R
There is a small, recurring moment of social panic at the bottom of every email you write. You have said the thing. Now you have to decide who you are. Best? Best regards? Thanks? Your name, alone, like a man leaving a note on a windshield? Nothing at all?
Plenty of people have surveyed what we say we do. Almost nobody has counted what we actually do, at scale, in real inboxes. So we did.
We parsed 71,216 real emails — the Git mailing list, Enron's inboxes, two decades of spam — to find out how people really end a message. The formal sign-off you were taught is now, statistically, a fraud signal.
The published research is mostly self-reported, and it is remarkably consistent. A December 2022 survey of 1,005 Americans by the language platform Preply found that gratitude dominates: 80% said they use Thank you, 71% Thanks, and 47% sign with just their name.1 A 2016 HuffPost/YouGov poll of 1,000 US adults put Thanks at 62%, name-or-initials at 46%, Sincerely at 44% and Regards at 22%.2
Ask people what they like, though, and a different hierarchy appears. Perkbox's 2020 survey of 1,928 UK workers found Kind regards the runaway favourite at 69%, with Love the most hated sign-off at 57% — and, revealingly, no sign-off at all rated the second-worst option, at 44%.3
And there is one genuine large-scale measurement in the literature. In 2017 the email tool Boomerang regex-extracted closings from more than 350,000 threads across twenty-odd public mailing list archives and cross-referenced them against reply rates. Gratitude won decisively: Thanks in advance drew a 65.7% response rate and Thanks 63.0%, against 52.9% for Best regards and a 47.5% baseline.4
What none of this tells us is the plain distribution. Boomerang only counted the eight closings it went looking for. The surveys ask people to remember. Nobody has simply opened a very large pile of real email and counted every ending.
We assembled four corpora of raw email text, all publicly available, spanning 27 years and four very different populations: the Git mailing list (44,627 messages, January 2022 to September 2026 — a live, working open-source community); Enron's internal mail (12,091 messages, 1999–2002 — ordinary American corporate correspondence, preserved by federal subpoena); and, as a control group nobody else seems to have used for this, 12,776 spam messages and 1,722 modern phishing emails.
Then we stripped every quoted reply, forwarded block and signature file, so that we were only ever reading words the sender actually typed, and classified the last line.
Among Git list contributors who close at all, 84.7% say some version of thanks. The entire regards family — regards, best regards, kind regards, warm regards combined — accounts for 7.9%. At Enron, twenty years earlier and in a far more hierarchical setting, gratitude still led at 62.9%, with the regards family at 27.3%.
In neither population does formal valediction survive contact with real correspondence. Sincerely, Yours truly and Respectfully together account for 1.3% of human closings across both corpora — 150 messages out of 11,383.
The larger finding is what happens before you get to any of that. Across the Git list, 69.7% of messages have no closing formula whatsoever, and another 10.8% end with a bare name. At Enron the figures are 57.7% and 20.3%.
This is not a modern collapse in manners. It is what workplace email has always looked like the moment you stop asking people to describe themselves. The linguist Joan Waldvogel found exactly this in 2007, analysing 515 workplace emails from two New Zealand organisations: 34% of messages at one had no closing at all, and 59% had no greeting. Her conclusion was that workplace culture predicted the frequency and form of greetings and closings better than relative status, social distance or gender did.5
We included spam and phishing as a throwaway control. It turned out to be the most interesting result in the dataset.
Fraudulent email is dramatically more formal than real email. Among messages that use a closing formula, the regards family accounts for 51.7% of spam and phishing — against 12.5% of human mail. And Sincerely and Yours truly, which barely register among real correspondents at 1.3%, account for 23.8% of fraudulent closings.
Drop from families to single phrases and it sharpens further. Best regards — the specific string in this article's headline — accounts for 3.5% of human closings and 38.7% of fraudulent ones, an eleven-fold gap. In raw counts: 402 human uses across 56,717 messages, against 629 across 14,485 spam and phishing messages. A corpus a quarter the size produced half again as many.
The mechanism is not mysterious. Scam mail is written to a mental model of what a Serious Institution sounds like — a bank, a lawyer, a courier service. That model was assembled from business-writing guides, and business-writing guides still teach Sincerely. Real colleagues, meanwhile, have spent twenty years converging on thanks and silence.
So the register that signals authority in a textbook now signals the opposite in an inbox. Your spam filter has effectively been trained on etiquette advice.
Read across the four corpora, the sign-offs sort into something more like dialects than a politeness scale.
Thanks is the default of people who work together and expect to again. It carries a request or acknowledges one; Boomerang's reply-rate data suggests it also functions as a mild obligation on the reader.4 On the Git list it is 16.1% of all messages and 82.6% of all closings — effectively the only closing that community uses.
