Paul O'Brien

Tutanota takes an uncompromising approach to email privacy — encrypting more data, reducing metadata exposure, and accepting real trade-offs in usability to minimise risk in 2026.

DMARC defines what happens when email authentication fails, turning SPF and DKIM results into clear policy decisions that protect domains from spoofing and abuse.

DKIM (DomainKeys Identified Mail) doesn’t verify who sent an email. It verifies that the message hasn’t been altered since it was signed, and that a domain takes responsibility for its contents. Understanding DKIM means understanding what it proves — and what it deliberately ignores.

SPF doesn’t verify who sent an email — it only confirms that a server was allowed to deliver it. That distinction explains why SPF passes during phishing, fails during forwarding, and can’t be treated as a trust signal on its own.

Spam didn’t disappear — it was pushed out of sight. Reputation systems like Spamhaus reshaped email abuse at internet scale, trading noisy volume for quieter, more dangerous attacks. This is the infrastructure that keeps email usable — and the compromises it relies on.

Email authentication relies on SPF, DKIM, and DMARC — a set of interlocking systems — but most people misunderstand what they really do, and what they don’t protect.

Privacy rarely fails through dramatic hacks. It erodes quietly as the same email address is reused across accounts, services, and years of digital life — turning a simple inbox into an identity anchor.

Spam hasn’t disappeared — it has adapted. From mass junk to quiet impersonation, modern spam blends into routine digital life.