Major mailbox providers Google, Yahoo, and Microsoft have raised the bar on email authentication to improve inbox security and reduce spam. If you send email in bulk (especially over 5000 messages a day), these changes likely affect you. Senders Sending < 5k Emails/Day Requirement Status SPF / DKIM SPF or

Since the introduction of RFC9116 in 2022, the security.txt initiative has continued to evolve, aiming to simplify security vulnerability reporting and encourage widespread adoption. The goal remains clear: provide a standardized way for security researchers to report vulnerabilities by placing a text file in the /.well-known/ folder of a

In May 2024, I analyzed the top 1 million domains for BIMI (Brand Indicators for Message Identification) compliance, revealing adoption rates, errors, and trends. Now, with updated data, I revisit this analysis to explore changes in BIMI adoption and implementation quality. This follow-up highlights progress, persistent issues, and new challenges

Introduction In recent years, email administrators have been encountering unusually high rates of DKIM authentication failures in DMARC reports from Microsoft's Outlook.com. These failures are labeled temperror and signify temporary DNS lookup issues, which Microsoft has acknowledged and is working to resolve. In this post, we’ll

Email security is a critical concern for organizations worldwide, with protocols like DANE (DNS-based Authentication of Named Entities) and MTA-STS (SMTP Mail Transfer Agent Strict Transport Security) playing pivotal roles in safeguarding email communications. These protocols help enforce security measures that prevent man-in-the-middle attacks and ensure email transport is conducted

Introduction A common challenge for those delving into email security is grasping the concept of alignment in SPF and DKIM. This blog sheds light on what alignment entails and its critical role in ensuring successful DMARC validation. Authenticated Identifiers Upon receiving an email, the receiving server validates SPF using the

MTA-STS, Google's alternative to DANE, which relies on HTTPS instead of DNSSEC to thwart Man-in-the-Middle downgrade attacks on the opportunistic encryption of SMTP traffic, was introduced over five years ago. We've conducted a comprehensive survey among the top 1 million domains to assess the adoption rate

Google Chrome version 120 now supports Permissions Policy Violation Reports. This feature leverages the Permissions Policy API and Reporting API integration, enhancing developers' control over browser functionalities on their web pages. The Permissions Policy API is a powerful tool that allows developers to specify which features and capabilities are

A new version of the Reporting API [https://web.dev/reporting-api/] has been released that hopefully will get supported across more browsers. The legacy Reporting API (v0) is currently only supported by Chrome and Edge browsers. If you have already implemented the Reporting API v0, you can migrate to the