Why Email Forwarding Breaks Everything
SPF dies on the first relay. DKIM survives until a mailing list edits the message. Then DMARC turns a 40-year-old nuisance into bounced mail. A tour of email's most reliably broken feature.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
DNS TTL: What It Promises vs What Resolvers Actually Do
You set a TTL of 300 expecting changes in five minutes. Then traffic keeps hitting the old IP for an hour. TTL is not a schedule — it's a hint passed down a chain of caches that each reserve the right to ignore you.
DKIM Alignment: The Part Everyone Gets Wrong
A valid DKIM signature does not mean DMARC passes. The signature proves a domain signed the mail — alignment decides whether that domain is allowed to speak for your From address.
Homograph Attacks: When the Domain Name Is a Lie
In 2017 a researcher registered a domain that displayed as apple.com in three major browsers, served over valid HTTPS. Every character was Cyrillic. The reason it's hard to fix is older and stranger than the bug itself.
Why Your Browser Trusts 150 Certificate Authorities
Any one of ~150 certificate authorities can mint a valid cert for your domain. Your security is the weakest of all of them. Here's why it mostly works anyway.
We Rebuilt TCP on Top of UDP and Called It QUIC
QUIC is reliable, ordered, congestion-controlled, and encrypted — everything UDP refuses to be. So why build it on UDP? Because UDP was the only new-protocol-shaped hole left in the internet's plumbing.
The 13 Root Servers Myth
Everyone says there are 13 DNS root servers. There are about 2,000. The number 13 is frozen into the internet because of a packet-size limit nobody worries about anymore — and the way that contradiction got resolved is one of the better infrastructure hacks ever shipped.
Why DNS Uses UDP (and When It Doesn't)
DNS runs the busiest request-response system on the internet on top of a transport that doesn't promise your packet will arrive. That wasn't a shortcut. It was the right call — until the answers got too big.
How They Know You're a Bot
You can type any browser you like into your User-Agent string. It's the one field nobody trusts — because everything underneath it, the TLS handshake and the HTTP/2 settings, was written by your libraries, not by you.
CDNs Are a Single Point of Failure
CDN consolidation means a single outage takes down thousands of sites. We traded distributed resilience for centralized convenience.
DNS-over-HTTPS Changed Nothing (and Everything)
DoH wraps DNS queries in HTTPS. Same questions, same answers, different transport. The technical change is simple. The political implications are enormous.
How CDN Cache Poisoning Works
CDN cache poisoning tricks a CDN into caching a malicious response and serving it to all subsequent visitors. One weird request, a lot of collateral.