https://www.ietf.org/archive/id/draft-adams-arc-experiment-c...

It will be interesting to see if Google can be convinced to move away from ARC to something else. Gmail is all about email server reputation these days so they can reliably treat email servers they don't like badly.

If anyone can port their phone number, they should be in theory, allowed to port their email addresses as well.

None of the authentication systems here are helpful enough to allow this. You need a valid way to authenticate people irrespective of whatever provider they are on (not their email domain name)

That means that a standard needs to evolve that allows you sign on the behalf of the hosting provider itself.

That is the most evil part. Finally we will have bots talking to bots, no human in the loop.

All email problems can be solved with GPG, but that ruins Fastmail and other email services business, as they won't be able to read and analyze their users' emails. No ads, no selling user profiles to ad companies, not even teaching AI on user data. This is the kind of future of email I would like to see. Sadly, noone uses GPG and it's quite hard to teach people to do it.

In my experience since phone scammers tend to scam a small subset of numbers like dell, facebook, Microsoft, the Internal Revenue Service, copying this could allow big companies to block a huge number of phishing calls requiring their numbers. Since many calls originate from authenticating carriers now we need to go to the next level and block fake calls.

Those were the days, lol!

Either way, we are getting to a point where offline-2FA will be mandatory for all auth systems and when interacting with another party, it will need something like the above to be sure you are dealing with the correct company.

Here's a big part of the problem right there. Google requires something, it becomes a requirement. In fact, Google's hold on email is a problem in itself. Among other things we need variety. Without it, "Google begins requiring" will be a recurring theme. It's happening again now with mobile phone apps! "Google begins requiring" that you register with them so that the apps you write can be installed on Android phones.

> This shifted authentication from something senders could deprioritize to a basic prerequisite for reaching inboxes.

And later, Google and a few other large players could just prevent individuals and smaller email service providers from being able to send email, at all.

> so the filtering systems can tell where bad content is coming from and avoid hurting the reputation of the wrong parties.

Be ready for people who don't register with the big corporations to be marked as having "bad reputation" and being simply blocked. There might be some technical excuse.

> The inbox of the future will be faster, smarter, and more capable than what most of us use today.

That sounds like the inbox of the future might be controlled by somebody else. I don't like that at all.

For example, I could set rules like “if an email looks like a promotion, move it to the promotions folder.” I could roll my own MCP server sure, but that’s not the direction I want to go.

So on seeing this title, I was a bit worried.

> It’s worth being transparent about what that looks like at Fastmail: we haven’t integrated AI into your inbox, and your mail isn’t being processed by a model in the background. Our MCP server is simply an API endpoint available if you want to connect an AI client of your choosing with your explicit authorization, and nothing changes if you don’t.

Phew.

I don't quite buy this in either direction (although they are both couched as possibilities, which makes it a pretty safe statement). Humans might notice, but years of annual mandated phishing trainings has led me to believe that humans as a whole are generally not great at noticing.

AI agents OTOH mostly do as they are prompted. If the human prompting them tells them to check these things, they will likely check much more consistently than any human. If the prompt doesn't say to check, the agent won't. But that again falls back to what the human might or might not think about.

time and time again it's worth stressing how the Lindy effect directly applies here to email or other layers of the protocol stack.

https://en.wikipedia.org/wiki/Lindy_effect

As one example, I'm now regularly getting phishing email from "The IRS" that always comes from some random account that has been taken over. The latest one was literally from a hotmail account (and my address is dot ca so I'm clearly not subject to the US government). If they can't detect this kind of half-arsed phishing attempt, then things are pretty bleak.

Their customer service was pretty bad when I tried to discuss it. The rep didn't even acknowledge what I wrote. I won't be renewing unless they get this sorted.

Gmail Thinks I'm Stupid, So I Left: https://news.ycombinator.com/item?id=48375016

For instance, I am self-hosted, that without DNS. The email designers were carefull to make the email system work without DNS, that with email addresses with IP literals: mailbox@[x.x.x.x] and mailbox@[ipv6:...] (and I guess once ipv4 is really gone, the ipv6: prefix will be dropped).

This is stronger thas SPF, since as soon as a IP literals in the envelope and the various "from" headers does not match the actually IP from the sending SMTP server, the email is dropped, not even going in spam.

If I send such email to gmail for instance... I get a 'missing a DNS PTR' record, go to hell. How, convenient, to send an email there, you must have bought a DNS domain, knowing perfectly that most registrars nowadays are gated by the web engines of the whatng cartel... which gogol, then gmail does belong to... how convenient, the crime is almost perfect, I don't put that on the account of incompetence, this is beyond that, we are in the realm of toxic malice.

I do presume now they know what they are doing, killing all small tech, or self-hosting is in their agenda of dominant internet corporation.

It's absolutely the worst part of using Fastmail, that they don't clean up in their own house.

I particularly don't understand the constant fanfare around discussions of SPF/DKIM/DMARC. They're widely understood, published RFCs that have been around for at least 10-15 years, some of them longer. They're not obscure folk wisdom passed down through generations of sysadmins, yet I read so many documents and articles that make it sound like a proprietary trade secret that the authors of such articles are graciously revealing to the world.

Not so for Google Workspace. I get more spam and fake invoices and DocuSign contracts than I used to.

Please, Fastmail, don't fuck this up. I have been a happy customer for years. Do not fuck this up with idiotic AI systems. I just want reliable email.

> Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.

https://news.ycombinator.com/newsguidelines.html

... and then the article goes on to talk about SPF, DKIM and DMARC which authenticates only the domain part of the "From" field. So just the reputation of the email server, not the entity that sent you the email. If things get as bad with AI generated deception as suggested by the article this wouldn't be good enough, we would have to start signing our emails again. Emails from entities we don't know would have to be treated with a high level of suspicion.

I am not convinced that things will for sure really get that bad. How can a AI figure out the email addresses of our correspondents? They are not magic.

The new fad is "loop". And any loop should have a trigger. Rather having countless integrations, let all the triggers to got email, and those triggers trigger loops. I feel AI can kick off from personal/shared inboxes to deliver meaningful outcomes

We built a Discord integration so that new emails to our support address would ping us in a Discord channel using the JMAP API. It's only failed to work once that I can recall - and that ultimately ending up being on Discord - not Fastmail.

Just rock solid service all around with no bullshit.

No AI needed, and also no stupid AI summary, as you only get a few legit emails to your inbox, never spam anymore.

[1] https://neomd.ssp.sh

Big title, little content.

Another subscription for software- and people outside HN hate paying for software- when outlook, apple and Gmail exist?

It's important that they're secure.

Is it possible to have E2E encryption on emails?