9 ms·

The Future of Email

203 points by soheilpro 4mo ago

shevy-java 4mo ago
They really want to kill anonymity. That's a hit piece if ever I saw one - and a very poor, unconvincing attempt at promo. Shame on you, Fastmail.
sverhagen 4mo ago
I find it hard to judge how much, if at all, this will help, but I'm all for email being more secure, to the point that organizations (banks, governments, insurance companies) stop creating walled-email alternatives: please log in to our secure message center, where you can only see our messages poorly formatted, and for a short time, until we permanently delete them. I like that my Inbox is a somewhat-searchable, historical record of my life, and these alternatives break that.
- iLoveOncall 4mo ago
  > I'm all for email being more secure, to the point that organizations (banks, governments, insurance companies) stop creating walled-email alternatives This will literally never happen. Email doesn't support the features that those messaging platforms need to have, such as recalling messages. The security layers are also only on the sender part, not on the receiver part, which banks care a lot more about.
  - superice 4mo ago
    I know this is only tangentially related, but recalling messages is horrible. I hate that so many services will allow people to send me a message, give me a notification with a preview, but then the message gets edited or deleted. If you drop a letter in a physical mailbox, or slide a paper underneath the door, you cannot get it back either. This whole philosophy of 'we allow destruction of messages in a shared chat' needs to stop. The moment things are being sent, both sides are co-owner of that message. Not being able to recall messages is a good thing. I'll settle for a brief edit (not retraction!) window after sending though, say 5 minutes tops. Edit (I realize the irony): banks of course won't give a hoot about the receiver, the power dynamic is inherently not equal.
    - nosioptar 4mo ago
      With banks, I've found that offering to bring the matter up with the FDIC and/or fed regulators moves the balance of power to a less unfair level. "We have to use secure messages" turned into a willingness to use email in less than 6 hours last time I had an issue.
  - Hizonner 4mo ago
    > Email doesn't support the features that those messaging platforms need to have, such as recalling messages. "Need".
- LoganDark 4mo ago
  I love hearing that I received a "secure message", with no further detail. Straight to trash -- I don't read "secure messages". My inbox is probably more secure.
  - Symbiote 4mo ago
    I get secure messages from public authorities and companies in Denmark, which go to my secure 'mailbox' for this purpose. Of course, contracted out to some private company, and they'll probably change the contract again in 5 years. The messages are usually PDFs, which isn't great for accessibility, e.g. using a translation tool.
  - jasode 4mo ago
    The gp isn't talking about spam using "secure message" as bait to open unwanted email. Instead, legitimate companies like banks, healthcare, etc tell users to click on a url link to their "Secure Message Center" to read or submit some critical information. It's often the only way to get the info the users need. E.g. if I open a payment dispute with the bank, the workflow they use is the Secure Message area. I can't just use my normal email client and upload some pdf attachments. Instead, I have to log into my bank website, navigate to their Secure Message area, and then upload the docs there to submit the claim. They also don't send followup status or final resolution in an email. Instead, you log back into the Secure Message area to read the case resolution. Similar for insurance claims. Similar situation for asking a medical imaging center for some mammograms. They will not send those as PDF or JPG attachments directly to your email address. Instead, you log into a secure message area on a healthcare website and download it from there.
    - LoganDark 4mo ago
      > The gp isn't talking about spam using "secure message" as bait to open unwanted email. No, this includes all messages from my doctor/healthcare. It's not mass spam. Theoretically I could want to know what's in the message, but not enough to visit a website I've been logged out of again, perform multi-factor authentication, navigate to the message center and find the message and then back it up manually.
- thefounder 4mo ago
  To have secure email I think html /css should be dropped from email support and the inbox should work on an invite only basis. Basically you should pre-authorize the senders just like you add someone as friend on a social network.
  - Angostura 4mo ago
    So... not e-mail then
    - fc417fc802 4mo ago
      The necessary bits to facilitate that could be added on top of the existing protocol in a manner that doesn't break existing clients. Essentially it amounts to an out of band registration of the expected sender with your own server, likely by means of a short proxy code or phrase. Couple with key exchange to facilitate an E2EE extension at the same time, while also dodging the logistical issue that would otherwise arise when a sender has multiple addresses or the sending address changes.
    - coldtea 4mo ago
      Yeah, because email as a family of protocols never developed different capabilities /s
    - thefounder 4mo ago
      You can call it Secure-Email or RFC-99999
  - jen729w 4mo ago
    > Basically you should pre-authorize the senders This is kinda what 'masked email' services like Fastmail's – of which I am a delighted customer – do. Until you've known the comfort of creating an address; giving it to a service; deciding that you want to end your relationship with them; just deleting that address, without changing your mailbox or infrastructure or archives or anything else … it's kinda life changing. I recommend everyone try it. Also, the chances of a phisher trying to get my BigBank details by sending mail to lonely.chicken6382@spuriously-named-and-unused-other-than-for-email-domain.com are … well, it seems unlikely. I've never felt more secure. For real.
- the_bear 4mo ago
  Those "message centers" aren't just about security, they're also about compliance. For example, insurance companies need to be HIPAA-compliant which requires that they can only send health-related info to other HIPAA-compliant systems, which means signing a BAA (a contract) with those other systems. There's no way to do that with email (your insurance company can't sign a contract with every potential email host in the world, and they don't even know where the email will ultimately end up after they send it) so practically speaking, they're not legally allowed to send any health info via email. It's extremely difficult to accurately identify which emails have health info and which ones don't (even something like a person's name or IP address could count depending on the context) so they just default to sending everything through their message center. No amount of email security could change that.
  - prepend 4mo ago
    Somehow they mail letters with info. Encrypted email wouldn’t require a BAA.
    - b112 4mo ago
      Dollar bills are essentially untracked, good everywhere, secure, work no matter what. Same goes for normal mail, and it's a federal offense to tamper with it. Nothing electronic will ever be secure, unless it is never, ever networked. Networking changes "touch physical thing" into "everyone on the planet plus their bots" can touch it. Even if you pass harsh laws, you need to geogate network connections to only within that legal jurisdiction. Otherwise, it's pointless. The real, true problem is anonymousness. I used to advocate for, now I'm done. The problems anonymity solve, are a gnat compared to the ones it creates. I'm all for ipv8, but with a unique ID in the packet identifying the person directly. I can't drive a car, own a gun, drive a boat, buy explosives, ply many trades, and 100 other things without a license. Maybe unrestricted internet access is in that category, and bad behaviour means it is revoked. The Internet was a toy for a long time. Now it's the backbone of all commerce, industry, personal communication, with life threatening implications at times. Play time is over.
      - 4mo ago
- nosioptar 4mo ago
  Those secure messaging platforms make it damned near impossible to make a backup. I've seen medical clinics delete messages that would have bad for them in court. As such, I tell anyone who sends me one to fuck off and send a real email.
- marysol5 4mo ago
  My bank does a PUSH notification that is "Please log into the app to read an important message", which is usually just my monthly statement or whatever. And then also sends an e-mail, which sometimes I confuse and think is ANOTHER message, and log in again.... It has a "Download this message as a PDF" button, which just takes you to a web-browser wrapper....
- WhyNotHugo 4mo ago
  I called my bank for some info recently. They can't email it to me, but they _can_ send it through postal mail. Should be arriving any time next week. I'm sure there's a sum of compliance reasons why this is not allowed, but it doesn't make any sense at all.
w3ll_w3ll_w3ll 4mo ago
What's the point of the article?
- pbhjpbhj 4mo ago
  I'd say "advertise Fastmail". They have an MCP end-point, they want to market to both AI proponents and critics -- that's about what I learnt from scanning the article.
- reddalo 4mo ago
  Yeah, it's just a simplified explanation of what SPF, DKIM and DMARC are. Nothing new.
- whh 4mo ago
  I feel like I just ate a sandwich made entirely of corporate air.
- dgellow 4mo ago
  As coming from fastmail I expected something more substantial, it seems to be low quality marketing
- Hugsbox 4mo ago
  I've heard nothing but good things about Fastmail, but this article in particular is literally just pointless fluff.
  - reddalo 4mo ago
    Yes this kind of article makes me lose trust in Fastmail
zhouzhao 4mo ago
Bit of a nothing burger. Big title, little content.
- whh 4mo ago
  I was definitely expecting profound insights into the next decade of digital communication...
oakinnagbe 4mo ago
We’re basically outsourcing email judgment to AI, then trying to compensate by strengthening SPF/DKIM. That feels like hardening the locks while handing out more master keys.
- cryo32 4mo ago
  I think there's several things going on at once in that space. This is just their vocalisation of it because it suits them. The thing is Fastmail can't speak with absolute authority about email because Fastmail is not email. It's subordinate to it.
itskokeh 4mo ago
Emails are very important especially at this age of rapidly changing technological landscape. It's important that they're secure. Is it possible to have E2E encryption on emails?
- vbezhenar 4mo ago
  Of course it is possible to have E2E encryption on emails. You can have E2E encryption on everything. Just use `age` and encrypt your message with sender public key. Easy.
  - zikduruqe 4mo ago
    > Easy vbezhenar, this is your grandmother. I just got an email from you with a bunch of gobbledygook and I can't read it. /s If it were that easy, everyone would be doing it.
    - marysol5 4mo ago
