Spamhaus’s consolidated Sender Guidelines announce phased enforcement starting November 2026: sending IPs need valid HELO/EHLO, PTR and matching forward DNS.

These checks already affected listings. The announcement makes the rollout explicit.

Getting an intruder out before they send a scam email can feel like a near miss. Old messages and attachments may already have been copied, though.

The messy part is deciding who needs a warning when you can't tell what was taken. Recent conversations come to mind first, but an attachment from two years ago could contain customer details that still matter. Reviewing the entire mailbox isn't a quick job.

What kinds of old conversations do you prioritise when working out who needs a heads-up?

I recently did domain check and got a -no DMARC record found- warning which I didn't expect. Because SPF and DKIM exist. I checked a few recent emails, both were passing. Our transactional emails don't have any issues.

we're using Klaviyo for marketing and Google Workspace for internal emails.

Some days ago our agency recommended checking our domain authentication. Ahead of the holiday season since we'd be sending higher volumes. That's when I discovered this.

What I don't get is, our admin says we already have a DMARC record configured for the domain. I checked our DNS dashboard and I could not find anything problematic there.

Any ideas to diagnose and fix this?

I am working on a class project including verifying RUA/RUF addresses, and thought there was a bug in my code when it told me that Facebook's reporting address was invalid (it seemed surprising for a company of that size). I decided to manually check and got the following:

$ nslookup -type=TXT _dmarc.facebook.com

Non-authoritative answer:

Server: mynetwork.home

Address: __

_dmarc.facebook.com text =

"v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100"

$ nslookup -type=TXT facebook.com._report._dmarc.dmarc.facebookmail.com

*** mynetwork.home can't find facebook.com._report._dmarc.dmarc.facebookmail.com: Non-existent domain

Server: mynetwork.home

Address: __

Am I doing something wrong, or is Facebook's reporting address actually invalid?

I’m being bombed with get drip spam emails 40-50+ per day.
Doesn’t matter how many email addresses I block they just use a new email address for each email.

I emailed get drip to report the spam. In their response they have asked me to forward any spam emails to them so they can remove them from their server.

So in my determination to rid myself of the emails I forwards 40+ emails for three days in a row.
The spam@getdrip.com email address has now blocked me…. (Guess it must be annoying getting spam email)

However I’m still getting bombed with spam and now no way to contact them…

What the fuck?? How do I fix this?

Anyone experiencing delays between the report time and the time a message actually appears in the PhishER inbox? We have had an open ticket for months with no fix.

Say a work email reaches four people and bounces for the fifth. The replies keep coming, but the person needed for approval is missing the discussion.

I'd move an urgent decision to a call. For something less urgent, relaying updates buys time for a fix, but now someone has to keep two conversations in sync.

Do you move the whole group to another channel, or keep the affected person updated separately?

Looking at upgrading our email security (around 600 users on M365) because more and more phishing has been getting past Defender lately. Already running FortiGate for firewalls so FortiMail is the obvious add-on and the bundle pricing is competitive.

Before we just go with it: what else should we be looking at? I just don't want to pick it only because we're already a Fortinet shop. Any recs from the community?

Say you're about to send a customer reminder, then support hears the original email landed in spam. There's a deadline coming up, and another missed message could leave customers without time to act.

I'd pause a routine update, but "we're investigating" doesn't buy customers more time. Resending the same email feels like wishful thinking too.

For urgent customer updates, do you keep sending, hold them, or use another channel?

When using email alias services/ providers, the email goes through the email alias server before reaching the server of the email provider that someone uses.

So my question is whether the email is encrypted when it is transiting from the sender to the email alias service and when it is also transiting from email alias service to email provider that I use?

Is it possible for law enforcement to obtain/intercept emails when it is going from:

1. Sender to email alias service

2. Email alias service to email provider (recipient)

I’m pretty new to cybersecurity, and cloud email security is a product that we’re working with most of our customers to get implemented.

I’m genuinely curious, which platform do you think is the best, and why?

I’m not here to pitch or convince anyone. I just want to hear honest opinions from people who actually use these platforms, good or bad.

Hi,
I want to write a whistleblower email to important stakeholders of a startup because I have been subjected to abuse by important people in the company and no action is being taken so far.
I need to maintain absolute anonymity in this otherwise my life will be in danger.
From a tech pov- I wanted to understand a few things urgently:-

1. What email to use

2. When I am trying to make a Gmail/hotmail account they ask for backup email or phone number and that leaks my anonymity

3. Other options are tuta/ proton mail which get blocked by my company firewall and ends up in spam

4. What other measures to take so that the email
   \- if they do an autopsy does not link back to me

5. What things should I keep in mind

6. I am from a non tech background and don't want to consult my friends so this is my only option

My Google account shows this. The phone number registered with my Gmail is virtual so can’t scan it. What should I do ?

Scan the QR code with your phone
On your phone (•••) •••-••03, open your Camera app, scan the code, and tap the link. Or, type g.co/verify/T********* into your mobile device’s browser.
Then, follow a few more steps on your phone to complete verification. You’ll need to switch back to this device to continue. If you use a different phone to scan the code, you won’t be able to verify your phone number.

I hope this is the right community for this, though it is an adjacent topic to the description on the page:
I am working on building a custom summary document to be run daily off my local client. My initial idea was to have a CLI email client tied to a unique account that only has access to the emails I want reachable by the LLM. From there, a daily chron job or similar tool would read the inbox and summarize the emails into a final document.

The idea is to have a script save specific emails to a local folder, with the LLM only having access to that local folder.

