There are other "security issues" too. One is that you can send email as any other FastMail user, and it won't stop you. SPF passes and DKIM signatures signed

There are other "security issues" too. One is that you can send email as any other FastMail user, and it won't stop you. SPF passes and DKIM signatures signed (even for other customers' custom domains), totally impossible to tell the difference between a legitimate and spoofed message. To be fair, DKIM is a borderline useless technology and doesn't really prove anything, but it still appears to be an intentional policy decision by FM to be "lax". Interestingly enough they do track the real sender in mail headers (which I suspect enables them to mark their own official emails with "verified" badges), but it's a dynamic obfuscated value iirc so it's absolutely worthless for regular users. It kind of makes my stomach churn when I consider that it's trivial for any other FastMail user to impersonate me, but OTOH, it's best not to be under the delusion that email is authenticated, so I'm staying with them. Great service, despite my comments.