Security
Just recently discovered in my own inbox: a notice from Google indicating that they’re going to require OAuth access for third party applications connecting to “Gmail, Google Calendar, Contacts via protocols such as CalDAV, CardDAV, IMAP, SMTP, and POP.” Most modern apps support OAuth already, but there are a number of legacy tools out there that do not — anything where you might have configured an app password to link that third party functionality to your Google (Workspace) account. Starting June 15, 2024, Google will remove the allow “less secure access” app password settings from Google Workspace admin. Currently configured apps and passwords should continue to work until September 30, 2024, at which time support for that functionality will be disabled for Google Workspace users. Read more details here. Does this affect you? Impact here likely isn’t broad, and certainly I’m a fan of better security. But I also do
Brian Krebs has a grand writeup on the new ICANN thingy (technical term) meant to help folks standardize requests for access to WHOIS data via a new “Registration Data Request Service” process. I’ll let Brian give you his good overview and history of what happened to WHOIS data (grr, GDPR!) and the negative impact it has had on good guys trying to track and stop bad guys. But at the end of the day, I have to express my doubt that it will actually result in additional meaningful access to WHOIS data. Registrars can opt-out, and there’s nothing here compelling a registrar to respond to certain requests in a certain way. This whole RDRS standardization could just make it easier for registrars to ignore data access requests. So…what was the point of this again? Read it here: ICANN Launches Service to Help With WHOIS Lookups
GPT — Google Postmaster Tools (or Gmail Postmaster Tools) is a truly handy thing for email senders, especially email marketers who need data and deliverability monitoring. It is a reputation dashboard that pulls together IP address reputation, domain reputation, bounce and complaint metrics, and more, all in one handy interface. GPT is domain-based, meaning that you configure it to provide you data on either your return-path or visible from domain, authenticated by way of SPF and DKIM. You tell GPT which domains you want to monitor, and you then prove that you own or have admin access to each given domain by implementing a key string in a TXT record to demonstrate that ownership. Deliverability consultants and marketing managers can use the data to great success — showing proof that whatever changes (strategic, technical, segmentation, etc.) made to a marketing program are showing improvement as measured by the good/bad reputation
The Verge reports on a new change announced by Google: There’s now a good chance they’ll ask you to verify your login when you change certain Gmail settings, adjusting things like IMAP email access or adding email forwarding to a new address. Here’s the details from Google. This is a good thing, meant to prevent stealth account takeovers where you might think everything is fine, but a bad actor could be siphoning mail away without the account’s owner realizing what’s going on. I’m sure it’s going to annoy me, though, since I have a zillion Gmail accounts all with various settings around forwarding and IMAP that I am often modifying. But, I’ll happily put up with it in the name of making Gmail a more secure platform for users.[ H/T: Jennifer Nespola Lantz ]
How does Comcast decide which mail lands in the inbox versus the spam folder? We learn from Comcast’s senior engineer. The post Ask the Expert: Alex Brotman, Senior Engineer, Comcast appeared first on SendGrid.
What are the ins and outs of a DMARC policy? Does every company need a DMARC policy? Learn the answers from a DMARC expert at Valimail. The post Ask the Expert: Marcel Vinson, Sales Director, Valimail appeared first on SendGrid.
Over the past decade, Twilio SendGrid has embraced Transport Layer Security (TLS) encryption as a way to protect outbound emails as these travel between servers. In a digital world rife with cyberattacks, implementing true end-to-end email encryption for sensitive emails has become increasingly necessary. But what exactly does this mean? This post provides an overview […] The post Paranoid Email: End-to-End Encryption Primer appeared first on SendGrid.
Email privacy and security are vital to your business. Learn how to promote email security awareness within your organization. The post Email Privacy and Security for Businesses: Everything to Know appeared first on SendGrid.
Rackspace appears to have suffered a security issue related to their Hosted Exchange mailbox environment, starting on December 2nd. You can find more information here, here and here.From what I can tell, their Hosted Exchange systems make up only a small portion of the overall mailbox provider infrastructure hosted by Rackspace. Doing a quick check against the top 10 million domains suggests that the vast majority of mail traffic to Rackspace is handled by their non-Exchange infrastructure. Less than 1% of the Rackspace-hosted domains in the top 10 million domains point at the affected Exchange services. Rackspace’s MX records typically look like mx*.emailsrvr.com for non-Exchange-using domains, and mex*.emailsrvr.com for Hosted Exchange infrastructure-using customers.Sender impact is thus likely to be small — you’ll see a bit of bouncing at a handful of affected domains, as they’re not able to accept mail at this time. If you’re a mail/IT admin at an
Presentation about DMARC Terry Zink did at 2014 Virus Bulletin conference in Seattle.