Email Authentication Stopped Being Optional
For twenty years SPF, DKIM, and DMARC were advice you could ignore. Then in fourteen months Gmail, Yahoo, and Outlook made them the price of admission — without changing SMTP by a single byte.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Port 25: The Day ISPs Gave Up on Email Federation
You cannot run a mail server from your home internet connection. The port SMTP was born on in 1982 is blocked on most consumer networks — and that quiet, entirely justified defense is also the thing that killed email as a peer-to-peer system.
SPF ~all vs -all: The Softfail Epidemic
A great many domains end their SPF record with ~all, which tells receivers to accept mail that fails. It's the safe default that quietly guarantees SPF can't stop spoofing on its own.
DKIM Replay: A Valid Signature Is Not Consent
In April 2025, phishing emails arrived from no-reply@google.com with a valid Google DKIM signature and a DMARC pass. Nothing was forged. That's the problem with DKIM.
BIMI: Is the Brand Logo Worth $1,000 a Year?
The logo in your inbox costs four figures a year — not because the protocol is expensive, but because two mailbox providers decided a certificate authority should stand between you and a picture.
SMTP Smuggling: Forged Email That Passed SPF and DMARC
In December 2023 a researcher sent forged email from domains like microsoft.com that still passed SPF and DMARC. He didn't break the authentication. He made the receiving server read one message as two.
"Just Add DMARC" Is Terrible Advice
Publishing a DMARC record is the easy 5%. The advice skips the part that actually stops spoofing: alignment, reading the reports, and the slow walk to enforcement.
Email Is More Secure Than Slack
Everyone treats Slack as the modern, secure successor to email. But on Slack's top plans, an org owner can export every DM you ever sent — and, if retention is set to keep them, your edits and deletions too — and Slack holds the plaintext to do it. Email's transport is a 1982 disaster, and yet the thing it gives you that Slack structurally can't is the one that matters: custody. Here's the case for the medium nobody defends.
Email Is Unfixable
SMTP was designed in 1982 for a network where everyone trusted everyone. Every security property we've wanted since — knowing who sent a message, encrypting it in transit — has been bolted on as an optional patch on top of a protocol that can't be replaced. That's not a bug we haven't fixed yet. It's the shape of the thing.
DANE: The Protocol That Failed on the Web and Won in Email
Everyone agrees DANE is dead — a beautiful protocol stranded behind DNSSEC that nobody deployed. That verdict is American. In the Netherlands it's mandatory, Microsoft validates it in Exchange Online, and on the web it really is dead. Same protocol, three fates.
MTA-STS: The Email Security Protocol Nobody Knows
SMTP encryption has a hole you can drive a truck through: any attacker in the path can strip STARTTLS and read the mail in cleartext. MTA-STS closes it. Then it makes you host a web page to do so, which is why almost nobody bothered.
How SMTP Relay Actually Works in 2026
In 1982 every mail server relayed for anyone — that was the design. Now relaying for a stranger gets you blocklisted before lunch. The word 'relay' survived. Everything underneath it inverted.