      I used to always use GPG, had my keys listed on keybase, which cross references my social media and websites to validate they're me. And there already is the first problem, how do you get and trust a public key? Key servers are chock full of fake keys. Just search Linus Torvalds on there... But even then, the sheer amount of people who'd complain and wonder what the block of base64 data was at the bottom of the e-mail, or the strange attachments I'd have (including signing other attachments) was too much to have to deal with. For the once in a million people who ever looked at key signing...
      - zikduruqe 4mo ago
        I use GnuPG daily and mandate that everyone in our organization do the same. As part of the onboarding process, I have a doc explaining how to install GnuPG, generate keys and how to share their public key in a specific place in our network. Once you force people to do it, it is not terrible once they get the hang of it.
    - 4mo ago
collabs 4mo ago
I was hoping this would be about JMAP.
- LoganDark 4mo ago
  I didn't know what JMAP was but upon looking it up, I agree
  - OJFord 4mo ago
    JMAP's been Fastmail's future of email since circa 2016 iirc; it seems unlikely Google will ever get on board (NIH?) so it's doomed to remain not completely standard and fairly niche/popular but struggling for (technical) support.
    - josephg 4mo ago
      We'll see. I think mass JMAP adoption is really waiting for either apple (mail.app) or google (gmail) to jump on it. My favorite feature of JMAP is that it gives you a single, consistent API endpoint that works for native clients, webmail and programmatic clients (like, backup scripts and things like that). JMAP means you don't have to invent your own REST API for webmail. Unfortunately, gmail, yahoo mail and all the rest predate JMAP. So it doesn't really help them in the same way. It'd be lovely to get thunderbird working with JMAP!
- roenxi 4mo ago
  This was the post where I learned about SPF, DKIM, and DMARC which seems like a nice technical win. It isn't text encryption but it goes to show there is still room to improve on the basic email situation.
internet_points 4mo ago
I've been a happy Fastmail customer for years, and one of the best things about Fastmail has been how they just incrementally make things slightly better, as if they somehow haven't learnt how to enshittify. So on seeing this title, I was a bit worried. > It’s worth being transparent about what that looks like at Fastmail: we haven’t integrated AI into your inbox, and your mail isn’t being processed by a model in the background. Our MCP server is simply an API endpoint available if you want to connect an AI client of your choosing with your explicit authorization, and nothing changes if you don’t. Phew.
arpinum 4mo ago
BIMI certificates cost over $1,000 / yr right now. For me that's a feature. I wish the fallback in my mail client was a big untrusted symbol rather than sender initials when they aren't in my address book.
danielhep 4mo ago
I love fastmail, I switched from Proton a couple years ago after deciding the trade offs to have encrypted email were not worth it, since even if I fully trust Proton, most emails come from or go to AWS, Outlook, or Gmail anyway. I have been extremely happy with the service. Fairly priced, very fast even with a huge inbox, and they don’t add unnecessary features or bloat. I thought I would use my OS’s mail apps but the fastmail app and website are so good I just use that.
- wycy 4mo ago
  What were the tradeoffs with Proton?
  - cianmm 4mo ago
    As a Proton user - the main trade-off for me is that you are forced to use their apps on mobile, and those apps are pretty barebones and (on iOS at least) have none of the bells and whistles of a modern iOS app, such as Home Screen widgets. Since I use my own domain for email, I am considering moving over to another provider once my subscription term is up. I really miss widgets.
  - danielhep 4mo ago
    For me it was search. The proton apps are the only way to access email on mobile, and on them and on their webapp the search barely functioned, even with full text search downloaded. The only way to reliably search my email was with Proton Mail Bridge on desktop, but for some reason it continuously was using CPU on my laptop and of course didn’t work on mobile. If they made a server version that I could put in a docker container on my server it would probably solve most of my problems with Proton, because then I could access it from the Mail app on my phone over IMAP.
  - jabroni_salad 4mo ago
    for me there were two: no caldav support so I couldn't get my next appointment as a widget on my phone. Similarly, your contacts in proton are trapped there and cannot sync with any other system (such as your phone...) limited quantity of aliases compared to fastmail. this is actually a really sticky feature with fm from what I've been seeing. I would have to rename a bunch of accounts or switch to using a catchall to transfer out.
throwwwll 4mo ago
The Future of Email is obsolescence.
orgad 4mo ago
good luck
zazuke 4mo ago
The easiest and best filter is to screen emails. Only emails that were screened in once go to your inbox. It's that easy. HEY.com introduced it, and I can't see email without it; that's why I integrated it into my TUI email client, neomd [1]. Since then, when I get an email from Amazon that lands in my "To Screen" box, I am automatically alerted and know it is potentially spam, because I have approved Amazon and legit emails land in my inbox. Check it out, it's that easy. Neomd works with Fastmail or any other IMAP/SMTP email provider. No AI needed, and also no stupid AI summary, as you only get a few legit emails to your inbox, never spam anymore. [1] https://neomd.ssp.sh https://neomd.ssp.sh
- bradfa 4mo ago
  So the natural extension of this would be plugins which have curated open source allow-lists? Similar to how I trust uBlock Origin's default ad filtering block-lists, I would similarly trust a curated open source allow-list for email domains, and then I would add my own from the "to screen" folder?
  - zazuke 4mo ago
    Oh, that's a great idea. Currently, every user has their own private list (it's just text files). It takes a bit of work initially, as you need to approve each email, but it's totally worth it. And it must be per user IMO, as your friends and family have different emails, so its less about public or legit domain, but more what domain and e-mail YOU trust. But great idea, what i added is the opposite direcrection: showing if a sender used spy pixel. There I used public spylists I found.
- GlibMonkeyDeath 4mo ago
  This is basically where I (and I imagine many others) have landed with the telephone. Anyone not in my contacts goes to voice mail. Made my phone usable again.
  - zazuke 4mo ago
    still not many are doing it with emails. but great point, tough we all still have to pick unknown calls here and there as we expect someone, so with the email screener it's even better, as each email has a sender.
jdw64 4mo ago
These days, it seems that what they call security is just isolating oneself
thelastgallon 4mo ago
Recent discussion: Gmail Thinks I'm Stupid, So I Left: https://news.ycombinator.com/item?id=48375016 https://news.ycombinator.com/item?id=48375016
sph 4mo ago
A lot of nonsense about AI and this The inbox of the future will be faster, smarter, and more capable than what most of us use today Please, Fastmail, don't fuck this up. I have been a happy customer for years. Do not fuck this up with idiotic AI systems. I just want reliable email.
upofadown 4mo ago
>Anyone can put anything in the “From” field of an email. ... and then the article goes on to talk about SPF, DKIM and DMARC which authenticates only the domain part of the "From" field. So just the reputation of the email server, not the entity that sent you the email. If things get as bad with AI generated deception as suggested by the article this wouldn't be good enough, we would have to start signing our emails again. Emails from entities we don't know would have to be treated with a high level of suspicion. I am not convinced that things will for sure really get that bad. How can a AI figure out the email addresses of our correspondents? They are not magic.
- jcgl 4mo ago
  You’re mistaken: DKIM always signs the entire From field. Signing is done on the MTA, so yes, it is “the reputation of the server” like you say, but “server” can be a relatively granular thing here, using different DKIM selectors for different addresses, MTAs, etc.
  - upofadown 4mo ago
    A signature is not authentication in itself. It is only such if the signing entity is in some way restricting what it is willing to sign. The domain part of the email address in the "From" field is so restricted. The signing MTA will only sign domains that it controls. Otherwise it would suffer a loss of reputation. The user part of the address is not so restricted. The name part of the email address is also part of the same signature but is not being authenticated either.
greengreengrass 4mo ago
What's the point of this article? The most I got was "email is here to stay," followed by some discussion of an MCP server for their proprietary mail platform. I particularly don't understand the constant fanfare around discussions of SPF/DKIM/DMARC. They're widely understood, published RFCs that have been around for at least 10-15 years, some of them longer. They're not obscure folk wisdom passed down through generations of sysadmins, yet I read so many documents and articles that make it sound like a proprietary trade secret that the authors of such articles are graciously revealing to the world.
- hliyan 4mo ago
  Agreed. I had some vague hope that this article made it to the HN hope page because someone was saying what needs to be said: that the future of email should be protocols over platforms, as it was in the past. Mail servers and mail clients.
  - layer8 4mo ago
    > HN hope page Nice. ;)
- aquariusDue 4mo ago
  Yeah, it's the same thing with self-hosting email. The technical side is documented and the tradeoffs are well known. It's the up front effort of migration, maintenance and mails landing in spam that gets people down and so on. Though once you get going it's supposed to become easier with time. Also there's a spectrum from Gmail to Fastmail to AWS SES to Wireguard on a VPS that's tunneling to a server running at home. And when the people from both extremes of the spectrum interact they look at each other as if they're from other planets. It's the same for Auth stuff I believe, almost a decade of generic advice like "don't roll your own auth" has lead some people to file it into a tidy corner of their mind labelled "DON'T TOUCH" so most people end up gawking and staring in awe when someone does so and lose all nuance along the way. To be clear I'm advocating for learning how stuff works and playing around with it (time permitting) instead of simply delegating it to the technical equivalent of Higher Powers in perpetuity.
- 4mo ago
TitaRusell 4mo ago
Paying for email will never be the future of email. Another subscription for software- and people outside HN hate paying for software- when outlook, apple and Gmail exist?
- scary-size 4mo ago
  Have been paying for Fastmail for years. It’s actually fast and lets me use my own domain. (And doesn’t shove AI down my throat). Cash well spent.
upofadown 4mo ago
