Coder Legion - Recent posts tagged email

Lock Your Inbox: Email 2FA, Passkeys and App Passwords

Wed, 28 Oct 2026 13:51:22 +0000

This article was originally published on the [@fuck.it] blog and is republished here by the author.

There is a quiet assumption sitting behind almost every account you own: that if you ever lose your way in, your email will let you back. Click "forgot password," wait a moment, and something arrives in your inbox that puts you back in charge.

It is a reasonable way to build things. It also means your mailbox is not really one account among many. It is the drawer where the spare keys to the others are kept, which makes it the one account worth being fussy about.

So here is the fussy version. What the options actually do, which of them hold up against a convincing fake login page, the one feature that quietly undoes the rest and how to switch all of it on.

TL;DR

Use a passkey or a hardware security key if your provider offers one. They are phishing-resistant in a way that SMS codes and authenticator codes are not.
Use an authenticator app if it doesn't. Enormous improvement over nothing. Still phishable.
SMS codes are the weakest real option. NIST's current guidelines classify exactly one authenticator as restricted, and this is it.
Save your recovery codes somewhere that is not the inbox they unlock. Locking yourself out is a very real way to lose an email account.
App passwords bypass your second factor completely. That is their entire job. Create one only when a client demands it, keep it to one per device and revoke it when you are done.
Your recovery address and recovery phone are keys too. A locked front door and an open window is not security.

Why the Inbox Is the Wrong Thing to Secure Casually

Almost every account you own has a button that says it will email you a way back in. That is sensible design. It also means that for a great many of your accounts, the real lock on the door is your mailbox, however strong the password on each individual one happens to be.

Attackers worked this out long before users did. Taking over an inbox is not usually the goal. It is the tool. Once somebody is reading your mail they can trigger resets, collect the codes, approve the changes and delete the warning messages on the way out, without ever having to attack the accounts they actually want.

So if you are going to be fussy about exactly one account, make it this one. Everything in this article is worth doing on your email before you do it anywhere else.

What People Mean When They Talk About 2FA

There are four of them in common use, and they are not equivalent. The gap between the best and the worst is wider than most people assume.

A code by SMS. The provider texts you six digits. Better than nothing, and worse than every other option here. The weakness is not the code, it is the phone number. Numbers get moved to a new SIM by somebody who has talked a carrier employee into it, and your codes move with them. The problem is real enough that the FCC adopted rules in November 2023 requiring carriers to authenticate customers properly before a SIM change or a port-out, and to offer you a free account lock against both. NIST's 2025 authentication guidelines go further: use of the phone network for out-of-band verification is classified as restricted, and at publication it was the only restricted authenticator in the document. Services may still offer it, but they have to provide something better alongside it and tell you about the risk.

A code from an authenticator app. A six-digit number that changes every thirty seconds, generated on your device from a shared secret. No phone number, no carrier, no text message to intercept. This is a very large upgrade, and for most people it is the realistic default.

It has one specific weakness worth understanding, because it is the weakness that catches people who thought they were safe. Typing a code into a web page does not tie that code to the real site. NIST puts it plainly: manual entry does not bind the output to the session, so an impostor verifier could relay it. In practice, a fake login page that looks right can collect your password and your code, pass both to the real provider inside the thirty seconds they are valid, and let itself in. Ready-made tooling for exactly this has existed for years. An authenticator app defeats password reuse, credential stuffing and opportunistic attacks. It does not defeat somebody who has got you onto a convincing fake page.

A push notification you approve. Your phone asks "was this you?" and you tap yes. Convenient, and vulnerable to the oldest trick in the catalog: send the prompt over and over at eleven at night until the human taps approve to make it stop. The better implementations use number matching, where the login screen shows you two digits that you have to type into the app. That kills the half-asleep approval, and it is worth turning on wherever you are offered it. Against a live fake-page attack it is in the same boat as an authenticator app.

A passkey or a hardware security key. This one differs in kind rather than in degree, so it gets its own section.

What a Passkey Actually Is

A passkey is a pair of cryptographic keys. The private half stays on your device or in an encrypted credential manager and never travels to the site you are signing into. The site keeps only the public half, which is useless to a thief. When you sign in, your device proves it holds the private key without ever revealing it.

The part that matters for phishing is less obvious and more important. When a passkey is created, it is bound to the exact domain that created it. A passkey you made for your bank will not answer a request from your-bank-secure-login.example, no matter how perfect the copy of the page is, because your browser will not even offer it. NIST calls this verifier name binding, and names WebAuthn, the standard passkeys are built on, as the example of how to do it.

That is the whole argument, so it is worth reading twice. With an authenticator app, your safety depends on you noticing the fake site. With a passkey, the fake site gets nothing even when you do not notice. The decision has moved from your judgment at eight in the morning to a check your browser performs every single time without ever getting tired or distracted.

Two honest drawbacks, both smaller than they were a year ago and neither of them gone.

First, a synced passkey puts part of your security in the hands of a credential manager and its account recovery. Moving them used to be close to impossible. That has improved: Apple's iOS 26, iPadOS 26 and macOS 26 releases and recent Android versions support transferring credentials directly between credential manager apps on the same device, and Apple Passwords, 1Password, Bitwarden, Dashlane and others have adopted it. The underlying work is only half finished, though. The exchange format reached proposed-standard status in 2025, while the protocol for actually moving credentials between providers is still a working draft that explicitly says it is not a basis for implementations. Same-device switching between participating credential managers works today on both Apple and Android. What does not exist yet is a finished universal protocol for moving credentials freely between providers across different devices and platforms.

