Blog

Latest stories

Insights and war stories from the inbox trenches.

AI coding subscriptions are cheap now, and email verification is why the free tier has limits

Cline Pass sits near $2.12 for month one with a promo code. Behind every one of those promotions is an email gate, because a discount that anyone can farm is not a discount.

tmail TeamOctober 24, 2026

Read article

ARC: how forwarded mail survives SPF without breaking DMARC

tmail TeamOctober 24, 2026

Bot protection meets email verification: where Turnstile sits in a signup funnel

tmail TeamOctober 24, 2026

Building email testing into CI without the flake

tmail TeamOctober 24, 2026

Explore topics.

All 19 articles, everything we have learned about throwaway inboxes, deliverability, and signup automation.

Catch-all mailboxes: why 'accept everything' is a signal, not a feature

A domain that accepts mail for every possible local part is convenient for testing and diagnostic for abuse. Here is what a catch-all tells an operator, and how to use it deliberately.

tmail TeamOctober 24, 2026

Disposable email blocklists: 9,927 domains, and what they are really telling you

The community blocklist ships 9,927 domains today. Understanding who maintains it, and how it grows, explains why some signups reject throwaway addresses and others do not.

tmail TeamOctober 24, 2026

DKIM key sizes: the 1024-bit floor and the 512-byte DNS ceiling

RFC 6376 sets a hard floor at 1024 bits for long-lived signing keys, and explains why 4096-bit keys often do not fit in a UDP DNS response. Both facts shape what you should actually publish.

tmail TeamOctober 24, 2026

Email header injection: one newline is the whole vulnerability

A subject line that accepts a bare newline lets an attacker add headers — extra recipients, a replaced body. The fix is one validation rule, and most frameworks do not apply it for you.

tmail TeamOctober 24, 2026

MTA-STS and TLS-RPT: what actually gets enforced, and when

MTA-STS is a policy file served over HTTPS, not a DNS record with teeth. The three modes and the max_age integer decide whether a downgrade attack is blocked or just reported.

tmail TeamOctober 24, 2026

One-click unsubscribe: why the DKIM requirement is the hard part

RFC 8058 looks like two headers. The actual requirement is a valid DKIM signature covering both of them, which means the unsubscription path is bound to your signing infrastructure.

tmail TeamOctober 24, 2026