WttW: Is .edu a canary?

Word to the Wise just shared another brilliant post:

Several times recently I’ve heard about something unusual happening email delivery-wise at academic domains that was new, and wasn’t being seen at non-academic domains on the same lists. Most recently it was aggressive following of all links in an email at delivery time, seen at several .edu domains, all using the same mail provider. Not that unusual a thing in itself, we know that corporate malware filters have done this for a while. But this seemed more aggressive than just “this mail looks iffy, lets sample a few links and look for malware”, and the new behaviour was only being seen on .edu recipient domains, not on any of the non-academic domains using the same mail provider. If any .edu postmasters can explain, please, do, but my speculation is that one big difference between academia and the corporate environment is how much control the IT security folks have over recipient

Read more here: Is .edu a canary?