Email Provider Dependencies and Email Security in Municipalities Across Germany, Austria, and Switzerland

Automated pipeline to collect email domains, classify email providers, and analyze email security for municipalities in Germany, Austria, and Switzerland.

Pipeline

1. Resolve — Collect municipality websites from official registries and Wikidata, scrape for email addresses, validate via DNS/MX, and produce a municipality-to-domain mapping.
2. Classify — Fingerprint DNS records (MX, SPF, autodiscover, SMTP banners, ASN) to determine email provider (Microsoft 365, Google Workspace, AWS, domestic hosting, etc.).
3. Scan — Evaluate DANE/DNSSEC and email authentication (SPF, DMARC) per domain via a Kotlin/Docker scanner.

How to run

Install uv, then:

uv sync                               # install deps
uv run resolve <ch|de|at|--all>       # Stage 1: resolve email domains
uv run classify <ch|de|at>            # Stage 2: classify providers
uv run scan <ch|de|at>                # Stage 3: DANE/SPF/DMARC (requires Docker)

Common flags: --dry-run, -v, --no-cache. See uv run <cmd> --help.

Important

This tool requires unrestricted outbound port 25 (SMTP). Most residential ISPs and laptops block this. For best results, run from a cloud VM with port 25 access opened.

Validation

The classifier is validated via bounce probing — a separate, manual process (not part of the pipeline above) that sends probe emails to a stratified sample of municipalities and parses the resulting NDRs to identify the actual backend MTA. The validation tooling and data is maintained in a separate repository.

Output files

Results are written to output/:

Stage	Files	Description
Resolve	domains/domains_{cc}.json	Minimal: code, name, region, website, email domain
	domains/domains_{cc}_detailed.json	Full: includes source, confidence, flags
	domains/domains_{cc}_review.json	Low-confidence entries for manual review
Classify	providers/providers_{cc}.json	Provider, confidence, evidence signals, gateway
	providers/providers_{cc}.min.json	Minified for frontend consumption
Scan	security/security_{cc}.json	DANE, SPF, DMARC assessment per municipality
Export	export.xlsx	Combined workbook: all municipalities + statistics

Maps

Interactive Leaflet maps visualizing email provider distribution and security posture are available in the maps/ directory.

To view them:

python3 -m http.server              # from the project root

Now open http://localhost:8000/maps/ in a browser.

Origins

This project builds on MXmap (source), a solo project by David Huser mapping the email providers of ~2,100 Swiss municipalities, which spawned around ten country-specific forks across Europe. SecAssure2026 extends that work to all of Germany, Austria and Switzerland and adds a dedicated email-security scanning stage.

License

First-party code in this repository is released under the MIT License — see LICENSE.

Third-party subtrees retain their own licenses. Notably, src/security_test/scanner/testssl.sh/ is vendored under GPL-2.0 (see the LICENSE file in that directory). Redistribution of the repository as a combined binary artifact (e.g., a single Docker image) is therefore constrained by GPL-2.0 terms; the MIT grant applies to the first-party Python code.