Why Email Forwarding Breaks Everything
SPF dies on the first relay. DKIM survives until a mailing list edits the message. Then DMARC turns a 40-year-old nuisance into bounced mail. A tour of email's most reliably broken feature.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
DKIM Alignment: The Part Everyone Gets Wrong
A valid DKIM signature does not mean DMARC passes. The signature proves a domain signed the mail — alignment decides whether that domain is allowed to speak for your From address.
DMARC Adoption: Still Decorative in 2026
More than half of the domains that 'have' DMARC don't enforce it — usually they sit at p=none, which means monitor but don't enforce. It's a smoke detector without a siren.
Email Authentication: How Many Domains Actually Have All Five?
SPF, DKIM, DMARC, MTA-STS, BIMI — five standards, twenty years, and nobody can hand you a clean count of the domains that have all five. Every partial measurement points the same way.
The SPF 10-Lookup Limit: A 20-Year-Old Mistake
RFC 7208 limits SPF to 10 DNS lookups. Exceed it and your email authentication silently breaks. The limit made sense in 2006. It doesn't anymore.
Two-Factor Authentication Doesn't Solve Phishing
2FA stops credential stuffing. It barely slows down the real-time phishing proxies that are actually stealing sessions in 2026.
Why Email Authentication Needs Five Protocols
SPF, DKIM, DMARC, BIMI, MTA-STS — email keeps stacking protocols on a 40-year-old system instead of replacing it. Here's why.