The article makes a reference to the failed ARC (Authenticated Received Chain) proposal which was intended to help DKIM not break email forwarding: https://www.ietf.org/archive/id/draft-adams-arc-experiment-conclusion-00.html https://www.ietf.org/archive/id/draft-adams-arc-experiment-c... It will be interesting to see if Google can be convinced to move away from ARC to something else. Gmail is all about email server reputation these days so they can reliably treat email servers they don't like badly.
thelastgallon 4mo ago
Are there any options left at all to self host email?
- lloeki 4mo ago
  You can absolutely set up SPF, DKIM, and DMARC for yourself, it's really not that hard if your difficulty reference point is self hosting email. I did it like 10 years ago and I don't think it has changed. Self hosting is hard (which is why I just use Fastmail now), but it's not because of that.
- deleted 4mo ago
  [deleted]
- lifty 4mo ago
  Sure, I do it, and many others. Some people say it's hard, but I think it's much easier than it used to be, technically. You have projects like https://stalw.art https://stalw.art which make it quite easy. Single binary setup which covers all functionality you need. Setting up SPF, DKIM and DMARC is also easy. The only thing that remains is IP reputation, but even then, I haven't had major issues. People seem to receive the few emails that I send.
- OJFord 4mo ago
  Tonnes? I don't like to say 'just search for it', but seriously you'll get more out of that than a response here. Personally I use SES for the 'hard' bit, but there's loads of OSS if you want to self-host the actual receiving too. (Sending probably requires more time looking into getting a trustworthy static IP than software. Again, I bypass that by using SES, but that's technically only self-hosting storage & client.)
sylware 4mo ago
email is turning into a walled-garden of big tech. For instance, I am self-hosted, that without DNS. The email designers were carefull to make the email system work without DNS, that with email addresses with IP literals: mailbox@[x.x.x.x] and mailbox@[ipv6:...] (and I guess once ipv4 is really gone, the ipv6: prefix will be dropped). This is stronger thas SPF, since as soon as a IP literals in the envelope and the various "from" headers does not match the actually IP from the sending SMTP server, the email is dropped, not even going in spam. If I send such email to gmail for instance... I get a 'missing a DNS PTR' record, go to hell. How, convenient, to send an email there, you must have bought a DNS domain, knowing perfectly that most registrars nowadays are gated by the web engines of the whatng cartel... which gogol, then gmail does belong to... how convenient, the crime is almost perfect, I don't put that on the account of incompetence, this is beyond that, we are in the realm of toxic malice. I do presume now they know what they are doing, killing all small tech, or self-hosting is in their agenda of dominant internet corporation.
- cryo32 4mo ago
  I think it's more they simply don't register small tech and self-hosting. In time there will be a reckoning though. The geopolitical instability at the moment will see the end of the US dominant services used outside of the US so they will have to work out how to make a not small but balkanised email provider model work again.
  - sylware 4mo ago
    They are doing it slowly, maliciously (they know). On top of that, you add complicit or severely brain-washed political support (look at my country or EU) on technical 'standards'. Fixing that level of corruption/brain washing is now going to hurt bad.
einpoklum 4mo ago
> In early 2024, Google and Yahoo began requiring Here's a big part of the problem right there. Google requires something, it becomes a requirement. In fact, Google's hold on email is a problem in itself. Among other things we need variety. Without it, "Google begins requiring" will be a recurring theme. It's happening again now with mobile phone apps! "Google begins requiring" that you register with them so that the apps you write can be installed on Android phones. > This shifted authentication from something senders could deprioritize to a basic prerequisite for reaching inboxes. And later, Google and a few other large players could just prevent individuals and smaller email service providers from being able to send email, at all. > so the filtering systems can tell where bad content is coming from and avoid hurting the reputation of the wrong parties. Be ready for people who don't register with the big corporations to be marked as having "bad reputation" and being simply blocked. There might be some technical excuse. > The inbox of the future will be faster, smarter, and more capable than what most of us use today. That sounds like the inbox of the future might be controlled by somebody else. I don't like that at all.
- 2000UltraDeluxe 4mo ago
  Disclaimer: I do some work for one of Gmail's competitors. Of all the stuff Gmail imposes on the rest of the world, requiring proper sender authentication was a good thing and we've helped thousands of senders set up proper authentication because of it. Forcing the issue finally got rid of the ridiculous practice of ignoring SPF/DKIM failures and just setting the DMARC record to p=none. None of this changes the fact that Gmail is a problem for so many other reasons, but this specific imposed change was a net benefit for the entire email ecosystem.
- jprjr_ 4mo ago
  Honestly requiring DMARC was overall a good thing. I was an email admin for a university. In the past - each college ran their own email. Before DKIM, before SPF, you'd just have basically random servers on the internet sending email as (school).edu. Tons of random subdomains too. math.(school).edu and so on. Email was eventually centralized but you'd have parts of the university still running their own things. Insisting they're special and can't be brought into the fold. So, we had a lot of stuff out there just not passing authentication. A lot of spammers could just impersonate our domain. We'd go to leadership and say "hey we should really get our act together" - but everything was working. Our emails were still getting out. Hard to justify spending the time, getting various higher-ups within departments to give up their things, and so on. Unless you can get like, the president to back your initiative- universities are very decentralized and it becomes an issue of "do we have the political capital to spend here." The overall relationship between central IT and the various college-based IT departments was terrible, often bordering on combative. Google and Yahoo made it so we could go to leadership and say "people will not get our emails if we don't get this straightened out" and it became a priority. When I left our DMARC reports were showing something like a 99% pass rate when it was previously like, 50. So, I'm glad Google and Yahoo made that call, it gave us the kick in the pants we needed to get our own shit together. I am 100% certain we were not the only org like this. Plus for a small host - where you're just running a single mail server or something - you just need a few things to pass DMARC. A DMARC record, and an SPF record, and for your emails to pass SPF. You technically don't need to do DKIM signing (though I'd still recommend it because that survives automated forwarding).
jgalt212 4mo ago
> The first is AI filtering: the systems that decide what’s spam, what’s phishing, and what deserves your attention. Not so for Google Workspace. I get more spam and fake invoices and DocuSign contracts than I used to.
fiskeben 4mo ago
It's insane that in 2026 signing and encryption of emails still isn't the norm, but as long as the business model of the largest email vendors rely on us not having it, I guess we never will.
- nicce 4mo ago
  None of the big providers want that. Otherwise Microsoft had more difficult to share the Outlook data for 1000 partners.
- jcranmer 4mo ago
  In 2026, pushing for encryption of emails is a sign that you care more about box-checking requirements rather than actual security practices. Encrypted email sounds good--it's encrypted, how can that be bad?--but when you actually work through various threats and see what encrypted email protects against, it's really not much compared to the status quo, and encrypted email also turns out to lose a lot of features. Keep in mind that the baseline is that, when you send an email, it is encrypted from your computer to your email server, your email server to your recipients' email servers, and your recipients' email servers to their computers. The only people other than you and the recipients who can see it are the email servers involved in the middle, so the best you can get with encrypted emails is maybe cutting out some of the entities that have a critical role in the process (and which therefore can't entirely be cut out). In particular, encrypted email leaves all the email headers public, so it's not like the best case here is particularly private. But encrypted email also breaks the ability to do any server-side processing of email, like server-side email filters (okay, not the hugest loss in the world). Or spam processing--no one's come up with a workable solution here, especially given the vast amount of spam that never hits an email folder (the things that get routed to your spam folder are the emails your spam filters aren't sure is spam). Users also expect the ability to log onto their email server's website and just read their email: such webmail is the dominant email client used, and even people like me who almost exclusively use email clients still end up using a webmail client from time-to-time. You can fix this by giving your email server your key... which puts them back on the list of people who can read your email again, oops, you've gained nothing over the status quo. Worse still is the problem of key distribution. To send an email, you need to look up the recipients' keys... and the most practical approach to make that work at scale is probably to ask the mail server what its users' public keys are. The one entity that is guaranteed to be able to intercept literally every message to somebody, and thus is in prime position to offer its own key instead, strip the encryption, and re-encrypt it to the user without anybody else finding out. Alternative approaches like keyservers don't work: the PGP keyserver ecosystem collapsed several years ago when PGP encryption was of interest to fewer than a million users, far less scale than the billions of email users. Encrypted email is a useless pipedream, and not because of the business models of email vendors, but because the architecture of email provides good-enough security today that makes improving on it very challenging without negating the supposed benefits of extra encryption.
eggbrain 4mo ago
I feel we need a "proof of work by human" for emails. Something that could be signed that attests that someone took the time to write the email, not just sent a template / used AI to auto-generate a personal looking email, etc. Sure that could be gamed as well (have an AI write characters one by one to look more human-like), but taking more time usually is a fairly good blocker for spammers / salespersons / etc.
- dgellow 4mo ago
