Guides, tutorials, and updates
Expert insights on email security, disposable email services, API integrations, and DNS management.
Featured
Anti-Abuse Controls That Keep an Alias Service Off the Blocklists
The moment you let users receive mail at throwaway addresses and forward it anywhere, you are running an open-ish relay whose reputation is only as good as your worst 100 users. Here is the boundary-first playbook — SRS, ARC, Rspamd rejection thresholds, FBLs, and auto-ejection — that keeps your forwarding IPs out of Spamhaus.
The DPA and Subprocessor List You Actually Need Before You Outsource Email
Wiring up SES or Postmark takes an afternoon. Being able to answer a DPO's "list every subprocessor that touches our data" request takes a DPA and a subprocessor list you treat as versioned config — not a PDF in a drive. Here is what Article 28 actually requires, mapped to the email stack, with the commands to test it.
All Posts
Encrypting Dovecot Mailboxes at Rest with mail_crypt: Global vs Per-User Keys
LUKS protects nothing on a running mail server — the volume is unlocked 24/7. Dovecot's mail_crypt plugin encrypts the message payloads themselves so the bytes on disk stay ciphertext through backups, snapshots, and RMA'd drives. Here's how to pick between global and per-user keys, wire it without losing data, and migrate a live mailbox with no maintenance window.
Redacting PII From Mail-Server Logs Without Going Blind
Your mail.log is the largest un-audited PII store you run. Here is how to strip identity at the rsyslog layer, pseudonymize with a keyed HMAC, and still debug every delivery — because Postfix already hands you a PII-free correlation key.
KVKK Compliance for Mail Systems Serving Turkish Users
The email address a user types in, and the IPs in your Received: headers and Postfix logs, are personal data under KVKK. That makes any mail operator serving Turkish users a data controller. Here are the three engineering controls — consent, retention, and a 72-hour breach runbook — that actually make you compliant.
Forward and Forget: Architecting a Zero-Retention Email Alias Relay
Most "private" forwarders quietly spool deferred mail to disk and log your subjects, Message-IDs, and recipients for days. Here's how to build an alias relay that provably can't — content transits RAM only, SRS and ARC keep forwarded mail in the inbox, and the only thing on disk is an opaque alias-to-destination row.
Detecting and Blocking Disposable Email at Signup Without Rejecting Real Users
We run a temp-mail service, so here is the uncomfortable truth from the other side: static blocklists lose. Here is a layered, scored pipeline that catches throwaways without torching real customers on Apple Hide My Email or Firefox Relay.
One Unsubscribe Flow That Satisfies CAN-SPAM, GDPR, and Gmail's One-Click at Once
The naive "single unsubscribe link" fails in three silent ways — Gmail ignores an unsigned header, link scanners drain your list on GET, and a row-delete can't prove withdrawal under GDPR. Here's how to build one flow to the strictest common denominator, with the headers, the handler, and the curl tests.
Aliases vs Forwarding vs Full Masking: What Each One Actually Hides
Privacy blogs use "alias", "forwarding", and "masking" interchangeably — but they defend against three completely different adversaries. Here's what leaks at the SMTP, DNS, and header level in each case, and how to pick by the threat you actually face.
GDPR Retention and Deletion Policies for Mail Logs, Queues, and Delivery Events
Every line in your Postfix maillog ties an IP, an envelope sender, and a recipient to a timestamp — that is personal data under GDPR. Here is how to build a per-data-class retention clock, make expiry automatic and provable, and honor erasure without blinding your anti-abuse forensics.
Idempotent, Replay-Safe Webhook Handlers for Delivery, Bounce, and Complaint Events
Mail providers send delivery events at-least-once, out of order, and from anyone who can find your URL. Here's how to build a handler that authenticates, dedupes at the database level, and never lets a late "delivered" resurrect an address that already hit "spam."
XOAUTH2 for IMAP and SMTP: authenticating after app passwords die
App passwords are being retired on a per-provider schedule, and most mail code still authenticates with a static string. Here is the working migration playbook: the exact SASL wire format, the two OAuth flows you actually need, copy-paste token-minting and IMAP/SMTP snippets, and the failure modes nobody documents.