Privacy
Metadata is the real leak
Encrypting the body of a message is the easy part. Who you talk to, when, and how often is far harder to hide.
read >
Email authentication
SPF, DKIM and DMARC in plain language
Three DNS-based mechanisms decide whether your mail is trusted or tossed into spam. Here is what each one actually does.
read >
Threats
Five tells of a modern phishing email
Typos are no longer the giveaway. Attackers write fluent, well-formatted messages. Look for these instead.
read >
Encryption
PGP in practice: what it is good for
End-to-end email encryption has a reputation for being painful. A short, honest look at where it helps and where it does not.
read >
Threats
OAuth Consent Phishing: Reviewing Which Apps Can Read Your Mail
Malicious apps can request mailbox access through a standard OAuth consent screen without ever seeing a password. Learn to recognize these requests and review.
read >
Operations
SMTP Smuggling and Why Strict Parsing Matters
SMTP smuggling exploits disagreement between mail servers about where a message ends. High-level explanation and the defenses that follow.
read >
Threats
QR Code Phishing in Email: How It Works and How to Respond
QR codes in email move a malicious link out of the text that filters inspect and into an image. Here is how the attack works and what to do when one arrives.
read >
Privacy
Threat Modelling Personal Email: A Simple Method for Individuals
A practical threat model for personal email: define what you protect, who might target it, and which controls are worth the effort.
read >
Guides
Sieve Filter Recipes for Sorting, Vacation Replies and Plus Addresses
Working Sieve rules for sorting mail, sending vacation notices and routing plus-addressed mail, with notes on order, testing and common mistakes.
read >
Encryption
Web Key Directory Explained: How Clients Discover Public Keys
Web Key Directory lets mail clients fetch OpenPGP keys over HTTPS from the recipient's own domain, removing most manual key exchange.
read >
Guides
Why IMAP Still Matters: Open Protocols Versus Proprietary APIs
IMAP is an open, decades-old standard that keeps your mail portable across clients and servers. Why it matters, and how to avoid lock-in.
read >
Email authentication
Reading DMARC Aggregate Reports: A Practical Guide
DMARC aggregate (rua) reports show who sends mail as your domain and whether it passes authentication. Here is how to read them.
read >