Blog

Practical insights on email deliverability, security, and infrastructure — based on real findings from working with 450+ organizations.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Email Security

Coordinated Subdomain Takeover Campaign Targeting US Universities

April 7, 2026

Attackers are hijacking abandoned .edu subdomains via orphaned CNAME records, serving spam under trusted university domains and exploiting SEO authority.

Email Deliverability

Why Your Platform's Emails Go to Spam: 9 Causes From 100+ Audits

April 1, 2026

Nine reasons emails land in spam — domain reputation, complaint rates, authentication gaps, spam traps, and more — with specific fixes for each.

Email Security

DMARC Enforcement Guide: Moving from p=none to p=reject Without Breaking Email

March 18, 2026

A step-by-step guide to moving your DMARC policy from p=none to p=reject without disrupting legitimate email. Includes common mistakes to avoid.

Email Security

Never Let Your Domain Expire (Hackers Are Watching)

March 13, 2026

An expired domain can become a major security risk. Here’s why you should never let your domain lapse.

Email Deliverability

Why Your Gmail Emails Go to Spam (And How to Fix It)

March 3, 2026

Using Gmail for business emails, especially automations and batch sending, will likely land you in spam. Here’s why and what to do instead.

Email Deliverability

Why Small Batch Emails Can Trigger Gmail Sending Limits

February 25, 2026

Why a Google Drive link in a CRM batch email triggered spam flags and a Gmail sending limit error — and how proper domain authentication fixes it.

Email Security

Google.com Scam Sent via Gmail API - DMARC Passed, No Account Compromise

February 11, 2026

A scam email sent from @google.com passed SPF, DKIM, and DMARC without a compromised account. Here’s what it reveals about modern email threats.

Email Deliverability

Why Routing CRM Emails Through a Third-Party ESP Can Hurt Deliverability

February 4, 2026

A real-world look at whether CRM emails should be routed through a third-party ESP, and why proper infrastructure architecture matters for deliverability.

Email header showing dmarc=fail action=oreject and compauth=none reason=451 — the fingerprint of Microsoft 365 silently overriding a DMARC p=reject policy

Email Security

How Microsoft 365 Silently Overrides DMARC p=reject as oreject

January 29, 2026

Microsoft 365 has a result code that doesn't appear in any DMARC RFC: oreject. When M365 sits behind a third-party gateway, p=reject policies get silently overridden — and Microsoft doesn't report it. Here's the mechanism, why the original M365 Groups framing was incomplete, and the receive-connector lockdown that actually fixes it.

Email Deliverability

How to Handle Bounces and Blocks Properly

January 28, 2026

Why treating all bounces the same is a mistake – and how to properly handle soft bounces, hard bounces, and blocks for better deliverability.

Email Security

2.3 million emails. One exposed API key. $10K bill.

January 13, 2026

How DMARC forensics exposed an API key leak, 2.3M unauthorized emails, and a $10K bill.

Email Security

Backscatter Injection Attacks Exploiting Legitimate Infrastructure

January 8, 2026

Attackers use backscatter emails to bypass filters, harming servers and delivering phishing content.