Writing
30 articles on email privacy, deliverability and testing. Much of it comes from things that went wrong while building this, which is the only reason any of it is worth reading.
Privacy
Keeping your real address out of other people’s databases.
Most disposable email is not private at all
On many throwaway-mail sites, anyone who types your address can read your inbox. That is not a bug in those products, it is how they are built.
4 min read →What a masked email alias actually does
An alias is not a second mailbox. It is a valve on your real one, and understanding the difference tells you when it helps and when it does not.
5 min read →Plus addressing: useful, and easier to strip than you think
you+shop@gmail.com is a fine way to label mail and a poor way to hide anything.
4 min read →One-time codes are not secret in transit
A six-digit code sent by email is protected by your mailbox, and by nothing else along the way.
4 min read →What actually happens when you press unsubscribe
For a legitimate sender it works and you should use it. For the other kind it is a delivery confirmation.
4 min read →Why your alias provider should not rewrite your mail
Every change a forwarder makes to a message is a change you have to trust, and one more way the sender’s signature can break.
4 min read →What a forwarder should refuse to carry
Forwarding an executable to somebody’s real mailbox is not neutrality.
4 min read →What a mail service should tell you it stores
Retention promises are easy to write and easy to quietly not keep.
4 min read →Deliverability
Why mail lands in spam, and what actually fixes it.
SPF, DKIM and DMARC in plain English
Three records, three different jobs, and one relationship between them that explains almost every "why is my mail in spam" question.
6 min read →Why forwarded mail lands in spam
Forwarding breaks SPF every single time, by design. What keeps forwarded mail out of the spam folder is DKIM surviving the trip, and that is easy to break.
5 min read →MTA-STS and TLS-RPT, and when they are worth it
SMTP encryption is opportunistic by default, which means it is trivially downgraded. These two records are the fix, and one of them is nearly free.
5 min read →Why a good mail server refuses instead of bouncing
Accepting a message you cannot deliver turns you into a spam cannon aimed at whoever was forged as the sender.
4 min read →Catch-all addresses are a spam magnet
Accepting anything@yourdomain feels convenient and quietly makes you the easiest target on the internet.
4 min read →Sending reputation is per IP and per domain, and they are not the same
Moving to a new IP does not reset your domain’s history, and a clean domain will not save a bad IP.
5 min read →Null MX: telling the world your domain does not receive mail
If a domain only sends, say so. It stops senders queueing for days and reduces what you get backscattered.
3 min read →The bulk sender rules, summarised
What the large providers now require, and which parts have real teeth.
5 min read →For developers
Testing email properly, in CI and out of it.
Testing signup emails in CI without a real mailbox
Sleep-and-hope is why your email tests are flaky. Here is the shape that is not.
5 min read →Webhook signatures, done properly
A shared secret in a header is not a signature. Here is what to send, what to check, and the two mistakes almost everyone makes on the receiving end.
5 min read →Rate limiting on the wrong axis is worse than none
Per-IP limits punish shared offices and mobile networks while doing nothing to an attacker who rotates addresses for pennies.
5 min read →Designing a signup form that does not leak who is registered
"That email is already taken" is a feature request and a privacy hole, and you usually have to pick.
5 min read →The test address in your CI belongs to somebody
test@example.com is reserved. test@gmail.com is a real person, and your pipeline has been mailing them for months.
4 min read →When two safety checks hide each other
A debugging story: two independent gates, each refusing for its own reason, and a day spent proving the wrong one was responsible.
5 min read →The feature works. Nobody can tell.
Three times in one product we built a correct mechanism and forgot to tell anyone it had fired.
4 min read →Guides
Step by step, with the traps marked.
How to read email headers without guessing
Received lines read bottom to top, Authentication-Results is the verdict, and the timestamps tell you who was slow.
6 min read →Use a subdomain, unless you really mean it
Pointing your main domain’s MX at a new service takes over all of its mail. A subdomain gets you the same feature with none of the risk.
3 min read →Getting to DMARC p=reject without breaking your mail
The policy is the easy part. Finding everything that sends as you is the work.
6 min read →How long should a temporary inbox live?
Long enough for a slow verification email, short enough that it is genuinely gone.
3 min read →What to check before your first campaign
A short list that catches most of what goes wrong on a first send.
5 min read →Shared team inboxes and the things that go wrong
info@ is where messages go to be everybody’s problem and therefore nobody’s.
4 min read →When not to use a temporary address
It is the wrong tool more often than the sites promoting it will tell you.
3 min read →