Spam filtering, scam trends and deliverability, decoded.
The From line gets the scrutiny; Reply-To quietly decides where the answer goes. This is a practical audit for UK teams who want to spot mismatched reply paths in invoice, HR and mailing-list mail before someone helpful sends the wrong thing to the wrong inbox.
SMTP smuggling is a boundary dispute between servers that disagree about where one message ends and the next begins. Here is how the trick works, why UK shared hosting and inherited relays can still be caught out, and how to audit your own mail chain without lobbing malformed SMTP at live users.
SPF looks like a one-line DNS record until your marketing platform, CRM and helpdesk all pile into the same include chain. Here is how UK teams can count the lookups, spot a silent permerror and flatten the record without building a fresh maintenance headache.
HTML attachments don’t behave like documents. They open local pages, pull scripts and hand users to fake logins or QR codes — often after the filter has already waved them through. Here’s a practical 2026 audit for UK tech teams, from attachment policy to archive inspection and user reporting.
Safe-sender lists are meant to stop good mail being binned. In practice they become a museum of old suppliers, overbroad domains and accounts nobody owns. Here’s how to turn your allowlist into a reviewed, expiring guest list rather than a permanent backstage pass.
Scam emails now arrive dressed in local detail: the right council, a real NHS trust, your actual bin day. That specificity feels like proof, but it is usually just cheap data. Here is how to spot a hyper-local lure and audit which details about your organisation are already doing the rounds.
Shared mailboxes like info@ and sales@ are the workhorses of UK small teams, but they often run on shared passwords, forgotten forwarding rules and unnamed access. This health check walks through the people, rules and defences attached to a generic inbox before a phished click turns it into a team-wide problem.
Alias services promise a wall between you and the internet, but most of them are really just forwarding pipes with good branding. Here's how to audit every burner address you've ever created, spot the one that's leaking, and decide whether to keep feeding it or cut it loose.
Quarantine digests are meant to rescue legitimate mail, but their release and allow-sender links are a ready-made phishing template with a filter logo on top. This audit looks at the patterns attackers copy, the pressures they add, and how UK teams can verify links and configure safe lists without handing over a shortcut.
Every domain with a DMARC record is being quietly audited by Gmail, Microsoft and a long tail of receivers — and the results land in a mailbox almost nobody reads. Here's how to turn a month of XML noise into a short list of unauthorised senders, forgotten subdomains and third parties you'd rather not vouch for.
Inbox logos are becoming the visual shorthand for 'this one is fine' — which is exactly why they deserve a second look. BIMI proves a domain has published a record and, usually, that a certificate backs the mark. It does not prove the sender is honest. Here is how to audit yours before a lookalike borrows the trust.
Backscatter is the email equivalent of someone using your address as the return label on a pile of junk post. Here is how UK teams can spot phantom bounces, check whether their domain is being borrowed, and tighten controls without blocking genuine delivery failures.
A clean-looking PDF, a harmless square, and a prompt to use your camera: 2026's quishing lures are designed to jump from a filtered inbox to an unfiltered phone. Here's why attachment sandboxes and URL reputation miss the handoff, and what UK tech teams can actually check.
A mailbox rule that quietly copies accounts@ to a personal Gmail address can turn a perfectly legitimate message into an authentication failure. This is how forwarding changes the envelope, breaks SPF alignment and sometimes shreds DKIM — plus a practical audit for every hidden relay in your domain.
Thread hijacking doesn't ask for your trust — it borrows someone else's. We walk through how a compromised mailbox turns an existing payroll thread into a payment diversion, why your filters wave it through, and the four checks that actually break the chain.
Calendar invites can land in your diary without a trip through the usual link-scanning gauntlet. Here’s why .ics files are a favourite for UK phishing in 2026, and how to audit auto-add across Outlook, Google and your phone.
A flood of newsletter signups can be more than annoying — it can be cover for a password reset, invoice or bank alert. Here is how UK recipients, senders and filtering admins can spot a subscription bomb and stop it without making the mess worse.
Spammers love a borrowed return address. When your domain gets picked as the fall guy, the bounces and angry replies land in your lap — here’s how to tell a joe-job from a real delivery problem and what actually helps.
Out-of-office messages are meant to be helpful, but they can also confirm live inboxes, advertise empty desks and generate backscatter that spammers lap up. Here is how UK teams can audit auto-replies, tighten the rules and write safer wording without sounding like a robot.
Send the identical email to BT, Sky, Virgin Media, TalkTalk, Outlook.com and Gmail and you'll get six different answers — sometimes six different answers on the same afternoon. We built a repeatable test harness to find out which signals each UK provider actually punishes, and what to do when your campaign works everywhere except one ISP.