Since the introduction of RFC9116 in 2022, the security.txt initiative has continued to evolve, aiming to simplify security vulnerability reporting and encourage widespread adoption. The goal remains clear: provide a standardized way for security researchers to report vulnerabilities by placing a text file in the /.well-known/ folder of a

In May 2024, I analyzed the top 1 million domains for BIMI (Brand Indicators for Message Identification) compliance, revealing adoption rates, errors, and trends. Now, with updated data, I revisit this analysis to explore changes in BIMI adoption and implementation quality. This follow-up highlights progress, persistent issues, and new challenges

Introduction In recent years, email administrators have been encountering unusually high rates of DKIM authentication failures in DMARC reports from Microsoft's Outlook.com. These failures are labeled temperror and signify temporary DNS lookup issues, which Microsoft has acknowledged and is working to resolve. In this post, we’ll

Email security is a critical concern for organizations worldwide, with protocols like DANE (DNS-based Authentication of Named Entities) and MTA-STS (SMTP Mail Transfer Agent Strict Transport Security) playing pivotal roles in safeguarding email communications. These protocols help enforce security measures that prevent man-in-the-middle attacks and ensure email transport is conducted

Introduction A common challenge for those delving into email security is grasping the concept of alignment in SPF and DKIM. This blog sheds light on what alignment entails and its critical role in ensuring successful DMARC validation. Authenticated Identifiers Upon receiving an email, the receiving server validates SPF using the

MTA-STS, Google's alternative to DANE, which relies on HTTPS instead of DNSSEC to thwart Man-in-the-Middle downgrade attacks on the opportunistic encryption of SMTP traffic, was introduced over five years ago. We've conducted a comprehensive survey among the top 1 million domains to assess the adoption rate

Google Chrome version 120 now supports Permissions Policy Violation Reports. This feature leverages the Permissions Policy API and Reporting API integration, enhancing developers' control over browser functionalities on their web pages. The Permissions Policy API is a powerful tool that allows developers to specify which features and capabilities are

At URIports, we process a lot of Reporting API intervention reports containing the following violation: Modified page load behavior on the page because the page was expected to take a long amount of time to load Intervention violations can cause unwanted behavior and are visible in the visitors' developer