Blog

Practical insights on email deliverability, security, and infrastructure — based on real findings from working with 450+ organizations.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Newest

Email Security

I Registered the Domain in Cloudflare's DMARC Documentation. 18 Organizations Were Sending Real Reports to It.

April 21, 2026

Cloudflare's DMARC documentation pointed administrators to a publicly registerable domain. We bought it. Eighteen organizations were sending real DMARC aggregate reports to us within weeks — exposing sending IPs, vendors, and infrastructure metadata for their production domains.

Email Security

When ESP Setup Instructions Break Your DMARC Protection

April 16, 2026

Moving to DMARC p=reject doesn't guarantee spoofing protection if your SPF record authorizes an ESP's shared IP pool. MailerLite prescribes exactly this configuration in their setup UI — and the exposure applies to every ESP that requires a root-domain include.

Email Security

Hazy Hawk Hijacked Subdomains at MIT, Harvard, Stanford, and 30+ Other US Universities

April 15, 2026

In early April 2026, I discovered attackers had hijacked subdomains at 34 major US universities — MIT, Harvard, Stanford, UC Berkeley, Columbia, and more — using them to serve spam that Google was actively indexing under trusted .edu domains. Infoblox confirmed the campaign was the work of Hazy Hawk.

Email Deliverability

SendGrid Professional Services vs. Independent Email Deliverability Consulting: How to Choose

April 12, 2026

How to choose between SendGrid Professional Services and an independent deliverability consultant — and when scope should make the decision for you.

Email Security

Cloudflare's DMARC Documentation Exposed an Unregistered Domain And Dozens of Organizations Paid the Price

April 9, 2026

How an unregistered domain in Cloudflare's DMARC documentation silently exposed infrastructure data from dozens of organizations.

Email Security

FinTech AccessPay Exposed Internal Email Infrastructure Data for Years

April 8, 2026

A misconfigured DMARC record sent sensitive email infrastructure data to an unregistered domain, creating a long-term exposure risk.

Email Security

Coordinated Subdomain Takeover Campaign Targeting US Universities

April 7, 2026

Attackers are hijacking abandoned .edu subdomains via orphaned CNAME records, serving spam under trusted university domains and exploiting SEO authority.

Email Deliverability

Email Deliverability Isn’t About Engagement - It’s About Security

April 1, 2026

Email deliverability starts with security, not engagement. Without a strong foundation, nothing else matters.

Email Deliverability

Why Your Emails Are Going to Spam (And How to Fix It)

April 1, 2026

Nine reasons emails land in spam — domain reputation, complaint rates, authentication gaps, spam traps, and more — with specific fixes for each.

Email Deliverability

SendGrid Deliverability Problems: Common Issues and How to Fix Them

March 28, 2026

The most common SendGrid deliverability problems — authentication gaps, suppression mismanagement, IP reputation issues — and how to fix them.

Email Deliverability

Why Email Deliverability Is a Much Higher Barrier Than Getting Into IT

March 26, 2026

Getting into IT is one thing. Keeping emails in the inbox at scale is a completely different challenge.

Email Deliverability

Email Deliverability Audit: What It Is and When You Need One

March 25, 2026

What an email deliverability audit covers, what it typically uncovers, and the key signals that tell you it's time to get one.