Paul O'Brien

Data breaches don’t just leak passwords — they expose email addresses that quietly tie together your digital life. Here’s how Have I Been Pwned helps you understand the risk.

Gmail didn’t become the world’s default inbox by accident. This piece explores how scale, design, and ecosystem beat privacy-first ideals.

Fastmail in 2026 is a paid, standards-first email service built for portability, reliability, and long-term control — not encryption maximalism or platform lock-in.

Tuta Mail (formerly Tutanota) remains one of the most privacy-focused email services in 2026, prioritising maximum encryption and reduced metadata exposure over convenience. This review explains the trade-offs, who it suits, and when Proton or StartMail may be a better fit.

Spam didn’t disappear — it was pushed out of sight. Reputation systems like Spamhaus reshaped email abuse at internet scale, trading noisy volume for quieter, more dangerous attacks. This is the infrastructure that keeps email usable — and the compromises it relies on.

DMARC defines what happens when email authentication fails, turning SPF and DKIM results into clear policy decisions that protect domains from spoofing and abuse.

SPF doesn’t verify who sent an email — it only confirms that a server was allowed to deliver it. That distinction explains why SPF passes during phishing, fails during forwarding, and can’t be treated as a trust signal on its own.

Email authentication relies on SPF, DKIM, and DMARC — a set of interlocking systems — but most people misunderstand what they really do, and what they don’t protect.