  I would love for a proof of human work to exist, but how would you even do that? It would need to be monitoring the user activity in their email client, which isn't something that can be trusted by a server (and is pretty shady). But that makes me think of Hashcash, that was developed to limit email spam via proof of work, but I don't think that has ever been used in practice: https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash (and of course wouldn't work for the proof of humanness you're talking about).
- deleted 4mo ago
  [deleted]
- dbdr 4mo ago
  What about automated signup confirmation emails, just as one example?
- BatteryMountain 4mo ago
  I want to give my bank my public key (preferable at a branch), so that ANY comms coming from them I can prove it came from them as.
bingemaker 4mo ago
In the world of AI, I think the future of email is deliver-ability. The new fad is "loop". And any loop should have a trigger. Rather having countless integrations, let all the triggers to got email, and those triggers trigger loops. I feel AI can kick off from personal/shared inboxes to deliver meaningful outcomes
Jgrubb 4mo ago
If only there were some interest on the part of Big Telco to solve these types of problems.
jollyjerry 4mo ago
It's frustrating not being able to send email for my hobby projects even if I follow all the rules and have the correct headers. I enjoyed reading jeremyevan's post on self hosting email, but it's only for receive and not send https://code.jeremyevans.net/2021-07-29-running-my-own-email-server.html https://code.jeremyevans.net/2021-07-29-running-my-own-email...
timwis 4mo ago
I read this article and was surprised when I reached the end because the whole thing felt like it was setting the stage for some announcement or new thing. But nothing came..? Forgive me if I'm being thick but what was the takeaway?
- LearnYouALisp 4mo ago
  "A crummy ad??"
  - nickpeterson 4mo ago
    They want you to drink your rich chocolate email.
  - reaperducer 4mo ago
    Downvoters are obviously not fans of A Christmas Story.
- jimbobimbo 4mo ago
  As a fastmail user I'm glad there was no announcement. Every time a company starts telling me about some bright future, this usually means my user experience is about to sink.
  - frereubu 4mo ago
    But there is an announcement, called "The Future of Email", which is a clickbait title that would be much better titled with the last header of the last paragraph: "Email is not going anywhere".
    - riffic 4mo ago
      I thought as well - it seemed like it was poised to say something about JMAP: https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol
  - 4mo ago
carlosjobim 4mo ago
Everybody who has a Fastmail e-mail in their profile here on HN has received several targeted phishing mails with senders who are registered with @fastmail accounts that sound official. And Fastmail doesn't seem to do much about it. It's absolutely the worst part of using Fastmail, that they don't clean up in their own house.
br0ceph 4mo ago
pgp exists, sheesh
daft_pink 4mo ago
A little bit off topic but We need dmarc to prevent phone spoofing. STIR/SHAKEN should adopt the DMARC model from email. The legitimate holder of a phone number should be able to publish a policy declaring that any call claiming to originate from their number without A-level attestation must be blocked by the terminating carrier. Just as domain owners can instruct mail servers to reject unauthenticated email sent in their name, number holders should be able to instruct carriers to reject unauthenticated calls spoofing their numbers. In my experience since phone scammers tend to scam a small subset of numbers like dell, facebook, Microsoft, the Internal Revenue Service, copying this could allow big companies to block a huge number of phishing calls requiring their numbers. Since many calls originate from authenticating carriers now we need to go to the next level and block fake calls.
br0ceph 4mo ago
seems like pgp would solve alot of the issues around auth and confidentiality i think email is fine the way it is
marysol5 4mo ago
E-Mail should have died in the early 2000's. It's an absolute shit communication system and isn't fit for purpose, and wasn't even then....
br0ceph 4mo ago
seems like pgp inside emails would solve alot of the issues around auth and confidentiality i think email is fine the way it is i dont need any more solutions that make it harder to host your own servers email is meant to be self hosted. i feel like commercial email services have their usecases but we should avoid having service providers playing with standards, as their motives might be self serving. we should keep decentralized internet tech as decentralized as possible, with a caution against blocking random senders, as this leads to monopolies blocking their competition and demanding compliance to their agendas.
- inigyou 4mo ago
  How would you get someone's key?
jfb 4mo ago
Postage. Postage. Postage.
NewCzech 4mo ago
In 1993, a friend of mine was working at Apple. I wanted to send him a funny message with a spoofed sender. I just typed "telnet apple.com 25" and then typed in the required commands. Apple.com accepted it and delivered it to my friend with a fake sender. Those were the days, lol!
- monitron 4mo ago
  My friends and I used to do this all the time in that same time period. It was all fun and games until one day I caught one of them spoofing a message from me to president@whitehouse.gov making vague threats. He seemed to think I overreacted when I dove under the desk and unplugged the machine.
vkaku 4mo ago
Counter Point: Until people can migrate their inboxes and steer them to any provider, none of this authentication business seems to hold up actual value at scale. If anyone can port their phone number, they should be in theory, allowed to port their email addresses as well. None of the authentication systems here are helpful enough to allow this. You need a valid way to authenticate people irrespective of whatever provider they are on (not their email domain name) That means that a standard needs to evolve that allows you sign on the behalf of the hosting provider itself.
kaishiro 4mo ago
As a Fastmail user for both personal use, as well as for my business, the best thing I can say about them is that I haven't thought about them in...a decade? We built a Discord integration so that new emails to our support address would ping us in a Discord channel using the JMAP API. It's only failed to work once that I can recall - and that ultimately ending up being on Discord - not Fastmail. Just rock solid service all around with no bullshit.
wakamoleguy 4mo ago
> A person reading a suspicious email might notice that the sender’s domain has an extra character, or that something about the request feels off. An AI assistant scanning your inbox for items that need action may not slow down to check those things. I don't quite buy this in either direction (although they are both couched as possibilities, which makes it a pretty safe statement). Humans might notice, but years of annual mandated phishing trainings has led me to believe that humans as a whole are generally not great at noticing. AI agents OTOH mostly do as they are prompted. If the human prompting them tells them to check these things, they will likely check much more consistently than any human. If the prompt doesn't say to check, the agent won't. But that again falls back to what the human might or might not think about.
ruslan 4mo ago
> The second is AI assistance: tools that summarize your inbox, surface action items, draft replies, and in some cases take actions on your behalf. That is the most evil part. Finally we will have bots talking to bots, no human in the loop. All email problems can be solved with GPG, but that ruins Fastmail and other email services business, as they won't be able to read and analyze their users' emails. No ads, no selling user profiles to ad companies, not even teaching AI on user data. This is the kind of future of email I would like to see. Sadly, noone uses GPG and it's quite hard to teach people to do it.
- BatteryMountain 4mo ago
  Preach. Exactly. We will eventually be forced down this path though, be patient! Upfront key exchange in-person will be the only way left to prove comms are real. GPG is just one path but someone will come along and make it easy on organizational level.
  - ruslan 4mo ago
    Delta Chat is an email client I use and advise to my correspondents, it does GPG stuff quite comfortably. Yet it still requires understanding of the process.
- IncandescentGas 4mo ago
  Fastmail reads or analyzes users email to sell ads? Fastmail trains ai models on their user's email messages? Metadata is more valuable than message content for analysis. GPG solves that how?
  - ruslan 4mo ago
    > Fastmail reads or analyzes users email to sell ads? Fastmail trains ai models on their user's email messages? Even though they have not been caught, it does no mean they are not doing so. We live in the world of zero trust. > Metadata is more valuable than message content for analysis. GPG solves that how? In most cases yes, only From: and To: headers are exposed.
riffic 4mo ago
> Email is not going anywhere time and time again it's worth stressing how the Lindy effect directly applies here to email or other layers of the protocol stack. https://en.wikipedia.org/wiki/Lindy_effect https://en.wikipedia.org/wiki/Lindy_effect
m463 4mo ago
respectfully the title is clickbait, so maybe a more objective one would be better? > Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
havaloc 4mo ago
I really like Fastmail, but I wish they offered a lightweight AI feature. Their filtering system is unmatched, yet I’d love a basic, privacy-focused AI filter powered by a small, private model they run. For example, I could set rules like “if an email looks like a promotion, move it to the promotions folder.” I could roll my own MCP server sure, but that’s not the direction I want to go.
BatteryMountain 4mo ago
We will end up with a situation where all interactions with computers (remote systems), including email, will need an initial step to pair/exchange keys, much like ssh. So when the bank wants to send me email, they can only do so if they have my public key. We should try to make this as frictionless as possible. Or, we generate semi-random email addresses that are short-lived, so that each company I interact with get their own unguesable email address. Either way, we are getting to a point where offline-2FA will be mandatory for all auth systems and when interacting with another party, it will need something like the above to be sure you are dealing with the correct company.
reader9274 4mo ago
We need email end to end encryption. Good to see Google getting into that world, we need Apple and others to join too.
mthoms 4mo ago
I used to love Fastmail, but their spam/phishing filtering (and customer service) have been really poor lately. I don't know if AI is helping or hurting them. My anecdotal experience suggests the latter. As one example, I'm now regularly getting phishing email from "The IRS" that always comes from some random account that has been taken over. The latest one was literally from a hotmail account (and my address is dot ca so I'm clearly not subject to the US government). If they can't detect this kind of half-arsed phishing attempt, then things are pretty bleak. Their customer service was pretty bad when I tried to discuss it. The rep didn't even acknowledge what I wrote. I won't be renewing unless they get this sorted.
deleted 4mo ago
[deleted]