Second, support is uneven. Microsoft began making new consumer accounts passwordless by default in 2025 and most large providers accept passkeys somewhere, but plenty of smaller services still do not offer them at all. A physical security key sidesteps the ecosystem question completely, at the cost of being an object you can lose. Credentials cannot be exported from a certified hardware key by design, so there is no migration path and the answer is to buy two and register both.

Where a passkey is on offer for your email, take it.

App Passwords: The Back Door You Opened Yourself

Now the part that is mostly missing from articles about securing email, and that can undo everything above.

Turn on two-factor authentication, then try to set up your mailbox in an older desktop mail client or on an office printer. It fails, and the reason is structural. When an older mail client connects over IMAP or SMTP using traditional password authentication, it hands over a username and a password, and there is no interactive moment in that exchange where the server can stop and ask you for a code from your phone.

The modern fix is to stop using a password at all. RFC 7628 defines OAuth-based authentication over these protocols for exactly this situation: the client sends you through a browser login where two-factor happens normally, then receives a token it uses from then on. This is what "modern authentication" means in Gmail and Outlook, and it is why those accounts work properly in current mail apps.

The older fix, still available at many providers, is an app password. Your provider generates a long random string that works in place of your real password and skips your second factor entirely. Google's is sixteen characters, shown to you exactly once. You can only create one if two-step verification is already switched on, which is the quiet irony of the feature: it exists only for accounts that took security seriously, and what it produces is a credential that ignores the protection they switched on.

Google itself says app passwords are not recommended and are unnecessary in most cases. That has not stopped them being widely used, and it has not stopped them being targeted.

In June 2025 the Citizen Lab published a report on a campaign that did precisely that. Over at least ten email exchanges, an attacker posing as a US State Department official cultivated a relationship with Keir Giles, a Chatham House specialist on Russian information operations. Four apparently fabricated state.gov addresses were copied into the thread for credibility, which worked partly because the real State Department mail server appears to accept messages to addresses that do not exist without bouncing them. Eventually a professionally formatted PDF arrived with instructions for joining a government platform. The instructions walked him through creating an app-specific password on his Google account, labeling it with a meaningless string and sending it back.

The PDF contained no malware. There was no exploit anywhere in the operation. The entire attack was a set of polite instructions that persuaded a careful, security-aware target to generate a credential that bypassed his own two-factor authentication, and then to hand it over. Google's threat intelligence group attributed the operator to UNC6293, linked with low confidence to APT29.

The rules that follow are short:

Create an app password only when a device truly cannot do anything else, and look for an OAuth option first.
One per device, named for that device, so you can revoke precisely.
Revoke it the moment you stop using that client, sell the phone or replace the printer.
Never send one to anybody. There is no legitimate situation in which a person, a company or a support agent needs your app password. None.
Google revokes its app passwords when you change your account password. Do not assume every provider does. After any scare, change the password and then go and audit the app password list separately.
Audit that list occasionally anyway. Old app passwords have a habit of surviving long after the device they were created for is gone.

Recovery Codes Are the Part Everyone Skips

When you switch on two-factor authentication you are handed a list of one-time codes and a button to download them. Do it. NIST calls these look-up secrets and treats them as a legitimate authenticator in their own right, with the caveat that they are not phishing-resistant either.

The reason to care is not heroic. A very ordinary way to lose access to an email account is a phone that went into a canal carrying the only copy of the authenticator secret. Recovery codes are the answer to that, and they are the step people reliably skip, because the account works perfectly well without them right up until it does not.

Where to put them: printed on paper somewhere a burglar would not think to look is perfectly reasonable. A password manager is good too, with one trap worth thinking through. If your password manager's own account recovery runs through the email address these codes protect, and the codes exist only inside that password manager, you have built a circle with no way in. Keep at least one copy outside the loop.

And do not store them as a draft in the inbox they unlock, which is a thing people do.

The Windows You Left Open

Two more ways into your mailbox that are not the front door.

Your recovery address and recovery phone. These exist to let you back in, which means they can let somebody else in. An abandoned address at a provider you no longer check, or worse, one that has lapsed and could be registered by anybody who notices, is a live key to your current mailbox. Go and look at what is actually listed.

Forwarding rules and filters. This is a standard move after a mailbox compromise and one that is easy to overlook. A rule that quietly copies everything to an outside address, or files all mail from your bank into a folder you never open, survives the password change, the new second factor and the warm feeling of having dealt with it. If you ever suspect something happened, read your rules before you relax.

Turning It On

The wording differs between providers, but the shape of it almost never does.

Sign in and open your account settings, then look for a section called Security, Sign-in or Password.
Switch on two-factor authentication, two-step verification or multi-factor authentication. Same thing, three names.
Scan the QR code with any authenticator app. Anything that does standard TOTP works, so you are not tied to a particular vendor.
Type the six-digit code once to confirm. If you skip this step, it is not actually on.
Save the recovery codes. This is the step that matters most in a year's time.

One thing worth understanding while you are in there. A mail client using traditional password authentication over IMAP, POP3 or SMTP has no interactive moment where the server can stop and ask you for a code. Providers deal with that in different ways: some disable password authentication once a second factor is enabled, some issue separate application passwords and modern services increasingly use OAuth so that the second factor can happen during a browser login instead.

The practical conclusion matters more than the mechanism, so find out what credential your mail apps are actually using. If your normal mailbox password still works over IMAP, POP3 or SMTP after you switch on two-factor authentication, then that password is still a way into the mailbox with no second factor standing in front of it. Make it long, make it unique to this account and never reuse it anywhere else.

Worth checking separately: a few services keep more than one login. The account you use for billing and the mailbox itself can be two different doors with two different settings, and switching one on does not switch on the other.