Nothing is what a settled relationship looks like. We did not measure first contact against continuation, so treat this as the likeliest explanation rather than a finding: the no-closing rate is highest on the Git list, where most messages are replies inside a thread already in progress.
A bare name is the compromise: a signature without a claim about the relationship. It is the most common non-gratitude ending in both human corpora.
Regards and its variants now mark distance — and, overwhelmingly, mail from people who are not who they say they are. The distance reading is inference: we classified closings, not relationships, so we cannot show first contact against established threads. The fraud gap is the part we measured.
Cheers is small but persistent at 1.6% of human closings, and it is the one closing that reads as a genuine personality choice rather than a register default.
Each message was parsed from raw RFC822 text. We removed quoted lines, forwarded and original-message blocks, patch payloads and everything after the -- signature delimiter, leaving only text the sender composed. The last five non-empty lines were matched against an ordered pattern list, longest form first, so best regards is never counted as best or regards. Messages with fewer than fifteen words of prose — bare attachments, data tables, auto-generated notices — were excluded, as were exact duplicates of substantial messages. Code and raw counts are reproducible from the corpora cited below.
These four corpora are not a sample of world email, and no such sample exists publicly. The Git list is a technical, male-skewed, English-language open-source community; Enron is one American energy company at the turn of the century. Both under-represent exactly the settings — client-facing, junior-to-senior, cross-cultural — where formal closings are most likely to survive. Read the human figures as a floor on formality, not an average.
The Enron release we used is whitespace-tokenised and lowercased, which erases capitalisation as a signal; our patterns are case-insensitive and normalise the tokenisation, but some nuance is gone. The phishing corpus is the smallest at 1,722 messages and is heavily weighted toward campaigns rather than individual authors. We also evaluated and rejected two further corpora: the released Clinton State Department emails, whose extracted body text is OCR fragments interleaved with FOIA release stamps, and a 1990s mailing list archive that leaked mail headers into message bodies. Both would have produced confident, wrong numbers.
Plenty of people have surveyed what we say we do. Almost nobody has counted what we actually do, at scale, in real inboxes. So we did.
We parsed 71,216 real emails — the Git mailing list, Enron's inboxes, two decades of spam — to find out how people really end a message. The formal sign-off you were taught is now, statistically, a fraud signal.
What the surveys say
The published research is mostly self-reported, and it is remarkably consistent. A December 2022 survey of 1,005 Americans by the language platform Preply found that gratitude dominates: 80% said they use Thank you, 71% Thanks, and 47% sign with just their name.1 A 2016 HuffPost/YouGov poll of 1,000 US adults put Thanks at 62%, name-or-initials at 46%, Sincerely at 44% and Regards at 22%.2
Ask people what they like, though, and a different hierarchy appears. Perkbox's 2020 survey of 1,928 UK workers found Kind regards the runaway favourite at 69%, with Love the most hated sign-off at 57% — and, revealingly, no sign-off at all rated the second-worst option, at 44%.3
And there is one genuine large-scale measurement in the literature. In 2017 the email tool Boomerang regex-extracted closings from more than 350,000 threads across twenty-odd public mailing list archives and cross-referenced them against reply rates. Gratitude won decisively: Thanks in advance drew a 65.7% response rate and Thanks 63.0%, against 52.9% for Best regards and a 47.5% baseline.4
What none of this tells us is the plain distribution. Boomerang only counted the eight closings it went looking for. The surveys ask people to remember. Nobody has simply opened a very large pile of real email and counted every ending.
71,216 emails, counted
We assembled four corpora of raw email text, all publicly available, spanning 27 years and four very different populations: the Git mailing list (44,627 messages, January 2022 to September 2026 — a live, working open-source community); Enron's internal mail (12,091 messages, 1999–2002 — ordinary American corporate correspondence, preserved by federal subpoena); and, as a control group nobody else seems to have used for this, 12,776 spam messages and 1,722 modern phishing emails.
Then we stripped every quoted reply, forwarded block and signature file, so that we were only ever reading words the sender actually typed, and classified the last line.
Among Git list contributors who close at all, 84.7% say some version of thanks. The entire regards family — regards, best regards, kind regards, warm regards combined — accounts for 7.9%. At Enron, twenty years earlier and in a far more hierarchical setting, gratitude still led at 62.9%, with the regards family at 27.3%.
In neither population does formal valediction survive contact with real correspondence. Sincerely, Yours truly and Respectfully together account for 1.3% of human closings across both corpora — 150 messages out of 11,383.
Most email doesn't end at all
The larger finding is what happens before you get to any of that. Across the Git list, 69.7% of messages have no closing formula whatsoever, and another 10.8% end with a bare name. At Enron the figures are 57.7% and 20.3%.
