[kakwa_]

It can be quite hard to detect. A lot of this services will not have an easily recognizable marker.

It can be for various reasons:

* They can use these services themselves

* They can support full customization of domains, including for the "message-id" and the "received" headers.

I'm working as SRE in a fairly large marketing provider (not sure in term of %, but we provide services for quite a few large brands sending several millions emails per day), and we do this full customization by default. There are other way to recognize us (other headers in the email or the pattern for the tracked url for example), but the one described in the article will not work.

It would also be interesting to be able to detect which MTA is used by these service providers. Is it an in-house one or an off the shelf one? The two off the shelf ones I know for mass sending are Momentum and PowerMTA which are both owned by Sparkpost but they might be others.