203 points by soheilpro 4mo ago

They really want to kill anonymity. That's a hit piece if ever I saw one - and a very poor, unconvincing attempt at promo. Shame on you, Fastmail.

sverhagen 4mo ago

I find it hard to judge how much, if at all, this will help, but I'm all for email being more secure, to the point that organizations (banks, governments, insurance companies) stop creating walled-email alternatives: please log in to our secure message center, where you can only see our messages poorly formatted, and for a short time, until we permanently delete them. I like that my Inbox is a somewhat-searchable, historical record of my life, and these alternatives break that.

iLoveOncall 4mo ago
> I'm all for email being more secure, to the point that organizations (banks, governments, insurance companies) stop creating walled-email alternatives This will literally never happen. Email doesn't support the features that those messaging platforms need to have, such as recalling messages. The security layers are also only on the sender part, not on the receiver part, which banks care a lot more about.
- superice 4mo ago
  I know this is only tangentially related, but recalling messages is horrible. I hate that so many services will allow people to send me a message, give me a notification with a preview, but then the message gets edited or deleted. If you drop a letter in a physical mailbox, or slide a paper underneath the door, you cannot get it back either. This whole philosophy of 'we allow destruction of messages in a shared chat' needs to stop. The moment things are being sent, both sides are co-owner of that message. Not being able to recall messages is a good thing. I'll settle for a brief edit (not retraction!) window after sending though, say 5 minutes tops. Edit (I realize the irony): banks of course won't give a hoot about the receiver, the power dynamic is inherently not equal.
  - nosioptar 4mo ago
    With banks, I've found that offering to bring the matter up with the FDIC and/or fed regulators moves the balance of power to a less unfair level. "We have to use secure messages" turned into a willingness to use email in less than 6 hours last time I had an issue.
- Hizonner 4mo ago
  > Email doesn't support the features that those messaging platforms need to have, such as recalling messages. "Need".
LoganDark 4mo ago
I love hearing that I received a "secure message", with no further detail. Straight to trash -- I don't read "secure messages". My inbox is probably more secure.
- Symbiote 4mo ago
  I get secure messages from public authorities and companies in Denmark, which go to my secure 'mailbox' for this purpose. Of course, contracted out to some private company, and they'll probably change the contract again in 5 years. The messages are usually PDFs, which isn't great for accessibility, e.g. using a translation tool.
- jasode 4mo ago
  The gp isn't talking about spam using "secure message" as bait to open unwanted email. Instead, legitimate companies like banks, healthcare, etc tell users to click on a url link to their "Secure Message Center" to read or submit some critical information. It's often the only way to get the info the users need. E.g. if I open a payment dispute with the bank, the workflow they use is the Secure Message area. I can't just use my normal email client and upload some pdf attachments. Instead, I have to log into my bank website, navigate to their Secure Message area, and then upload the docs there to submit the claim. They also don't send followup status or final resolution in an email. Instead, you log back into the Secure Message area to read the case resolution. Similar for insurance claims. Similar situation for asking a medical imaging center for some mammograms. They will not send those as PDF or JPG attachments directly to your email address. Instead, you log into a secure message area on a healthcare website and download it from there.
  - LoganDark 4mo ago
    > The gp isn't talking about spam using "secure message" as bait to open unwanted email. No, this includes all messages from my doctor/healthcare. It's not mass spam. Theoretically I could want to know what's in the message, but not enough to visit a website I've been logged out of again, perform multi-factor authentication, navigate to the message center and find the message and then back it up manually.
thefounder 4mo ago
To have secure email I think html /css should be dropped from email support and the inbox should work on an invite only basis. Basically you should pre-authorize the senders just like you add someone as friend on a social network.
- Angostura 4mo ago
  So... not e-mail then
  - fc417fc802 4mo ago
    The necessary bits to facilitate that could be added on top of the existing protocol in a manner that doesn't break existing clients. Essentially it amounts to an out of band registration of the expected sender with your own server, likely by means of a short proxy code or phrase. Couple with key exchange to facilitate an E2EE extension at the same time, while also dodging the logistical issue that would otherwise arise when a sender has multiple addresses or the sending address changes.
  - coldtea 4mo ago
    Yeah, because email as a family of protocols never developed different capabilities /s
  - thefounder 4mo ago
    You can call it Secure-Email or RFC-99999
- jen729w 4mo ago
  > Basically you should pre-authorize the senders This is kinda what 'masked email' services like Fastmail's – of which I am a delighted customer – do. Until you've known the comfort of creating an address; giving it to a service; deciding that you want to end your relationship with them; just deleting that address, without changing your mailbox or infrastructure or archives or anything else … it's kinda life changing. I recommend everyone try it. Also, the chances of a phisher trying to get my BigBank details by sending mail to lonely.chicken6382@spuriously-named-and-unused-other-than-for-email-domain.com are … well, it seems unlikely. I've never felt more secure. For real.
the_bear 4mo ago
Those "message centers" aren't just about security, they're also about compliance. For example, insurance companies need to be HIPAA-compliant which requires that they can only send health-related info to other HIPAA-compliant systems, which means signing a BAA (a contract) with those other systems. There's no way to do that with email (your insurance company can't sign a contract with every potential email host in the world, and they don't even know where the email will ultimately end up after they send it) so practically speaking, they're not legally allowed to send any health info via email. It's extremely difficult to accurately identify which emails have health info and which ones don't (even something like a person's name or IP address could count depending on the context) so they just default to sending everything through their message center. No amount of email security could change that.
- prepend 4mo ago
  Somehow they mail letters with info. Encrypted email wouldn’t require a BAA.
  - b112 4mo ago
    Dollar bills are essentially untracked, good everywhere, secure, work no matter what. Same goes for normal mail, and it's a federal offense to tamper with it. Nothing electronic will ever be secure, unless it is never, ever networked. Networking changes "touch physical thing" into "everyone on the planet plus their bots" can touch it. Even if you pass harsh laws, you need to geogate network connections to only within that legal jurisdiction. Otherwise, it's pointless. The real, true problem is anonymousness. I used to advocate for, now I'm done. The problems anonymity solve, are a gnat compared to the ones it creates. I'm all for ipv8, but with a unique ID in the packet identifying the person directly. I can't drive a car, own a gun, drive a boat, buy explosives, ply many trades, and 100 other things without a license. Maybe unrestricted internet access is in that category, and bad behaviour means it is revoked. The Internet was a toy for a long time. Now it's the backbone of all commerce, industry, personal communication, with life threatening implications at times. Play time is over.
    - 4mo ago
nosioptar 4mo ago
Those secure messaging platforms make it damned near impossible to make a backup. I've seen medical clinics delete messages that would have bad for them in court. As such, I tell anyone who sends me one to fuck off and send a real email.
marysol5 4mo ago
My bank does a PUSH notification that is "Please log into the app to read an important message", which is usually just my monthly statement or whatever. And then also sends an e-mail, which sometimes I confuse and think is ANOTHER message, and log in again.... It has a "Download this message as a PDF" button, which just takes you to a web-browser wrapper....
WhyNotHugo 4mo ago
I called my bank for some info recently. They can't email it to me, but they _can_ send it through postal mail. Should be arriving any time next week. I'm sure there's a sum of compliance reasons why this is not allowed, but it doesn't make any sense at all.

w3ll_w3ll_w3ll 4mo ago

What's the point of the article?

pbhjpbhj 4mo ago
I'd say "advertise Fastmail". They have an MCP end-point, they want to market to both AI proponents and critics -- that's about what I learnt from scanning the article.
reddalo 4mo ago
Yeah, it's just a simplified explanation of what SPF, DKIM and DMARC are. Nothing new.
whh 4mo ago
I feel like I just ate a sandwich made entirely of corporate air.
dgellow 4mo ago
As coming from fastmail I expected something more substantial, it seems to be low quality marketing
Hugsbox 4mo ago
I've heard nothing but good things about Fastmail, but this article in particular is literally just pointless fluff.
- reddalo 4mo ago
  Yes this kind of article makes me lose trust in Fastmail

zhouzhao 4mo ago

Bit of a nothing burger. Big title, little content.

whh 4mo ago
I was definitely expecting profound insights into the next decade of digital communication...

oakinnagbe 4mo ago

We’re basically outsourcing email judgment to AI, then trying to compensate by strengthening SPF/DKIM. That feels like hardening the locks while handing out more master keys.

cryo32 4mo ago
I think there's several things going on at once in that space. This is just their vocalisation of it because it suits them. The thing is Fastmail can't speak with absolute authority about email because Fastmail is not email. It's subordinate to it.

itskokeh 4mo ago

Emails are very important especially at this age of rapidly changing technological landscape. It's important that they're secure. Is it possible to have E2E encryption on emails?

vbezhenar 4mo ago
Of course it is possible to have E2E encryption on emails. You can have E2E encryption on everything. Just use `age` and encrypt your message with sender public key. Easy.
- zikduruqe 4mo ago
  > Easy vbezhenar, this is your grandmother. I just got an email from you with a bunch of gobbledygook and I can't read it. /s If it were that easy, everyone would be doing it.
  - marysol5 4mo ago
    I used to always use GPG, had my keys listed on keybase, which cross references my social media and websites to validate they're me. And there already is the first problem, how do you get and trust a public key? Key servers are chock full of fake keys. Just search Linus Torvalds on there... But even then, the sheer amount of people who'd complain and wonder what the block of base64 data was at the bottom of the e-mail, or the strange attachments I'd have (including signing other attachments) was too much to have to deal with. For the once in a million people who ever looked at key signing...
    - zikduruqe 4mo ago
      I use GnuPG daily and mandate that everyone in our organization do the same. As part of the onboarding process, I have a doc explaining how to install GnuPG, generate keys and how to share their public key in a specific place in our network. Once you force people to do it, it is not terrible once they get the hang of it.
  - 4mo ago

collabs 4mo ago

I was hoping this would be about JMAP.