The Twenty-Minute Version

In order, because the order matters:

Email first. It is the recovery channel for a disturbing number of your other accounts, so securing them while the mailbox is open is largely decorative.
Turn on the strongest second factor on offer. Passkey or security key, then authenticator app, then SMS. If SMS is the only option, take it and ask your provider why.
Save the recovery codes. Somewhere physical, outside the loop described above.
Review your app passwords and connected apps. Revoke anything you do not recognize or no longer use.
Check your forwarding rules and filters. Takes a minute, almost never done.
Fix your recovery address and phone. Make sure both are things you still control.
Then do steps two and three for your password manager and your phone's cloud account. Those are the other two sets of spare keys.

That is the lot. One short session on the sofa, once, for the account that holds the spare keys to so many of the others.

One Number Before You Go

We run a small paid email service, which puts us in a position to look something up that most people writing about this subject cannot: how many of our own customers actually switch this on.

Fewer than one in five.

Sit with that for a second. Our customers are, by definition, people who went looking for a private email service, found an invite-only one and paid money for it. If adoption is that low among people who are actively paying for privacy, it says something uncomfortable about how badly an optional security feature loses to inertia, no matter how motivated the person is.

Which is the honest note to end on. An optional second factor cannot protect you if you never switch it on.

It takes about four minutes. Go on.

Sources & further reading: NIST SP 800-63B-4: Authentication and Authenticator Management · NIST: Authenticators and phishing resistance · NIST: Syncable authenticators · W3C Web Authentication (WebAuthn) · RFC 7628: SASL Mechanisms for OAuth · Citizen Lab: Same Sea, New Phish · Google: Sign in with app passwords · FCC: SIM swap and port-out fraud rules · Open-Xchange: Application passwords

Disclosure: We run [@fuck.it], a privacy-focused, subscription-funded email service by Paradise Circus, Inc. — no ads, no tracking. Facts and product details are accurate as of October 28, 2026; check the original for the latest version.

I automated the hardest parts of Amazon SES, so you can send from your own AWS account in two minute

Wed, 28 Oct 2026 06:00:57 +0000

Amazon SES is the most cost-effective way to send transactional email. But a production setup
takes real work: IAM, the sandbox, bounce and complaint handling, logs, and watching your
reputation. I built SendFleet to do that work inside your own AWS account.

What it does

One-click connection. A CloudFormation template creates a scoped IAM role. Paste its ARN and
you are connected. No AWS keys are ever shared.
Finds your sending region. Production access is per region, so SendFleet checks them all and
picks the one that can send. If none can, it requests production access for you.
Tracking and webhooks. It sets up the configuration set and SNS topic in your account, keeps
them healthy, and turns events into an email log and signed webhooks.
Reputation protection. It pauses sending before your bounce or complaint rate reaches the
levels where AWS starts reviewing accounts.
Cost controls. You choose which SES events your account publishes, and set a monthly cap.
Transparency. Every change SendFleet makes in your account is listed in the dashboard.

How it is built

A Rust API for sending (POST /v1/send).
A Django dashboard.
Python Lambdas in a separate AWS account: a relay that assumes your role to send, a control
plane for setup and self-healing, and an event worker.
Postgres on Neon. Message bodies never reach the database.

Pricing

Free for 3,000 emails a month. $5 a month with 20,000 emails included, then $0.10 per 1,000. You
pay AWS for SES directly.

Try it at https://sendfleet.net. I'm keen to hear what would make you trust a tool like this with
your AWS account.

Is It Safe to Click Unsubscribe? Depends Who Sent It.

Wed, 21 Oct 2026 18:19:15 +0000

This article was originally published on the [@fuck.it] blog and is republished here by the author.

Somebody told you, years ago, never to click unsubscribe. It confirms your address is real. It tells the spammers you're alive. You've been dutifully deleting newsletters one at a time ever since, like a person bailing out a boat with a teaspoon.

That advice wasn't wrong. It was written for an inbox that doesn't exist anymore.

Here's what's actually true in 2026, and a rule simple enough to use at eight in the morning without thinking about it.

TL;DR

In your inbox, from a sender you recognize and expected to hear from: unsubscribe. That's what the button is for and it stops the mail at the source.
Use your mail app's own Unsubscribe button when it offers one. When the sender supports true one-click unsubscribe, your provider can process the request without you visiting the sender's page.
In your spam folder, or from a sender you've never heard of: don't click anything. Report it and move on.
Don't test whether a stranger's unsubscribe link is honest. Report the message instead.
The old warning still applies to actual spam. It just stopped applying to the legitimate marketing mail that makes up most of your clutter.

Why That Advice Was Right in 2004

In 2004 your inbox was a sewer. Filtering was primitive, spam was most of what arrived, and the stuff in front of you was genuinely dangerous.

In that world, the advice made sense. Clicking an unsubscribe link in a spam message can do three things for the sender, none of them good for you. It confirms somebody reads this address. It confirms somebody reads it attentively enough to click. And it hands over a browser session to a page of his choosing.

A confirmed, attentive address can be more useful to a spam operation than an unconfirmed one. At minimum, you've told them somebody is home. That mechanism hasn't changed.

What changed is everything in front of it.

What Changed

Three things, and together they flipped the answer for most mail.

Filtering got good. The crude, dangerous spam is much less likely to reach your inbox now. A lot of it lands in spam or never arrives at all. Much of the everyday clutter left in front of you is legitimate commercial mail from real companies, including plenty you did, at some point, give your address to. Possibly while buying a lamp in 2019.

