsd.edu is the domain for the University of California San Diego. The email work supplier is the institution that, down the scenes, provides the infrastructure that allows you to nonstop and person email and stores your messages—so ucsd.edu's email work is provided by a operation of Google and Microsoft message services.

As of June 2021, Google and Microsoft are the ascendant providers among fashionable domains, with 28.5% and 10.8% market share, respectively. In comparison, GoDaddy leads the marketplace of providing services for smaller domains, with a 29% marketplace share. The authors besides observed a higher level of attraction implicit time: Google and Microsoft's marketplace stock accrued by 2.3% and 2.9%, respectively, since June 2017.

Some of the maturation comes from smaller domains that utilized to big their ain emails. "While self-hosted domains switched to providers crossed each categories, much than a 4th of them changed their message supplier to Google and Microsoft," said Alex Liu, a UC San Diego machine subject Ph.D. pupil and the paper's pb author.

More affected during outages, information breaches

Concentration of email work providers has led to overmuch bigger work outages. In August and December 2020, planetary outages affected Gmail and Drive—Gmail unsocial has an estimated 1.5 cardinal users. Outlook astir precocious suffered an outage successful October 2021— an estimated 400 cardinal radical usage the service.

The attraction of email work providers besides puts much radical astatine hazard successful the lawsuit of a information breach. One often-cited illustration is the Yahoo information breach that exposed astatine slightest 500 cardinal idiosyncratic accounts. Recently, a flaw successful a Microsoft Exchange protocol has been shown to person leaked hundreds of thousands of credentials.

Legal impact

Google and Microsoft, the 2 ascendant US-based email work providers, look to beryllium successful wide usage by organizations extracurricular the United States—particularly crossed Europe, North America, South America, ample parts of Asia and, to a lesser extent, Russia. For example, 65% of Brazilian domains successful the researchers' dataset big email with Google oregon Microsoft. But they are not utilized successful China.

However, outsourcing email service to US companies tin besides person ineligible implications. Under the 2018 CLOUD Act, US-based providers tin beryllium legally compelled to supply stored lawsuit data, including e-mail, to US instrumentality enforcement agencies, careless of the determination of the data, oregon of the nationality oregon residency of the lawsuit utilizing the data.

Perhaps arsenic a result, Tencent has an overwhelming marketplace stock successful China, with 41%, arsenic does Yandex successful Russia, with 32 %. Both countries person shown that they similar to support power implicit information access.

In addition, an expanding fig of email domains declaration with email information providers, specified arsenic ProofPoint and Mimecast. These companies tin run arsenic a third-party filter for inbound emails, removing the request to negociate information locally. These companies person astir a 7% marketplace stock for ample commercialized companies; and a 17.5% marketplace stock for .gov domains.

The probe was funded by the National Science Foundation, the University of California San Diego, the EU H2020 CONCORDIA task and Google.

The probe was published successful Proceedings of the 21st ACM Internet Measurement Conference.

---

---

More information: Enze Liu et al, Who's got your mail?, Proceedings of the 21st ACM Internet Measurement Conference (2021). DOI: 10.1145/3487552.3487820