% ─────────────────────────────────────────────────────────────────────────
% La brecha entre publicar y proteger — autenticación de correo en México
% y América Latina. simiriki, 15 de agosto de 2026. CC-BY-4.0.
%
% The first entry cites this study. The rest are the primary standards and
% sources every claim in it rests on, so a reader can check the grading
% rules rather than take them on trust.
% ─────────────────────────────────────────────────────────────────────────

@techreport{delarosa2026emailauth,
  author      = {De La Rosa Pi{\~n}eiro, Jairo Jos{\'e}},
  title       = {La brecha entre publicar y proteger: autenticaci{\'o}n de
                 correo en M{\'e}xico y Am{\'e}rica Latina},
  institution = {simiriki},
  address     = {Monterrey, M{\'e}xico},
  year        = {2026},
  month       = {8},
  type        = {Measurement study},
  url         = {https://simiriki.com/reportes/autenticacion-correo-2026},
  note        = {14,523 domains measured over public DNS, 14--15 August 2026,
                 across two non-comparable sampling frames. Aggregate dataset
                 under CC-BY-4.0; no per-domain rows are published.}
}

% ── The protocols being measured ────────────────────────────────────────

@techreport{rfc7208,
  author      = {Kitterman, Scott},
  title       = {Sender Policy Framework (SPF) for Authorizing Use of Domains
                 in Email, Version 1},
  institution = {IETF},
  type        = {RFC},
  number      = {7208},
  year        = {2014},
  doi         = {10.17487/RFC7208},
  note        = {{\S}4.6.4 sets the ten-DNS-lookup limit; exceeding it yields
                 permerror, which most receivers treat as unverified rather
                 than as a failure.}
}

@techreport{rfc7489,
  author      = {Kucherawy, Murray and Zwicky, Elizabeth},
  title       = {Domain-based Message Authentication, Reporting, and
                 Conformance (DMARC)},
  institution = {IETF},
  type        = {RFC},
  number      = {7489},
  year        = {2015},
  doi         = {10.17487/RFC7489},
  note        = {{\S}6.3 defines the p= and rua= tags. {\S}6.6.4 defines how
                 receivers apply policy.}
}

@techreport{rfc6376,
  author      = {Crocker, Dave and Hansen, Tony and Kucherawy, Murray},
  title       = {DomainKeys Identified Mail (DKIM) Signatures},
  institution = {IETF},
  type        = {RFC},
  number      = {6376},
  year        = {2011},
  doi         = {10.17487/RFC6376}
}

@techreport{rfc8461,
  author      = {Margolis, Daniel and Risher, Mark and Ramakrishnan, Binu and
                 Brotman, Alexander and Jones, Janet},
  title       = {SMTP MTA Strict Transport Security (MTA-STS)},
  institution = {IETF},
  type        = {RFC},
  number      = {8461},
  year        = {2018},
  doi         = {10.17487/RFC8461},
  note        = {{\S}3.3 and {\S}6 distinguish announcing a policy from
                 enforcing one; testing mode changes no delivery decision.}
}

@techreport{rfc8460,
  author      = {Margolis, Daniel and Brotman, Alexander and Ramakrishnan, Binu
                 and Jones, Janet and Risher, Mark},
  title       = {SMTP TLS Reporting},
  institution = {IETF},
  type        = {RFC},
  number      = {8460},
  year        = {2018},
  doi         = {10.17487/RFC8460}
}

% ── The sampling frames ─────────────────────────────────────────────────

@inproceedings{pochat2019tranco,
  author    = {Le Pochat, Victor and Van Goethem, Tom and Tajalizadehkhoob,
               Samaneh and Korczy{\'n}ski, Maciej and Joosen, Wouter},
  title     = {Tranco: A Research-Oriented Top Sites Ranking Hardened Against
               Manipulation},
  booktitle = {Proceedings of the 26th Annual Network and Distributed System
               Security Symposium (NDSS)},
  year      = {2019},
  doi       = {10.14722/ndss.2019.23386},
  note      = {Frame A. Chosen because it is built for research and citable by
               a permanent identifier, which makes the sample reproducible.}
}

@misc{inegi2026denue,
  author       = {{Instituto Nacional de Estad{\'i}stica y Geograf{\'i}a}},
  title        = {Directorio Estad{\'i}stico Nacional de Unidades
                  Econ{\'o}micas (DENUE)},
  year         = {2026},
  howpublished = {\url{https://www.inegi.org.mx/app/mapa/denue/}},
  note         = {Frame B. Open Mexican government data. Establishments report
                  their own contact email and employee band, which is what
                  makes the size stratification possible.}
}

% ── Grading references ──────────────────────────────────────────────────

@techreport{nist800177,
  author      = {Chandramouli, Ramaswamy and Garfinkel, Simson and Nightingale,
                 Stephen and Rose, Scott},
  title       = {Trustworthy Email},
  institution = {National Institute of Standards and Technology},
  type        = {NIST Special Publication},
  number      = {800-177 Rev. 1},
  year        = {2019},
  doi         = {10.6028/NIST.SP.800-177r1}
}

@misc{m3aawg2020,
  author       = {{M3AAWG}},
  title        = {M3AAWG Email Authentication Recommended Best Practices},
  year         = {2020},
  howpublished = {\url{https://www.m3aawg.org/sites/default/files/m3aawg-email-authentication-recommended-best-practices-09-2020.pdf}}
}