Unsubscribing became a legal requirement. In the US, the CAN-SPAM Act requires commercial mail to carry a working opt-out mechanism and to honor requests within ten business days. Europe generally goes further, requiring prior consent for direct marketing email, with an exception for some marketing to existing customers. A real company has lawyers, and those lawyers would prefer the unsubscribe link worked.

The mailbox providers made it a condition of delivery. Since 2024, Google has required senders delivering more than 5,000 messages a day to Gmail accounts to support genuine one-click unsubscribe for marketing mail and process requests within 48 hours. Yahoo requires bulk senders to provide easy unsubscribe and honor requests within two days. Microsoft now imposes stricter rules on high-volume senders too, although its unsubscribe requirement is currently framed as a best practice rather than the same mandate. At scale, making it hard to leave has become a deliverability problem, which is the only kind of problem marketing departments take seriously.

The Button vs. the Link

There are two different things people call "unsubscribe," and the difference is the most useful thing in this article.

The Unsubscribe button at the top of the message, next to the sender's name, belongs to your mail app rather than to the email. It can appear because the message carries a List-Unsubscribe header, standardized back in 1998.

What happens when you press it depends on one more header. List-Unsubscribe-Post, defined in RFC 8058, marks the address as a true one-click endpoint. When it's there and your provider supports true one-click, your provider sends the unsubscribe request itself, as a POST over HTTPS. You don't visit the sender's website, you don't load their page and you don't execute their code. The sender gets a request saying this address is out, and that's the end of it.

Why a POST rather than a normal link? Because mail security systems routinely fetch URLs automatically to check them. If simply visiting the address counted as an unsubscribe, a link scanner could remove you from a list before you'd even opened the message. The separate POST tells the sender this was an intentional unsubscribe, not a security bot kicking the tires.

Without that second header, the older List-Unsubscribe header can contain a web address or a mailto: command, and clients handle them differently. A web address may open the sender's unsubscribe page. A mailto: command can trigger an unsubscribe message to the list system, usually with some form of confirmation. Either way, it isn't the standardized hands-off HTTPS POST defined by RFC 8058.

One technical detail worth knowing. For a provider to offer true one-click, the sender's DKIM signature has to cover both unsubscribe headers, and Gmail runs its own eligibility checks before showing its control. When a provider offers true RFC 8058 one-click, that's a useful signal that the sender has implemented the required authentication and unsubscribe headers correctly. It is not proof that the sender itself is trustworthy. A dishonest operation can authenticate its domain perfectly well.

The unsubscribe link in the footer is supplied by the sender. Clicking it opens a page chosen by the sender or their mailing service, with everything that implies. For a company you recognize, fine. For anything else, you're accepting an invitation from a stranger.

There is one reason to prefer the footer link even when the safe button exists: preferences. One-click unsubscribe is deliberately blunt and applies to the list that message came from. If you want the monthly newsletter but not the daily sale email, the sender's preference page may let you turn one off without killing everything.

The Rule

Here it is, short enough to remember:

Did this arrive in my inbox, do I recognize the sender and does the message make sense?

If yes, unsubscribe. Use the app's button if there is one, the footer link if there isn't.

If no, don't click anything. Report it as spam or phishing, block the sender if you like, and leave it alone.

That's the whole decision. Everything else is detail.

One exception worth knowing: not every legitimate message has something to unsubscribe from. Receipts, password resets, security alerts and booking confirmations are transactional mail. If there's no mailing list, there may be no unsubscribe button because there shouldn't be one.

How to Tell Which One You're Looking At

If you want to be more careful than the rule, these are the signals.

You don't have to click a footer link to find out where it goes. On desktop, hover over it and look at the destination first.

Signs it's real:

You can remember the company, or at least the purchase that got you onto the list.
The message itself makes sense: it refers to something real, and nothing about it is urgent or odd.
The footer link points to the company's domain or a recognizable mailing-service domain like Mailchimp or HubSpot, rather than somewhere completely unrelated.
The unsubscribe page just says you're removed, or offers a preferences page. No login, no card details, no "confirm your identity."

Signs it isn't:

You never had any relationship with this sender.
The message is already in your spam folder. Your provider has told you what it thinks. Listen.
The unsubscribe page asks for your password, your payment details or anything beyond the email address being removed.
The link goes somewhere that has nothing to do with the sender or any mailing service.

And the one that catches people: a message that looks like a newsletter from a brand you know but arrived somewhere unexpected, or addressed to an alias you never gave that company. That's phishing wearing a marketing costume, and the unsubscribe link is the hook.

Unsubscribe or Report as Spam?

Different tools for different jobs.

Unsubscribe stops mail at the source. The sender takes you off the list and doesn't send again. Right for legitimate marketing you no longer want.

Report as spam primarily tells your provider. It trains the filtering system and, in aggregate, hurts that sender's reputation. Some providers also feed complaint information back to legitimate bulk senders. Right for mail you never asked for or don't trust.

Reporting a newsletter you genuinely subscribed to as spam is a small act of vandalism against a company whose only crime was being boring. Unsubscribe instead. Save the spam button for people who deserve it.

For a sense of scale: Google tells bulk senders to stay below a 0.1% user-reported spam rate and never hit 0.3%. Yahoo uses the same 0.3% ceiling. That's three complaints in a thousand to hit 0.3%. The spam button carries rather more weight than it looks like.

Why You Don't Unsubscribe from Actual Spam

A malicious sender has no obligation to honor the request. The link might remove you, it might confirm that somebody reads this address, or it might simply take you somewhere you shouldn't be. You have no way to tell which in advance.

That's why the old advice survives for actual spam. Don't test whether a stranger's unsubscribe system is honest. Report the message and move on.

