The email deliverability signal log

AI Agents Are Now Cold-Emailing at Scale: What the iLands Episode Means for Senders

In September 2026 autonomous AI agents on the iLands platform began cold-emailing researchers, freelancers and editors to sell small paid tasks, often around $20 to $25. One NYU professor counted about 40 emails in a week from different agent personas. iLands added an unsubscribe option and says it is reviewing rate limits, cross-agent deduplication and stop-contact controls. By late October the same agents were pitching newsrooms, with almost no takers. For senders the lesson is simple: an agent that emails strangers is a sender like any other, and the Gmail, Yahoo and Microsoft rules apply to it from the first message.

APRF Adopted by the IETF MAILMAINT Working Group: What Changed in the New Draft

APRF graduated from an individual submission to a working-group draft: the IETF MAILMAINT working group adopted it on 8 October 2026 and republished it as draft-ietf-mailmaint-aprf-00 on 9 October, replacing draft-brotman-aggregate-performance-reporting. The protocol barely changed - a new selector-less record form, an explicit record-discovery order and a corrected subject-prefix typo - so any APRF record already published keeps working unchanged. Comcast is still the only mailbox provider sending reports.

Validity Launches "Heatwave", a Blocklist Targeting Artificial Domain Warmup

On 3 September 2026 Validity launched Heatwave, a blocklist that targets synthetic (artificial) domain warming - services that spin up networks of fake mailboxes to fake opens, clicks and replies and manufacture sender reputation. It launched with 1M+ domains listed, is mirrored into Validity's DNS reputation zones, and is used or evaluated by Comcast, Proofpoint, Spamhaus and SURBL - so a listing can affect real delivery. Delisting is a manual review and stopping the warmup is not, on its own, grounds for removal.

AI Assistants Can Now Run Live Email-Deliverability Checks (via MCP)

AI assistants like Claude can now run real email-deliverability checks through MCP (the Model Context Protocol), an open standard for connecting tools to assistants. Anthropic's Connectors Directory now lists such tools, so a user can ask "is my domain blacklisted?" and the assistant runs the actual check on the tool's infrastructure rather than guessing from training data. Postbox Services is among the first email-deliverability tools listed.

DMARCbis Is Now RFC 9989: What Actually Changed, and the t= Trap Everyone Is Getting Wrong

DMARCbis stopped being a draft in May 2026: it is now RFC 9989 (core), 9990 (aggregate reporting) and 9991 (failure reporting), and it obsoletes the original RFC 7489 that almost every DMARC guide still cites. The record you publish keeps working, but three things changed under the hood - the Public Suffix List is replaced by a DNS tree walk, pct/rf/ri are removed, and a new np= tag is the sharpest anti-spoofing control in the record. Watch out for t=: it steps your policy down one level, it does not disable it, and secondary sources are already calling it pct=0 by mistake.

EffectivePublished May 2026

TLS certificate lifetimes: 200 days now, 100 in 2027, 47 by 2029

CA/B Forum ballot SC-081v3 is phasing public TLS certificate validity down from 398 days to 47 by March 2029 - the 200-day cap took effect 15 March 2026. Email surfaces are on the clock: MX/STARTTLS, the MTA-STS policy host, BIMI logo hosting. The first mass renewal wave of 200-day certificates lands around 1 October 2026.

EffectiveIn force since 15 Mar 2026 - next step 15 Mar 2027

Gmail Drops "Send As" for Third-Party Accounts from January 2027

Gmail will stop letting you send mail as a non-Google address (@yahoo.com, @outlook.com or a custom domain) from the web and mobile apps, and will retire Gmailify and web POP fetch for third-party accounts. Existing users keep the features until January 2027; new sign-ups already lost Gmailify and POP after Q1 2026.

EffectiveJanuary 2027

APRF: The Draft Standard That Would Finally Show Senders Where Their Mail Lands

An IETF draft - now draft-ietf-mailmaint-aprf, after the MAILMAINT working group adopted it in October 2026 - proposes a DMARC-style mechanism for mailbox providers to email senders daily JSON reports on inbox placement and engagement, keyed to the DKIM signing domain, not the From address. It is still early (Comcast is the only provider sending beta reports, with a Google engineer among the authors), but it could finally standardize the placement data that has always lived behind per-provider portals.

DKIM2: Email Signing Gets a Ground-Up Rebuild to Stop Replay and Survive Forwarding

A revived IETF working group is rebuilding DKIM from the ground up. DKIM2 (draft-ietf-dkim-dkim2-spec, authored by engineers from Yahoo, Google and Fastmail) signs every hop, binds each signature to the SMTP envelope to stop replay, records reversible "recipes" so forwarding no longer breaks DMARC, and routes provable bounces up the chain - and a companion draft retires ARC into it. It is real enough to watch (working code exists), but still a draft: do not deploy it in production yet.