This is not a modern collapse in manners. It is what workplace email has always looked like the moment you stop asking people to describe themselves. The linguist Joan Waldvogel found exactly this in 2007, analysing 515 workplace emails from two New Zealand organisations: 34% of messages at one had no closing at all, and 59% had no greeting. Her conclusion was that workplace culture predicted the frequency and form of greetings and closings better than relative status, social distance or gender did.5
The part we did not expect
We included spam and phishing as a throwaway control. It turned out to be the most interesting result in the dataset.
Fraudulent email is dramatically more formal than real email. Among messages that use a closing formula, the regards family accounts for 51.7% of spam and phishing — against 12.5% of human mail. And Sincerely and Yours truly, which barely register among real correspondents at 1.3%, account for 23.8% of fraudulent closings.
Drop from families to single phrases and it sharpens further. Best regards — the specific string in this article's headline — accounts for 3.5% of human closings and 38.7% of fraudulent ones, an eleven-fold gap. In raw counts: 402 human uses across 56,717 messages, against 629 across 14,485 spam and phishing messages. A corpus a quarter the size produced half again as many.
A message signed Sincerely is 15 times more likely to come from our fraud corpora than from a human being writing to a colleague.
The mechanism is not mysterious. Scam mail is written to a mental model of what a Serious Institution sounds like — a bank, a lawyer, a courier service. That model was assembled from business-writing guides, and business-writing guides still teach Sincerely. Real colleagues, meanwhile, have spent twenty years converging on thanks and silence.
So the register that signals authority in a textbook now signals the opposite in an inbox. Your spam filter has effectively been trained on etiquette advice.
What each ending actually means
Read across the four corpora, the sign-offs sort into something more like dialects than a politeness scale.
Thanks is the default of people who work together and expect to again. It carries a request or acknowledges one; Boomerang's reply-rate data suggests it also functions as a mild obligation on the reader.4 On the Git list it is 16.1% of all messages and 82.6% of all closings — effectively the only closing that community uses.
Nothing is what a settled relationship looks like. We did not measure first contact against continuation, so treat this as the likeliest explanation rather than a finding: the no-closing rate is highest on the Git list, where most messages are replies inside a thread already in progress.
A bare name is the compromise: a signature without a claim about the relationship. It is the most common non-gratitude ending in both human corpora.
Regards and its variants now mark distance — and, overwhelmingly, mail from people who are not who they say they are. The distance reading is inference: we classified closings, not relationships, so we cannot show first contact against established threads. The fraud gap is the part we measured.
Cheers is small but persistent at 1.6% of human closings, and it is the one closing that reads as a genuine personality choice rather than a register default.
How we did it, and where it's weak
Method
Each message was parsed from raw RFC822 text. We removed quoted lines, forwarded and original-message blocks, patch payloads and everything after the -- signature delimiter, leaving only text the sender composed. The last five non-empty lines were matched against an ordered pattern list, longest form first, so best regards is never counted as best or regards. Messages with fewer than fifteen words of prose — bare attachments, data tables, auto-generated notices — were excluded, as were exact duplicates of substantial messages. Code and raw counts are reproducible from the corpora cited below.
Limitations
These four corpora are not a sample of world email, and no such sample exists publicly. The Git list is a technical, male-skewed, English-language open-source community; Enron is one American energy company at the turn of the century. Both under-represent exactly the settings — client-facing, junior-to-senior, cross-cultural — where formal closings are most likely to survive. Read the human figures as a floor on formality, not an average.
The Enron release we used is whitespace-tokenised and lowercased, which erases capitalisation as a signal; our patterns are case-insensitive and normalise the tokenisation, but some nuance is gone. The phishing corpus is the smallest at 1,722 messages and is heavily weighted toward campaigns rather than individual authors. We also evaluated and rejected two further corpora: the released Clinton State Department emails, whose extracted body text is OCR fragments interleaved with FOIA release stamps, and a 1990s mailing list archive that leaked mail headers into message bodies. Both would have produced confident, wrong numbers.
Sources
- Preply, "Email Greetings and Sign-Offs", survey of 1,005 US adults aged 18–76, fielded 9 December 2022.
- HuffPost/YouGov, email sign-off poll, 1,000 US adults, fielded 10–11 March 2016. Opt-in online panel weighted to US adult demographics.
- Perkbox Insights, "The most annoying things in an email, ranked", 1,928 UK respondents, published 6 January 2020.
- Boomerang, "How to End an Email", January 2017. 350,000+ threads from 20+ public mailing list archives; eight closings with 1,000+ occurrences each.
- Joan Waldvogel, "Greetings and Closings in Workplace Email", Journal of Computer-Mediated Communication 12(2), 2007. 515 emails from two New Zealand organisations.
- Corpora: Git mailing list mirror; Enron-Spam (Metsis, Androutsopoulos & Paliouras); Phishing Pot.