Sources & further reading: RFC 8058: One-Click Unsubscribe · RFC 2369: List-Unsubscribe · Google: Email sender guidelines · Google: Unsubscribe from marketing emails · Yahoo: Sender best practices · Microsoft: Outlook's requirements for high-volume senders · FTC: CAN-SPAM Act compliance guide · EU ePrivacy Directive, Article 13

Disclosure: We run [@fuck.it], a privacy-focused, subscription-funded email service by Paradise Circus, Inc. — no ads, no tracking. Facts and product details are accurate as of October 21, 2026; check the original for the latest version.

How to Automate Email Newsletter Campaigns Using Modern Autoresponders

Mon, 19 Oct 2026 11:10:49 +0000

Email newsletters remain an important channel for businesses that want to reach subscribers, promote products, distribute content, and build customer relationships. However, manually preparing and sending every newsletter requires time, consistent attention, and reliable audience management. Modern email autoresponders address these challenges by allowing marketers to schedule messages, create automated sequences, segment subscribers, and track campaign performance from a central platform.

For digital marketers, bloggers, SEO professionals, and website owners, automation can turn an irregular newsletter process into a repeatable marketing operation. The objective is not simply to send more emails. It is to deliver relevant information to the right audience at the appropriate stage of the customer journey.

What Is Email Newsletter Automation?
Email newsletter automation uses software to send messages according to predefined schedules, subscriber actions, or specific conditions. Instead of manually sending every message, marketers establish workflows that determine when an email should be sent and which subscribers should receive it.

An autoresponder can deliver a welcome email immediately after someone subscribes, send a series of educational newsletters over several days, or distribute recurring content according to a publishing schedule. More advanced marketing automation platforms can also apply subscriber tags, evaluate engagement, and direct contacts into different email sequences.

For example, a digital marketing website might automatically welcome new subscribers, introduce them to its most useful SEO resources, and subsequently send newsletters covering keyword research, technical SEO, content strategy, and marketing tools.

These workflows reduce repetitive work while helping businesses maintain consistent communication with their audiences.

Choose an Autoresponder That Matches Your Marketing Needs
The first step is selecting an email marketing platform with automation capabilities that support your publishing schedule, audience size, and business objectives.

Important features include:

Automated workflows: The ability to trigger emails following subscriptions, purchases, or other supported actions.

Audience segmentation: Tools for organizing subscribers according to interests, engagement, and relevant contact information.

Newsletter scheduling: Options for preparing campaigns in advance and delivering them at specified times.

Performance reporting: Access to delivery, click, engagement, and conversion data where supported.

Integration capabilities: Connections with website forms, customer relationship management systems, e-commerce platforms, and other marketing tools.

Deliverability controls: Support for sender authentication, unsubscribe management, and contact list maintenance.

Platforms differ in their available features, subscription limits, and pricing. Evaluate the actual capabilities included in the plan you intend to use rather than assuming every provider offers the same automation options.

A small blog may need a straightforward welcome sequence and scheduled newsletters. An established SaaS company may require more sophisticated workflows based on trial registrations, product usage, account status, and subscription activity.

Build a Permission-Based Subscriber List
Automation begins with a reliable subscriber list. The quality of that list directly affects the relevance of campaigns and the work required to maintain them.

Add newsletter signup forms to appropriate locations on your website, including relevant blog posts, resource pages, and landing pages. Explain what subscribers will receive, such as weekly industry updates, practical tutorials, product announcements, or exclusive educational content.

Collect only the information necessary for your marketing objectives. An email address may be sufficient for a general newsletter, while an optional interest selection can help deliver more relevant material.

Configure your platform to maintain subscription preferences and process unsubscribe requests correctly. Do not treat every website visitor, customer, or imported contact as someone who has agreed to receive promotional newsletters.

Email marketing also involves legal and technical obligations. For example, the United States Federal Trade Commission explains the requirements of the CAN-SPAM Act, while Google's sender guidelines specify authentication and unsubscribe requirements for applicable senders. Businesses must assess the laws and rules that apply to their own audiences and locations.

Create Automated Welcome Sequences
A welcome sequence introduces new subscribers to your brand and establishes expectations for future newsletters. Because the sequence begins when a subscriber meets a defined trigger, it can operate without requiring a marketer to send each message manually.

A practical welcome workflow can include the following stages:

Workflow Stage

Objective & Content

Email 1: Immediate welcome

Confirm the subscription, introduce the publication, and explain what subscribers can expect.

Email 2: Useful resources

Send a curated selection of relevant articles, tutorials, checklists, or other resources.

Email 3: Relevant next steps

Recommend a related guide, demonstrate a product feature, or direct subscribers to an appropriate landing page.

The intervals between these messages should reflect the content, audience expectations, and purpose of the campaign. Avoid sending several emails in rapid succession simply because the software allows it.

Before activating the sequence, test its trigger, timing, links, personalization fields, and exit conditions. Ensure that subscribers do not continue receiving welcome messages after they have unsubscribed or otherwise become ineligible for marketing communications.

Segment Subscribers for More Relevant Campaigns
Sending the same newsletter to every contact can reduce relevance. Segmentation allows marketers to divide an audience into smaller groups according to shared characteristics or recorded activity.

Modern email marketing platforms can support segments based on subscription date, selected interests, previous email engagement, customer status, and other available data. Some platforms also allow combinations of conditions to identify more specific audiences.

Consider a website that publishes content about search engine optimization, email marketing, and link building. Its subscribers may have different professional interests.

The marketing team could create separate segments for:

Readers interested in technical SEO and website audits.

Subscribers seeking email marketing tutorials and automation advice.

Website owners interested in link-building strategies.