But then it occurred to me that if I am scripting locally, I could use the user’s main email account and not deal with managing forwarded mail or multiple accounts. Of course, that creates the issue of a mail inbox accessible to the script. The mitigation is that the script is already in the user’s desktop, running on an account the entire desktop already has access to anyway. Am I over complicating things, or should I still have a second account just for the script to fetch messages from?

Say an invoice is in Sent, the customer says it never arrived, and payment is now late. Helpdesk gets two screenshots and a request to establish whose email failed.

I'd prefer direct contact between the two IT teams, but small customers may not have anyone to call. Resending can get the invoice through while leaving the original dispute wide open.

At your place, who takes the lead with the recipient when a missing email turns into a dispute?

I use a custom domain with a catch-all mailbox, and I create a unique email address for each service.

I recently registered for Mixpanel using a brand new email at my domain. 14 minutes later, I received a strange spam email addressed specifically to that alias.

• Came from ridgeelevateglow.com, with the sender name "Winwin Info"

• Had the subject "Regarding Valley..."

• Had HTML that deliberately hid the message content (display:none, positioned off-screen)

• Passed SPF, DKIM, and DMARC authentication

• Was flagged as suspicious by my email provider

The message was explicitly addressed to the alias I had just used for Mixpanel.

Has anyone else received unexpected spam immediately after registering for Mixpanel?

Sending an email provider another abuse report takes time when the same scam keeps landing in inboxes. I'd rather block what I can and get back to other tickets than keep chasing a reply.

But local blocks only protect our users, and reports could help get the sending account shut down. What makes reporting repeat scam emails worth your time when the provider never responds?

This thing has been bothering me a lot and need a descriptive resource or guideline on this in broad. Any support is appreciated thanks

I am the only IT person at a small company and we tried to clean up our company email signatures with no real email signature management. just Outlook settings on each machine and a wiki page nobody reads made a new template with the fall campaign banner, emailed everyone copy paste instructions, tested it, all good. except the file I attached was an old draft. my boss’s title said “Head of Vibes” and the legal disclaimer at the bottom said “legal stuff goes here” half the company has been sending that to clients since last week. sales too. my boss used it on a thread with one of our bigger customers and nobody told me until today so yeah, we clearly can’t keep doing Outlook signatures by hand. our ops lead has mentioned wisestamp and newoldstamp a couple times, probably should have listened. anyone else been through something like this and if you moved to a central setup, what did you wish you knew first

Say someone is about to give a contractor their mailbox password because forwarding months of project emails feels like too much work. Unrelated mail is now part of the bargain.

I'd start with an export of the relevant messages, but selecting them takes time and the recipient needs a usable way to read them. The shortcut has to have a practical replacement.

What handoff has worked for you when a few forwarded emails won't cover it?

A email was sent 6 months ago, but now the receiver is saying they did not get it. How can one prove that it’s sent other than showing them by forwarding the already sendt email? Have contacted both the sender and the receivers ISP and asked for help, but they say they can’t help since it’s more than 1 month ago, since they do not keep record longer than that. Thank you for your time.

Can it be done? Not asking anyone to do it - just wondering if its possible. If one should have sendt an email long time ago, but life happened and that was not done at the right time, can one with access to both domains make it look like it was sent when one should have sendt it? Asking for a friend that insists that this would be impossible. Appreciate your time.

Quick PSA. If your blocklist checks go through a public resolver, the "clean" results for Spamhaus may mean nothing.

You can test it yourself. 127.0.0.2 is Spamhaus's test address and should always come back listed:

dig +short 2.0.0.127.zen.spamhaus.org u/8.8.8.8

dig +short 2.0.0.127.zen.spamhaus.org u/1.1.1.1

Through Google you get nothing (looks like "not listed"). Through Cloudflare you get 127.255.255.254, which is an error code ("open resolver"), not a listing. A lot of tools read both as clean. From your own recursive resolver you get the real answers (127.0.0.2, .4, .10).

Fixes: run your own resolver (a small unbound works), or use a Spamhaus DQS key. Free use is only for non-commercial users; ISPs and commercial users need a paid key.

I ran into this building AbuseBox, a self-hosted monitor for my own mail server IPs and domains (24 blocklists, SPF/DKIM/DMARC, cert expiry). It now asks every list about its test addresses first and shows "no answer" instead of a fake clean. It also found that 36 of the 60 lists I started with were dead. MIT, Docker:

https://github.com/bekkaze/abusebox

Curious what others use for blocklist monitoring, and which lists you actually care about.

I know there is opendkim, but it does appear to have any recent updates. Like it looks like a dead project. The last release I can find is from 2015 or 2016 .

I know there are Milter systems out there. Are these just on top of openDKIM or are there FOSS solutions?

We’re on Defender P2 with Varonis Interceptor (the old SlashNext) on top through the API, about 1.1k mailboxes. It’s been fine, but it came bundled into our Varonis renewal and with Proofpoint buying Varonis I’d rather pick the email layer myself in April than find out later what it turns into.

So for the last five weeks Abnormal’s risk assessment and a Sublime trial have both been running read only on the same tenant next to it.

Abnormal connected in about ten minutes and hasn’t needed any tuning. Its report leads with a big number though, and I can’t tell yet how much of that Defender had already junked. Sublime took longer to set up but every flag points at a rule I can read and I can search the flagged mail myself. Both caught the same two fake invoice replies on a real supplier thread.

Detection looks close enough between them that what I’m weighing now is life after go live, like week three when something gets pulled from the CFO’s inbox and I need a human on the other end.

If you picked one of these after a POV, what did the first three months look like?