> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Structural hazards (T)

- URL: /taxonomies/email-infrastructure/structural-hazards/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T14:54:58.810Z
- Description: Structural hazards (T): 8 hazards in the email infrastructure threat taxonomy. Hazards of email itself. Each with a mitigation principle and design measures.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Email infrastructure](/taxonomies/email-infrastructure/) › Structural hazards

**The whole stack · 8 hazards · prefix T**

These eight hazards are properties of email itself, so no single component can fix them. Apply them to the whole design after the layers.

**Scope:** Hazards of email itself.

![Table: Structural hazards (T), 8 hazards with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/103/email-taxonomy-table-10-T.png =1400x2758)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/email-infrastructure/) on the overview page, where it can be searched and copied.*

## The hazards

- <span id="t8"></span>**T8** Envelope and Header Duality
- <span id="t7"></span>**T7** Hop-by-Hop Trust
- <span id="t6"></span>**T6** Legitimate Mutation
- <span id="t5"></span>**T5** Interpretation Differential
- <span id="t4"></span>**T4** Authentication Is Not Trust
- <span id="t3"></span>**T3** Legacy Fail-Open
- <span id="t2"></span>**T2** Shared Infrastructure, Shared Fate
- <span id="t1"></span>**T1** Check Once, Use Later

## Where this group touches others

- **Tenancy:** Tenant Confusion (DP·7), Cross-Tenant Identity (AU·K) and Shared Reputation Poisoning (SM·8) each cover a different face of shared infrastructure (configuration, identity, reputation). Shared Infrastructure, Shared Fate (T2) is the structural hazard behind all three.

## STRIDE, CAPEC and CWE

Of the 8 entries here, STRIDE fits none of them cleanly. CAPEC 3.9 has a pattern that describes 2 of them directly, only a generic parent pattern for 4, and nothing for 2. CWE 4.20 names the weakness directly for 2, has only a broader weakness for 5, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE](/email-threat-taxonomy-mapping). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Structural hazards (T), 8 hazards, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.](https://www.ostering.com/media/posts/103/email-mapping-table-10-T.png =1400x1346)

---

← [Operations and storage (OP)](/taxonomies/email-infrastructure/operations-and-storage/) · [Email infrastructure overview](/taxonomies/email-infrastructure/)

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [email infrastructure overview](/taxonomies/email-infrastructure/).*