LoganDark 4mo ago
I didn't know what JMAP was but upon looking it up, I agree
- OJFord 4mo ago
  JMAP's been Fastmail's future of email since circa 2016 iirc; it seems unlikely Google will ever get on board (NIH?) so it's doomed to remain not completely standard and fairly niche/popular but struggling for (technical) support.
  - josephg 4mo ago
    We'll see. I think mass JMAP adoption is really waiting for either apple (mail.app) or google (gmail) to jump on it. My favorite feature of JMAP is that it gives you a single, consistent API endpoint that works for native clients, webmail and programmatic clients (like, backup scripts and things like that). JMAP means you don't have to invent your own REST API for webmail. Unfortunately, gmail, yahoo mail and all the rest predate JMAP. So it doesn't really help them in the same way. It'd be lovely to get thunderbird working with JMAP!
roenxi 4mo ago
This was the post where I learned about SPF, DKIM, and DMARC which seems like a nice technical win. It isn't text encryption but it goes to show there is still room to improve on the basic email situation.

internet_points 4mo ago

I've been a happy Fastmail customer for years, and one of the best things about Fastmail has been how they just incrementally make things slightly better, as if they somehow haven't learnt how to enshittify. So on seeing this title, I was a bit worried. > It’s worth being transparent about what that looks like at Fastmail: we haven’t integrated AI into your inbox, and your mail isn’t being processed by a model in the background. Our MCP server is simply an API endpoint available if you want to connect an AI client of your choosing with your explicit authorization, and nothing changes if you don’t. Phew.

arpinum 4mo ago

BIMI certificates cost over $1,000 / yr right now. For me that's a feature. I wish the fallback in my mail client was a big untrusted symbol rather than sender initials when they aren't in my address book.

danielhep 4mo ago

I love fastmail, I switched from Proton a couple years ago after deciding the trade offs to have encrypted email were not worth it, since even if I fully trust Proton, most emails come from or go to AWS, Outlook, or Gmail anyway. I have been extremely happy with the service. Fairly priced, very fast even with a huge inbox, and they don’t add unnecessary features or bloat. I thought I would use my OS’s mail apps but the fastmail app and website are so good I just use that.

wycy 4mo ago
What were the tradeoffs with Proton?
- cianmm 4mo ago
  As a Proton user - the main trade-off for me is that you are forced to use their apps on mobile, and those apps are pretty barebones and (on iOS at least) have none of the bells and whistles of a modern iOS app, such as Home Screen widgets. Since I use my own domain for email, I am considering moving over to another provider once my subscription term is up. I really miss widgets.
- danielhep 4mo ago
  For me it was search. The proton apps are the only way to access email on mobile, and on them and on their webapp the search barely functioned, even with full text search downloaded. The only way to reliably search my email was with Proton Mail Bridge on desktop, but for some reason it continuously was using CPU on my laptop and of course didn’t work on mobile. If they made a server version that I could put in a docker container on my server it would probably solve most of my problems with Proton, because then I could access it from the Mail app on my phone over IMAP.
- jabroni_salad 4mo ago
  for me there were two: no caldav support so I couldn't get my next appointment as a widget on my phone. Similarly, your contacts in proton are trapped there and cannot sync with any other system (such as your phone...) limited quantity of aliases compared to fastmail. this is actually a really sticky feature with fm from what I've been seeing. I would have to rename a bunch of accounts or switch to using a catchall to transfer out.

throwwwll 4mo ago

The Future of Email is obsolescence.

orgad 4mo ago

good luck

zazuke 4mo ago

The easiest and best filter is to screen emails. Only emails that were screened in once go to your inbox. It's that easy. HEY.com introduced it, and I can't see email without it; that's why I integrated it into my TUI email client, neomd [1]. Since then, when I get an email from Amazon that lands in my "To Screen" box, I am automatically alerted and know it is potentially spam, because I have approved Amazon and legit emails land in my inbox. Check it out, it's that easy. Neomd works with Fastmail or any other IMAP/SMTP email provider. No AI needed, and also no stupid AI summary, as you only get a few legit emails to your inbox, never spam anymore. [1] https://neomd.ssp.sh https://neomd.ssp.sh

bradfa 4mo ago
So the natural extension of this would be plugins which have curated open source allow-lists? Similar to how I trust uBlock Origin's default ad filtering block-lists, I would similarly trust a curated open source allow-list for email domains, and then I would add my own from the "to screen" folder?
- zazuke 4mo ago
  Oh, that's a great idea. Currently, every user has their own private list (it's just text files). It takes a bit of work initially, as you need to approve each email, but it's totally worth it. And it must be per user IMO, as your friends and family have different emails, so its less about public or legit domain, but more what domain and e-mail YOU trust. But great idea, what i added is the opposite direcrection: showing if a sender used spy pixel. There I used public spylists I found.
GlibMonkeyDeath 4mo ago
This is basically where I (and I imagine many others) have landed with the telephone. Anyone not in my contacts goes to voice mail. Made my phone usable again.
- zazuke 4mo ago
  still not many are doing it with emails. but great point, tough we all still have to pick unknown calls here and there as we expect someone, so with the email screener it's even better, as each email has a sender.

jdw64 4mo ago

These days, it seems that what they call security is just isolating oneself

thelastgallon 4mo ago

Recent discussion: Gmail Thinks I'm Stupid, So I Left: https://news.ycombinator.com/item?id=48375016 https://news.ycombinator.com/item?id=48375016

sph 4mo ago

A lot of nonsense about AI and this The inbox of the future will be faster, smarter, and more capable than what most of us use today Please, Fastmail, don't fuck this up. I have been a happy customer for years. Do not fuck this up with idiotic AI systems. I just want reliable email.

upofadown 4mo ago

>Anyone can put anything in the “From” field of an email. ... and then the article goes on to talk about SPF, DKIM and DMARC which authenticates only the domain part of the "From" field. So just the reputation of the email server, not the entity that sent you the email. If things get as bad with AI generated deception as suggested by the article this wouldn't be good enough, we would have to start signing our emails again. Emails from entities we don't know would have to be treated with a high level of suspicion. I am not convinced that things will for sure really get that bad. How can a AI figure out the email addresses of our correspondents? They are not magic.

jcgl 4mo ago
You’re mistaken: DKIM always signs the entire From field. Signing is done on the MTA, so yes, it is “the reputation of the server” like you say, but “server” can be a relatively granular thing here, using different DKIM selectors for different addresses, MTAs, etc.
- upofadown 4mo ago
  A signature is not authentication in itself. It is only such if the signing entity is in some way restricting what it is willing to sign. The domain part of the email address in the "From" field is so restricted. The signing MTA will only sign domains that it controls. Otherwise it would suffer a loss of reputation. The user part of the address is not so restricted. The name part of the email address is also part of the same signature but is not being authenticated either.

greengreengrass 4mo ago

What's the point of this article? The most I got was "email is here to stay," followed by some discussion of an MCP server for their proprietary mail platform. I particularly don't understand the constant fanfare around discussions of SPF/DKIM/DMARC. They're widely understood, published RFCs that have been around for at least 10-15 years, some of them longer. They're not obscure folk wisdom passed down through generations of sysadmins, yet I read so many documents and articles that make it sound like a proprietary trade secret that the authors of such articles are graciously revealing to the world.

hliyan 4mo ago
Agreed. I had some vague hope that this article made it to the HN hope page because someone was saying what needs to be said: that the future of email should be protocols over platforms, as it was in the past. Mail servers and mail clients.
- layer8 4mo ago
  > HN hope page Nice. ;)
aquariusDue 4mo ago
Yeah, it's the same thing with self-hosting email. The technical side is documented and the tradeoffs are well known. It's the up front effort of migration, maintenance and mails landing in spam that gets people down and so on. Though once you get going it's supposed to become easier with time. Also there's a spectrum from Gmail to Fastmail to AWS SES to Wireguard on a VPS that's tunneling to a server running at home. And when the people from both extremes of the spectrum interact they look at each other as if they're from other planets. It's the same for Auth stuff I believe, almost a decade of generic advice like "don't roll your own auth" has lead some people to file it into a tidy corner of their mind labelled "DON'T TOUCH" so most people end up gawking and staring in awe when someone does so and lose all nuance along the way. To be clear I'm advocating for learning how stuff works and playing around with it (time permitting) instead of simply delegating it to the technical equivalent of Higher Powers in perpetuity.
4mo ago