Engaged readers who regularly click through to published resources.

New subscribers who have not yet received the introductory sequence.

Each segment can receive content that corresponds to its interests. Someone who subscribes for technical SEO tutorials does not necessarily need every promotional email about an unrelated service.

Segmentation also makes testing more useful. Marketers can compare engagement across groups, identify content that attracts qualified visitors, and adjust future campaigns based on recorded results.

Schedule Newsletters and Automate Content Distribution
Scheduling is one of the simplest ways to reduce the daily workload associated with newsletter publishing. Marketers can prepare content ahead of time, review it, and schedule delivery according to an editorial calendar.

A recurring newsletter might include recent articles, industry developments, practical recommendations, and links to relevant resources. An automated workflow can also distribute selected content when a supported trigger occurs.

For content-driven businesses, an RSS-based email campaign may be useful if the chosen platform supports it. Such campaigns can use an eligible website feed to distribute new publications automatically or according to configured delivery rules.

However, automated distribution still requires editorial oversight. Check article titles, summaries, featured links, formatting, and publication timing before enabling a workflow. A technical error or unsuitable article can otherwise be distributed to the entire targeted audience.

The strongest approach combines automated delivery with human review of content quality and relevance. Automation handles repetitive execution, while editorial judgment determines what deserves to reach subscribers.

Personalize Messages and Use Conditional Workflows
Personalization extends beyond inserting a subscriber's first name into a subject line. It can involve adapting content to a subscriber's selected interests, customer status, or recorded interactions, provided the platform has access to that information.

Conditional workflows allow an automation to follow different paths according to defined rules. For example, a SaaS company might send a product tutorial to new trial users, then direct subscribers who complete a particular onboarding action toward more advanced educational material.

A newsletter publisher could use a similar approach. Readers who click a link to an SEO audit guide might receive a subsequent email featuring related technical SEO resources. Readers who select an email marketing guide could receive a different sequence.

These workflows should rely on accurate data and clear rules. Avoid excessive messaging, unexplained personalization, or conclusions unsupported by subscriber activity. Provide meaningful unsubscribe and preference controls so recipients can manage their communications.

Monitor Deliverability and Protect Sender Reputation
A newsletter campaign produces little value if its messages fail to reach recipients' inboxes. Deliverability depends on several factors, including sender authentication, recipient engagement, list quality, sending practices, and compliance with mailbox provider requirements.

Configure the authentication methods supported by your email service, including SPF, DKIM, and DMARC where applicable. Google publishes specific sender requirements for messages delivered to personal Gmail accounts, with additional requirements applying to bulk senders. These rules should be reviewed against current provider documentation before campaigns are launched.

Maintain sound list management practices by removing invalid addresses, honoring unsubscribe requests, and avoiding purchased contact lists. Monitor spam complaints, delivery failures, and engagement trends.

A sudden increase in sending volume or repeated messages to unresponsive contacts can create deliverability problems. Automation should therefore include sensible eligibility rules and regular list maintenance rather than simply sending messages to every available address.

Track Performance and Improve Campaign Results
Email automation provides data that marketers can use to evaluate campaign performance and identify areas for improvement.

Important metrics include:

Metric

What it measures

Delivery rate

The proportion of sent messages reported as delivered by the platform.

Click-through rate

The proportion of recipients, or delivered messages, that generate clicks, depending on the reporting method.

Conversion rate

The proportion of a defined audience that completes a desired action.

Unsubscribe rate

The proportion of recipients who opt out of future messages.

Bounce rate

The proportion of messages that cannot be delivered.

Revenue attributed to email

Revenue credited to email campaigns under the reporting system's attribution rules.

Interpret these figures in context. Email opens are an imperfect measure because privacy features and automated image loading can affect tracking. Clicks, qualified website visits, completed registrations, and attributable purchases can provide additional evidence of campaign performance.

Use controlled A/B tests to evaluate subject lines, calls to action, content formats, and other variables supported by your platform. Test one principal variable at a time when practical, and evaluate results against a defined objective.

For example, a newsletter promoting an SEO checklist should be assessed by its ability to generate relevant visits and checklist downloads, not merely by the number of messages sent.

Conclusion
Automating email newsletter campaigns with modern autoresponders enables businesses to maintain consistent communication, organize subscribers, distribute content, and measure marketing results with less repetitive manual work.

The process begins with selecting suitable software and building a permission-based subscriber list. From there, marketers can establish welcome sequences, create targeted segments, schedule newsletters, personalize messages, and monitor deliverability. Performance data then informs subsequent improvements.

For digital marketers, SEO professionals, bloggers, and SaaS companies, the objective is to build an email operation that serves subscribers while supporting measurable business goals. Effective automation requires more than a collection of scheduled messages. It requires relevant content, reliable technical configuration, responsible list management, and ongoing evaluation.

When these elements work together, email autoresponders become a practical component of a broader digital marketing strategy, helping businesses nurture audiences, distribute valuable resources, and guide interested readers toward meaningful actions.

Would an independent final-email rule check earn a place beside your existing tests?

Sun, 18 Oct 2026 11:12:47 +0000

I’m cun he, maker of InlinerAPI. If you maintain business receipts, reset messages or invitations, I’d appreciate one current-work comparison: https://inlinerapi.netlify.app/requirements

Use synthetic final rendered HTML and an independently expected copy, displayed amount or CTA destination. The browser preview needs no signup. It checks the supplied content; it does not refresh application data, run your templates, validate tokens, or test inbox appearance or delivery.

What rule did you attempt, what result did you observe, and how did setup and maintenance compare with your existing tests? If it helps recurring work, what would your team need to justify paying for these current checks?

