> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Delivery pipeline (DP)
- URL: /taxonomies/email-infrastructure/delivery-pipeline/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T14:52:20.847Z
- Description: Delivery pipeline (DP): 13 threats, email infrastructure taxonomy. The composition of hops between sending MTA and mailbox: sequencing, fracture, remediation.
- Author: Brett Crawley
[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › Delivery pipeline
**Layer 01 of 09 · 13 threats · prefix DP**
Every message should pass every control, in the intended order, and each control should see what the recipient will see. These entries cover sequencing, fracture and remediation across the hops between the sending MTA and the mailbox.
**Scope:** The composition of hops between sending MTA and mailbox: sequencing, fracture, remediation.
*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*
## The threats
- **DP·A** Ingress Bypass
- **DP·K** Inherited Verdict
- **DP·Q** Mutating Hop
- **DP·J** Fail-Open Scanning
- **DP·10** Verdict Decay
- **DP·9** Unscanned Path
- **DP·8** Remediation Race
- **DP·7** Tenant Confusion
- **DP·6** Induced Backpressure
- **DP·5** Loop and Amplification
- **DP·4** Verdict Inconsistency
- **DP·3** Quarantine Release Abuse
- **DP·2** Pipeline Reconfiguration
## Where this layer touches others
- **SMTP and delivery pipeline:** SMTP is a single hop's conversation. The pipeline is the composition of hops.
- **MIME and delivery pipeline:** MIME is how a message is interpreted. The pipeline is whether and when it is inspected.
- **Delivery pipeline and content scanners:** the pipeline decides what to do with a scanner's limits and verdicts. The scanner layer asks whether the inspection itself holds up.
- **Tenancy:** Tenant Confusion (DP·7), Cross-Tenant Identity (AU·K) and Shared Reputation Poisoning (SM·8) each cover a different face of shared infrastructure (configuration, identity, reputation). Shared Infrastructure, Shared Fate (T2) is the structural hazard behind all three.
- **Operations and the other layers:** delivery pipeline, client protocols and DNS each cover a corner of operations (admin routing changes in DP·2, mailbox state in CP·10, dangling records in DN·K). Operations and storage covers the stores and tooling around the message path: the copies, the credentials and the people with access.
## STRIDE, CAPEC and CWE
Of the 13 entries here, STRIDE fits 5 cleanly and 8 only loosely. CAPEC 3.9 has a pattern that describes 2 of them directly, only a generic parent pattern for 9, and nothing for 2. CWE 4.20 names the weakness directly for 7, has only a broader weakness for 5, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.
---
Email infrastructure overview](/taxonomies/email-infrastructure/) · [Authentication protocols (AU)](/taxonomies/email-infrastructure/authentication-protocols/) →
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*