TitaRusell 4mo ago

Paying for email will never be the future of email. Another subscription for software- and people outside HN hate paying for software- when outlook, apple and Gmail exist?

scary-size 4mo ago
Have been paying for Fastmail for years. It’s actually fast and lets me use my own domain. (And doesn’t shove AI down my throat). Cash well spent.

upofadown 4mo ago

The article makes a reference to the failed ARC (Authenticated Received Chain) proposal which was intended to help DKIM not break email forwarding: https://www.ietf.org/archive/id/draft-adams-arc-experiment-conclusion-00.html https://www.ietf.org/archive/id/draft-adams-arc-experiment-c... It will be interesting to see if Google can be convinced to move away from ARC to something else. Gmail is all about email server reputation these days so they can reliably treat email servers they don't like badly.

thelastgallon 4mo ago

Are there any options left at all to self host email?

lloeki 4mo ago
You can absolutely set up SPF, DKIM, and DMARC for yourself, it's really not that hard if your difficulty reference point is self hosting email. I did it like 10 years ago and I don't think it has changed. Self hosting is hard (which is why I just use Fastmail now), but it's not because of that.
deleted 4mo ago
[deleted]
lifty 4mo ago
Sure, I do it, and many others. Some people say it's hard, but I think it's much easier than it used to be, technically. You have projects like https://stalw.art https://stalw.art which make it quite easy. Single binary setup which covers all functionality you need. Setting up SPF, DKIM and DMARC is also easy. The only thing that remains is IP reputation, but even then, I haven't had major issues. People seem to receive the few emails that I send.
OJFord 4mo ago
Tonnes? I don't like to say 'just search for it', but seriously you'll get more out of that than a response here. Personally I use SES for the 'hard' bit, but there's loads of OSS if you want to self-host the actual receiving too. (Sending probably requires more time looking into getting a trustworthy static IP than software. Again, I bypass that by using SES, but that's technically only self-hosting storage & client.)

sylware 4mo ago

email is turning into a walled-garden of big tech. For instance, I am self-hosted, that without DNS. The email designers were carefull to make the email system work without DNS, that with email addresses with IP literals: mailbox@[x.x.x.x] and mailbox@[ipv6:...] (and I guess once ipv4 is really gone, the ipv6: prefix will be dropped). This is stronger thas SPF, since as soon as a IP literals in the envelope and the various "from" headers does not match the actually IP from the sending SMTP server, the email is dropped, not even going in spam. If I send such email to gmail for instance... I get a 'missing a DNS PTR' record, go to hell. How, convenient, to send an email there, you must have bought a DNS domain, knowing perfectly that most registrars nowadays are gated by the web engines of the whatng cartel... which gogol, then gmail does belong to... how convenient, the crime is almost perfect, I don't put that on the account of incompetence, this is beyond that, we are in the realm of toxic malice. I do presume now they know what they are doing, killing all small tech, or self-hosting is in their agenda of dominant internet corporation.

cryo32 4mo ago
I think it's more they simply don't register small tech and self-hosting. In time there will be a reckoning though. The geopolitical instability at the moment will see the end of the US dominant services used outside of the US so they will have to work out how to make a not small but balkanised email provider model work again.
- sylware 4mo ago
  They are doing it slowly, maliciously (they know). On top of that, you add complicit or severely brain-washed political support (look at my country or EU) on technical 'standards'. Fixing that level of corruption/brain washing is now going to hurt bad.

einpoklum 4mo ago

> In early 2024, Google and Yahoo began requiring Here's a big part of the problem right there. Google requires something, it becomes a requirement. In fact, Google's hold on email is a problem in itself. Among other things we need variety. Without it, "Google begins requiring" will be a recurring theme. It's happening again now with mobile phone apps! "Google begins requiring" that you register with them so that the apps you write can be installed on Android phones. > This shifted authentication from something senders could deprioritize to a basic prerequisite for reaching inboxes. And later, Google and a few other large players could just prevent individuals and smaller email service providers from being able to send email, at all. > so the filtering systems can tell where bad content is coming from and avoid hurting the reputation of the wrong parties. Be ready for people who don't register with the big corporations to be marked as having "bad reputation" and being simply blocked. There might be some technical excuse. > The inbox of the future will be faster, smarter, and more capable than what most of us use today. That sounds like the inbox of the future might be controlled by somebody else. I don't like that at all.

2000UltraDeluxe 4mo ago
Disclaimer: I do some work for one of Gmail's competitors. Of all the stuff Gmail imposes on the rest of the world, requiring proper sender authentication was a good thing and we've helped thousands of senders set up proper authentication because of it. Forcing the issue finally got rid of the ridiculous practice of ignoring SPF/DKIM failures and just setting the DMARC record to p=none. None of this changes the fact that Gmail is a problem for so many other reasons, but this specific imposed change was a net benefit for the entire email ecosystem.
jprjr_ 4mo ago
Honestly requiring DMARC was overall a good thing. I was an email admin for a university. In the past - each college ran their own email. Before DKIM, before SPF, you'd just have basically random servers on the internet sending email as (school).edu. Tons of random subdomains too. math.(school).edu and so on. Email was eventually centralized but you'd have parts of the university still running their own things. Insisting they're special and can't be brought into the fold. So, we had a lot of stuff out there just not passing authentication. A lot of spammers could just impersonate our domain. We'd go to leadership and say "hey we should really get our act together" - but everything was working. Our emails were still getting out. Hard to justify spending the time, getting various higher-ups within departments to give up their things, and so on. Unless you can get like, the president to back your initiative- universities are very decentralized and it becomes an issue of "do we have the political capital to spend here." The overall relationship between central IT and the various college-based IT departments was terrible, often bordering on combative. Google and Yahoo made it so we could go to leadership and say "people will not get our emails if we don't get this straightened out" and it became a priority. When I left our DMARC reports were showing something like a 99% pass rate when it was previously like, 50. So, I'm glad Google and Yahoo made that call, it gave us the kick in the pants we needed to get our own shit together. I am 100% certain we were not the only org like this. Plus for a small host - where you're just running a single mail server or something - you just need a few things to pass DMARC. A DMARC record, and an SPF record, and for your emails to pass SPF. You technically don't need to do DKIM signing (though I'd still recommend it because that survives automated forwarding).

jgalt212 4mo ago

> The first is AI filtering: the systems that decide what’s spam, what’s phishing, and what deserves your attention. Not so for Google Workspace. I get more spam and fake invoices and DocuSign contracts than I used to.

fiskeben 4mo ago

It's insane that in 2026 signing and encryption of emails still isn't the norm, but as long as the business model of the largest email vendors rely on us not having it, I guess we never will.

nicce 4mo ago
None of the big providers want that. Otherwise Microsoft had more difficult to share the Outlook data for 1000 partners.
jcranmer 4mo ago
In 2026, pushing for encryption of emails is a sign that you care more about box-checking requirements rather than actual security practices. Encrypted email sounds good--it's encrypted, how can that be bad?--but when you actually work through various threats and see what encrypted email protects against, it's really not much compared to the status quo, and encrypted email also turns out to lose a lot of features. Keep in mind that the baseline is that, when you send an email, it is encrypted from your computer to your email server, your email server to your recipients' email servers, and your recipients' email servers to their computers. The only people other than you and the recipients who can see it are the email servers involved in the middle, so the best you can get with encrypted emails is maybe cutting out some of the entities that have a critical role in the process (and which therefore can't entirely be cut out). In particular, encrypted email leaves all the email headers public, so it's not like the best case here is particularly private. But encrypted email also breaks the ability to do any server-side processing of email, like server-side email filters (okay, not the hugest loss in the world). Or spam processing--no one's come up with a workable solution here, especially given the vast amount of spam that never hits an email folder (the things that get routed to your spam folder are the emails your spam filters aren't sure is spam). Users also expect the ability to log onto their email server's website and just read their email: such webmail is the dominant email client used, and even people like me who almost exclusively use email clients still end up using a webmail client from time-to-time. You can fix this by giving your email server your key... which puts them back on the list of people who can read your email again, oops, you've gained nothing over the status quo. Worse still is the problem of key distribution. To send an email, you need to look up the recipients' keys... and the most practical approach to make that work at scale is probably to ask the mail server what its users' public keys are. The one entity that is guaranteed to be able to intercept literally every message to somebody, and thus is in prime position to offer its own key instead, strip the encryption, and re-encrypt it to the user without anybody else finding out. Alternative approaches like keyservers don't work: the PGP keyserver ecosystem collapsed several years ago when PGP encryption was of interest to fewer than a million users, far less scale than the billions of email users. Encrypted email is a useless pipedream, and not because of the business models of email vendors, but because the architecture of email provides good-enough security today that makes improving on it very challenging without negating the supposed benefits of extra encryption.

eggbrain 4mo ago

I feel we need a "proof of work by human" for emails. Something that could be signed that attests that someone took the time to write the email, not just sent a template / used AI to auto-generate a personal looking email, etc. Sure that could be gamed as well (have an AI write characters one by one to look more human-like), but taking more time usually is a fairly good blocker for spammers / salespersons / etc.