@fuck.it - email with attitude

Tue, 13 Oct 2026 20:35:25 +0000

fuck.it is invite-only email for people who want a memorable address without becoming the product.
We built fuck.it around a simple idea: email should be something you pay for directly, not something subsidized by advertising, tracking or selling access to your data.
Every account gets an fuck.it email address with webmail plus IMAP and SMTP access so it works with standard email clients.

What you get

No advertising
No tracking pixels
No selling user data
Invite-only registration
IMAP and SMTP support
Webmail
Calendar, contacts and tasks
Encrypted connections
German-hosted infrastructure
Multiple storage plans up to 1 TB

Why invite-only?
Open signup attracts bots, spammers and scammers. That eventually hurts everyone on the platform through abuse, reputation damage and worse deliverability.
fuck.it deliberately avoids the free-for-all model. New users need an invitation before they can create an account.

Who is it for?
People who care about privacy, independence and having an email address nobody forgets.
It is not trying to replace every productivity platform on earth. It is email with attitude, built around a straightforward paid relationship between the service and the user.
Website: https://fuck.it

Is Paying for Email Worth It? What Your Money Actually Buys

Tue, 13 Oct 2026 20:29:52 +0000

"If you're not paying for the product, you are the product."

It's a great line. It's also doing a lot of work for people selling things, including us. So let's take it apart properly: what free email actually costs you, what paying actually buys and where even we think paying is the wrong answer.

We sell paid email. Read accordingly. We've still tried to write the version we'd want to read before spending money.

Somebody pays for every inbox. The only question is who and how.

TL;DR

Somebody pays for every inbox. The only question is who, and what they want in return.
Mainstream free mail runs partly on advertising and the data profile that makes it work. Gmail, Outlook, Yahoo, GMX, mail.com: somebody other than you is helping pay the bill.
The ad-free free tiers are paid for too, by the subscribers of the same company. Which rather makes the point.
Inbox data has been sold. Yahoo and AOL scanned more than 200 million inboxes for commercial advertising data, and free email apps have built six-figure datasets from what their users received and bought.
Your inbox is extraordinarily valuable data and AI makes it more useful than ever. What governs its use is a policy, not an architecture, and the settings are confusing enough that even security researchers got them wrong in public.
Email services simply end. Providers have been shutting down and offloading mailbox products for years, and a mailbox nobody pays for directly is the easiest kind to cut.
Paying puts you and the provider on the same side. Your subscription is the revenue, so the product only has to do one job.
What money doesn't buy: immunity from the law, guaranteed delivery, encryption once your message reaches Gmail, or protection from your own mistakes.
The one thing paying doesn't fix: the address still sits on somebody else's domain. Only your own domain changes that.

Somebody Pays for Every Inbox

Running mail is not free. Servers, storage, spam filtering, abuse handling, deliverability work, engineers: all of it costs money every month, for every mailbox, forever. Nobody absorbs that out of generosity.

So when an inbox costs you nothing, the money is coming from somewhere else, and that somewhere decides what the product becomes.

For mainstream free mail, advertising is part of the economics. Gmail, Outlook.com, Yahoo, GMX and mail.com all show advertising in or around their free email products. Microsoft states plainly that free Outlook is supported by ads. GMX says advertising revenue finances its free service. The targeting models differ, and Google says Gmail ads are based on your wider activity rather than your messages. But in every case somebody other than the person reading the mail is helping pay the bill.

For the ad-free free tiers, the answer is other customers. Proton and Tuta give away a limited free account with no ads and real encryption, and they can do it because their paying subscribers cover the cost. Those free tiers are an argument for paid email, not against it. They exist because somebody pays.

Which leaves one model where the person paying and the person using the inbox are the same: you pay, and the only thing the provider has to get right is your mail.

That's it. That's the entire case for paid email, and everything below is detail.

What Actually Happens to Free Email

Let's be precise, because the vague version is easy to dismiss.

Gmail is the interesting case, because the easy accusation is out of date and the real problem is worse.

Google stopped using message content for ad personalization in 2017. It says it does not use Gmail content to train its Gemini models, and it has repeated that denial every time the claim resurfaces.

Now look at what happened in November 2025. A post claiming Gmail had quietly opted everyone into AI training reached millions of people. A respected security firm wrote it up, then published a correction the next day admitting it had confused Gmail's long-standing smart features with generative model training. Google said it had changed nobody's settings. A proposed class action was filed in California alleging Gemini got access to Gmail, Chat and Meet without proper consent, which remains an allegation rather than a finding.

Here's the part that should bother you regardless of who was right. The controls live in several places and Google documents three separate categories of them. Switching them off also removes things like inbox categorization, Smart Compose and summary cards, so the convenient features and the data access share the same switches. And when professional security researchers looked at the interface and couldn't agree on what it did, several hundred million ordinary users had no chance at all.

That's the actual condition of free email in 2026. Not a confirmed conspiracy. Something more corrosive: a system so complicated that "we don't do that with your mail" has become unverifiable by the person whose mail it is.

Your inbox is extraordinarily valuable data. Contracts, purchases, appointments, arguments, relationships and years of natural-language correspondence, all in one searchable place. AI makes that data more useful than it has ever been.

Google says it does not use personal Gmail messages to train its foundational Gemini models. The concern is broader than training. Depending on your settings, your mail can already be processed to categorize messages, generate replies, summarize threads and power personalized features across Google's products.

"We don't use your mail to train our models" is an important promise. It's also a policy commitment layered over a system that can technically process the mail. The architecture hasn't made the question irrelevant, it has just moved it into a settings menu.

