SPF doesn’t verify who sent an email — it only confirms that a server was allowed to deliver it. That distinction explains why SPF passes during phishing, fails during forwarding, and can’t be treated as a trust signal on its own.
Email authentication relies on SPF, DKIM, and DMARC — a set of interlocking systems — but most people misunderstand what they really do, and what they don’t protect.
Privacy rarely fails through dramatic hacks. It erodes quietly as the same email address is reused across accounts, services, and years of digital life — turning a simple inbox into an identity anchor.
Spam hasn’t disappeared — it has adapted. From mass junk to quiet impersonation, modern spam blends into routine digital life.
Zero-access architecture changes who can read your email by design. This piece explains what it really means, how it differs from standard encryption, and why the trade-offs matter long term.
Email addresses tend to outlive the services behind them. This piece explores why using your own domain for email reduces lock-in, ages better than free inboxes, and gives you long-term control over an identity most people never think to own.
DKIM (DomainKeys Identified Mail) doesn’t verify who sent an email. It verifies that the message hasn’t been altered since it was signed, and that a domain takes responsibility for its contents. Understanding DKIM means understanding what it proves — and what it deliberately ignores.
Free email feels effortless, but the real cost often shows up later. This piece explores the hidden trade-offs between free and paid email — from incentives and lock-in to control, privacy, and long-term trust.
