tmailrWriting
Notes on email privacy and deliverability
32 articles on keeping your address private, getting mail delivered, and testing it properly. Most of it comes from things that broke while building this, which is the only reason any of it is worth reading.
Written from things that actually broke · No filler, no SEO padding
Browse by topic
RSS02 Aug 2026Why sites block disposable email, and where an alias differsThe "this email provider is not allowed" wall is a blocklist doing its job badly. Here is how a form decides your address is disposable, and the honest difference between a throwaway inbox and a masked alias.3 min31 Jul 2026Most disposable email is not private at allOn many throwaway-mail sites, anyone who types your address can read your inbox. That is not a bug in those products, it is how they are built.2 min31 Jul 2026Testing signup emails in CI without a real mailboxSleep-and-hope is why your email tests are flaky. Here is the shape that is not.2 min31 Jul 2026Rate limiting on the wrong axis is worse than nonePer-IP limits punish shared offices and mobile networks while doing nothing to an attacker who rotates addresses for pennies.2 min31 Jul 2026When two safety checks hide each otherA debugging story: two independent gates, each refusing for its own reason, and a day spent proving the wrong one was responsible.2 min31 Jul 2026The feature works. Nobody can tell.Three times in one product we built a correct mechanism and forgot to tell anyone it had fired.2 min30 Jul 2026What a masked email alias actually doesAn alias is not a second mailbox. It is a valve on your real one, and understanding the difference tells you when it helps and when it does not.3 min30 Jul 2026Webhook signatures, done properlyA shared secret in a header is not a signature. Here is what to send, what to check, and the two mistakes almost everyone makes on the receiving end.2 min29 Jul 2026SPF, DKIM and DMARC in plain EnglishThree records, three different jobs, and one relationship between them that explains almost every "why is my mail in spam" question.3 min28 Jul 2026Why forwarded mail lands in spamForwarding breaks SPF every single time, by design. What keeps forwarded mail out of the spam folder is DKIM surviving the trip, and that is easy to break.3 min27 Jul 2026Plus addressing: useful, and easier to strip than you thinkyou+shop@gmail.com is a fine way to label mail and a poor way to hide anything.2 min26 Jul 2026How to read email headers without guessingReceived lines read bottom to top, Authentication-Results is the verdict, and the timestamps tell you who was slow.3 min25 Jul 2026MTA-STS and TLS-RPT, and when they are worth itSMTP encryption is opportunistic by default, which means it is trivially downgraded. These two records are the fix, and one of them is nearly free.2 min24 Jul 2026Why a good mail server refuses instead of bouncingAccepting a message you cannot deliver turns you into a spam cannon aimed at whoever was forged as the sender.2 min23 Jul 2026Use a subdomain, unless you really mean itPointing your main domain’s MX at a new service takes over all of its mail. A subdomain gets you the same feature with none of the risk.2 min22 Jul 2026One-time codes are not secret in transitA six-digit code sent by email is protected by your mailbox, and by nothing else along the way.2 min21 Jul 2026What actually happens when you press unsubscribeFor a legitimate sender it works and you should use it. For the other kind it is a delivery confirmation.2 min20 Jul 2026Catch-all addresses are a spam magnetAccepting anything@yourdomain feels convenient and quietly makes you the easiest target on the internet.2 min19 Jul 2026Getting to DMARC p=reject without breaking your mailThe policy is the easy part. Finding everything that sends as you is the work.3 min18 Jul 2026Designing a signup form that does not leak who is registered"That email is already taken" is a feature request and a privacy hole, and you usually have to pick.2 min17 Jul 2026How long should a temporary inbox live?Long enough for a slow verification email, short enough that it is genuinely gone.2 min16 Jul 2026The test address in your CI belongs to somebodytest@example.com is reserved. test@gmail.com is a real person, and your pipeline has been mailing them for months.2 min15 Jul 2026Why your alias provider should not rewrite your mailEvery change a forwarder makes to a message is a change you have to trust, and one more way the sender’s signature can break.2 min14 Jul 2026Sending reputation is per IP and per domain, and they are not the sameMoving to a new IP does not reset your domain’s history, and a clean domain will not save a bad IP.2 min13 Jul 2026What to check before your first campaignA short list that catches most of what goes wrong on a first send.2 min12 Jul 2026Shared team inboxes and the things that go wronginfo@ is where messages go to be everybody’s problem and therefore nobody’s.2 min11 Jul 2026Null MX: telling the world your domain does not receive mailIf a domain only sends, say so. It stops senders queueing for days and reduces what you get backscattered.2 min10 Jul 2026What a forwarder should refuse to carryForwarding an executable to somebody’s real mailbox is not neutrality.2 min09 Jul 2026The bulk sender rules, summarisedWhat the large providers now require, and which parts have real teeth.2 min08 Jul 2026What a mail service should tell you it storesRetention promises are easy to write and easy to quietly not keep.2 min07 Jul 2026When not to use a temporary addressIt is the wrong tool more often than the sites promoting it will tell you.2 min