dgellow 4mo ago
I would love for a proof of human work to exist, but how would you even do that? It would need to be monitoring the user activity in their email client, which isn't something that can be trusted by a server (and is pretty shady). But that makes me think of Hashcash, that was developed to limit email spam via proof of work, but I don't think that has ever been used in practice: https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash (and of course wouldn't work for the proof of humanness you're talking about).
deleted 4mo ago
[deleted]
dbdr 4mo ago
What about automated signup confirmation emails, just as one example?
BatteryMountain 4mo ago
I want to give my bank my public key (preferable at a branch), so that ANY comms coming from them I can prove it came from them as.

bingemaker 4mo ago

In the world of AI, I think the future of email is deliver-ability. The new fad is "loop". And any loop should have a trigger. Rather having countless integrations, let all the triggers to got email, and those triggers trigger loops. I feel AI can kick off from personal/shared inboxes to deliver meaningful outcomes

Jgrubb 4mo ago

If only there were some interest on the part of Big Telco to solve these types of problems.

jollyjerry 4mo ago

It's frustrating not being able to send email for my hobby projects even if I follow all the rules and have the correct headers. I enjoyed reading jeremyevan's post on self hosting email, but it's only for receive and not send https://code.jeremyevans.net/2021-07-29-running-my-own-email-server.html https://code.jeremyevans.net/2021-07-29-running-my-own-email...

timwis 4mo ago

I read this article and was surprised when I reached the end because the whole thing felt like it was setting the stage for some announcement or new thing. But nothing came..? Forgive me if I'm being thick but what was the takeaway?

LearnYouALisp 4mo ago
"A crummy ad??"
- nickpeterson 4mo ago
  They want you to drink your rich chocolate email.
- reaperducer 4mo ago
  Downvoters are obviously not fans of A Christmas Story.
jimbobimbo 4mo ago
As a fastmail user I'm glad there was no announcement. Every time a company starts telling me about some bright future, this usually means my user experience is about to sink.
- frereubu 4mo ago
  But there is an announcement, called "The Future of Email", which is a clickbait title that would be much better titled with the last header of the last paragraph: "Email is not going anywhere".
  - riffic 4mo ago
    I thought as well - it seemed like it was poised to say something about JMAP: https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol
- 4mo ago

carlosjobim 4mo ago

Everybody who has a Fastmail e-mail in their profile here on HN has received several targeted phishing mails with senders who are registered with @fastmail accounts that sound official. And Fastmail doesn't seem to do much about it. It's absolutely the worst part of using Fastmail, that they don't clean up in their own house.

br0ceph 4mo ago

pgp exists, sheesh

daft_pink 4mo ago

A little bit off topic but We need dmarc to prevent phone spoofing. STIR/SHAKEN should adopt the DMARC model from email. The legitimate holder of a phone number should be able to publish a policy declaring that any call claiming to originate from their number without A-level attestation must be blocked by the terminating carrier. Just as domain owners can instruct mail servers to reject unauthenticated email sent in their name, number holders should be able to instruct carriers to reject unauthenticated calls spoofing their numbers. In my experience since phone scammers tend to scam a small subset of numbers like dell, facebook, Microsoft, the Internal Revenue Service, copying this could allow big companies to block a huge number of phishing calls requiring their numbers. Since many calls originate from authenticating carriers now we need to go to the next level and block fake calls.

br0ceph 4mo ago

seems like pgp would solve alot of the issues around auth and confidentiality i think email is fine the way it is

marysol5 4mo ago

E-Mail should have died in the early 2000's. It's an absolute shit communication system and isn't fit for purpose, and wasn't even then....

br0ceph 4mo ago

seems like pgp inside emails would solve alot of the issues around auth and confidentiality i think email is fine the way it is i dont need any more solutions that make it harder to host your own servers email is meant to be self hosted. i feel like commercial email services have their usecases but we should avoid having service providers playing with standards, as their motives might be self serving. we should keep decentralized internet tech as decentralized as possible, with a caution against blocking random senders, as this leads to monopolies blocking their competition and demanding compliance to their agendas.

inigyou 4mo ago
How would you get someone's key?

jfb 4mo ago

Postage. Postage. Postage.

NewCzech 4mo ago

In 1993, a friend of mine was working at Apple. I wanted to send him a funny message with a spoofed sender. I just typed "telnet apple.com 25" and then typed in the required commands. Apple.com accepted it and delivered it to my friend with a fake sender. Those were the days, lol!

monitron 4mo ago
My friends and I used to do this all the time in that same time period. It was all fun and games until one day I caught one of them spoofing a message from me to president@whitehouse.gov making vague threats. He seemed to think I overreacted when I dove under the desk and unplugged the machine.

vkaku 4mo ago

Counter Point: Until people can migrate their inboxes and steer them to any provider, none of this authentication business seems to hold up actual value at scale. If anyone can port their phone number, they should be in theory, allowed to port their email addresses as well. None of the authentication systems here are helpful enough to allow this. You need a valid way to authenticate people irrespective of whatever provider they are on (not their email domain name) That means that a standard needs to evolve that allows you sign on the behalf of the hosting provider itself.

kaishiro 4mo ago

As a Fastmail user for both personal use, as well as for my business, the best thing I can say about them is that I haven't thought about them in...a decade? We built a Discord integration so that new emails to our support address would ping us in a Discord channel using the JMAP API. It's only failed to work once that I can recall - and that ultimately ending up being on Discord - not Fastmail. Just rock solid service all around with no bullshit.

wakamoleguy 4mo ago

> A person reading a suspicious email might notice that the sender’s domain has an extra character, or that something about the request feels off. An AI assistant scanning your inbox for items that need action may not slow down to check those things. I don't quite buy this in either direction (although they are both couched as possibilities, which makes it a pretty safe statement). Humans might notice, but years of annual mandated phishing trainings has led me to believe that humans as a whole are generally not great at noticing. AI agents OTOH mostly do as they are prompted. If the human prompting them tells them to check these things, they will likely check much more consistently than any human. If the prompt doesn't say to check, the agent won't. But that again falls back to what the human might or might not think about.

ruslan 4mo ago

> The second is AI assistance: tools that summarize your inbox, surface action items, draft replies, and in some cases take actions on your behalf. That is the most evil part. Finally we will have bots talking to bots, no human in the loop. All email problems can be solved with GPG, but that ruins Fastmail and other email services business, as they won't be able to read and analyze their users' emails. No ads, no selling user profiles to ad companies, not even teaching AI on user data. This is the kind of future of email I would like to see. Sadly, noone uses GPG and it's quite hard to teach people to do it.

BatteryMountain 4mo ago
Preach. Exactly. We will eventually be forced down this path though, be patient! Upfront key exchange in-person will be the only way left to prove comms are real. GPG is just one path but someone will come along and make it easy on organizational level.
- ruslan 4mo ago
  Delta Chat is an email client I use and advise to my correspondents, it does GPG stuff quite comfortably. Yet it still requires understanding of the process.
IncandescentGas 4mo ago
Fastmail reads or analyzes users email to sell ads? Fastmail trains ai models on their user's email messages? Metadata is more valuable than message content for analysis. GPG solves that how?
- ruslan 4mo ago
  > Fastmail reads or analyzes users email to sell ads? Fastmail trains ai models on their user's email messages? Even though they have not been caught, it does no mean they are not doing so. We live in the world of zero trust. > Metadata is more valuable than message content for analysis. GPG solves that how? In most cases yes, only From: and To: headers are exposed.

riffic 4mo ago

> Email is not going anywhere time and time again it's worth stressing how the Lindy effect directly applies here to email or other layers of the protocol stack. https://en.wikipedia.org/wiki/Lindy_effect https://en.wikipedia.org/wiki/Lindy_effect

m463 4mo ago

respectfully the title is clickbait, so maybe a more objective one would be better? > Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

havaloc 4mo ago

I really like Fastmail, but I wish they offered a lightweight AI feature. Their filtering system is unmatched, yet I’d love a basic, privacy-focused AI filter powered by a small, private model they run. For example, I could set rules like “if an email looks like a promotion, move it to the promotions folder.” I could roll my own MCP server sure, but that’s not the direction I want to go.

BatteryMountain 4mo ago

We will end up with a situation where all interactions with computers (remote systems), including email, will need an initial step to pair/exchange keys, much like ssh. So when the bank wants to send me email, they can only do so if they have my public key. We should try to make this as frictionless as possible. Or, we generate semi-random email addresses that are short-lived, so that each company I interact with get their own unguesable email address. Either way, we are getting to a point where offline-2FA will be mandatory for all auth systems and when interacting with another party, it will need something like the above to be sure you are dealing with the correct company.

reader9274 4mo ago

We need email end to end encryption. Good to see Google getting into that world, we need Apple and others to join too.

mthoms 4mo ago

I used to love Fastmail, but their spam/phishing filtering (and customer service) have been really poor lately. I don't know if AI is helping or hurting them. My anecdotal experience suggests the latter. As one example, I'm now regularly getting phishing email from "The IRS" that always comes from some random account that has been taken over. The latest one was literally from a hotmail account (and my address is dot ca so I'm clearly not subject to the US government). If they can't detect this kind of half-arsed phishing attempt, then things are pretty bleak. Their customer service was pretty bad when I tried to discuss it. The rep didn't even acknowledge what I wrote. I won't be renewing unless they get this sorted.

deleted 4mo ago

[deleted]