A subscription-funded inbox doesn't need to monetize that processing to pay for the mailbox. That's the difference.

Everyone Else Is in the Same Business

Microsoft. In January 2026 a bug let Microsoft 365 Copilot Chat read and summarize emails that users had explicitly labelled confidential, bypassing the data-loss-prevention rules designed to stop it. Microsoft confirmed it and fixed it. In the same period the European Parliament's IT department switched off built-in AI features on lawmakers' devices, citing the risk of confidential correspondence being uploaded to the cloud. Those were paying enterprise customers with compliance controls turned on. If the guardrails leak there, think about what the free consumer tier looks like.

Yahoo and AOL. The clearest documented case. In 2018 the Wall Street Journal reported more than 200 million inboxes being scanned for commercial data sold to advertisers, sorting people into categories like "frequent traveler" from their receipts and booking confirmations. Only mail from companies, Yahoo said, and you could opt out. It was on by default.

Free email apps. In 2020, Edison Mail, Cleanfox and Slice were all shown to build commercial products out of their users' inboxes: purchase data extracted, aggregated and sold to corporate clients, with one dataset reportedly priced above $100,000. Edison's homepage said "No Ads, Just Mail." Perfectly true. The money came from somewhere else.

And the one nobody warns you about: email services simply end. Telecoms and internet providers have been shutting down or offloading mailbox products for years. Turkcell, for example, says its Mailim service closes completely on 31 October 2026 and that stored data becomes inaccessible after 1 December.

The problem is sharpest when email is bundled into something else. If nobody is paying specifically for the mailbox, it's easy to treat as a cost centre when priorities change. It's always somebody's line item, and line items get cut.

What Free Actually Costs

Forget the monthly price. These are the costs that show up later.

Ads in the place you read your mail. Promotions tabs, sponsored messages, inline units dressed up as email. You've stopped noticing them, which is exactly what makes them valuable.

A profile that outlives the inbox. Even where message content isn't used for targeting, your activity feeds the same advertising machine that funds everything else. The inbox is one input among many.

Deletion for inactivity. Google may delete personal accounts after two years of inactivity. Microsoft closes accounts not signed into for two years. A free account expects you to keep proving you exist, and quietly takes your address back if you don't.

Suspension with no appeal. Automated systems close accounts, sometimes wrongly. When mail, photos and documents all sit behind one free account, a bad automated decision takes all three at once, and your route back is a web form.

Storage you share with everything else. On Gmail, 15 GB covers mail, Drive and Photos together. Fill it with holiday videos and your mail stops arriving.

Changes you don't get a vote on. Gmail is ending Send As for outside addresses in January 2027. Yahoo cut free storage. AI features arrive switched on and the opt-out takes your inbox categorization with it. The product serves a strategy and you're not part of it.

An inbox that keeps becoming something else. Mail was a product. Then a tab in an ecosystem. Now an AI surface. Nobody asked the people reading their mail whether they wanted any of it.

What Paying Actually Buys

Here's the part where paid providers usually get vague. Specifics:

An actual support relationship. Not automatically a good one. Plenty of paid providers have terrible support and some free services do better than they need to. But paying puts you on the other side of a relationship where losing you costs something, and that changes what happens when your account locks on a Friday afternoon.
A business model that points the same way you do. If the money comes from subscriptions, the incentive is to keep you subscribed. If it comes from advertising or ecosystem lock-in, the incentive is to keep you engaged and inside. Neither is sinister. They just produce different products over ten years.
No ads in your inbox. Worth stating plainly, with the caveat below that a couple of free providers manage this too.
Storage built around your account, not an advertising ecosystem. Your mailbox capacity isn't competing with Google Photos or a consumer cloud bundle.
An account that doesn't expire just because you're quiet. A paid mailbox generally isn't going to disappear because you haven't logged in for two years.
The practical features. Proper IMAP, POP3 and SMTP access, so any mail client works. Aliases. Decent attachment limits. Export that isn't a maze. These vary by provider, so check rather than assume.
A provider small enough to care about your complaint. Not always true, but more likely when your subscription is a visible fraction of revenue rather than a rounding error.

What Paying Does Not Buy

Any provider telling you otherwise is selling harder than we are.

It doesn't buy immunity from the law. A provider in any jurisdiction responds to valid legal orders. Paid doesn't mean untouchable, and anyone implying it does is lying to you.

It doesn't buy privacy from the person you're writing to. Send mail to a Gmail address and it lands on Google's servers under Google's rules. Encryption in transit protects the journey, not the destination.

It doesn't buy guaranteed delivery. No provider controls what the receiving server does. Anyone promising inbox placement is promising something they don't own.

It doesn't buy protection from phishing. Good filtering helps. A convincing message from a real address, properly authenticated, still gets through to everybody.

It doesn't automatically buy better security than free. Several free providers have excellent security. Price is not a proxy for engineering.

The Thing Nobody Selling You Email Wants to Mention

Here's the strongest argument against paying us, and against paying any provider for an address on their domain.

If your address is *Emails are not allowed*, you don't control the domain behind it. Google does.

But if your address is *Emails are not allowed*, you don't control that domain either. We do. If we go out of business, get bought by somebody terrible or simply decide to stop, you're moving addresses and telling four hundred accounts about it, exactly as you would be if Google shut Gmail down.

Paying changes the incentives. It doesn't change who holds the domain.

The only setup that genuinely puts your email address under your control is your own domain plus a provider you can replace. Then switching providers is a DNS change and nobody has to update anything. That's the real answer to "my email is infrastructure," and for a basic domain it can cost little more than ten or twenty euros a year, plus the discipline to never let the registration lapse.

It also isn't something we sell. We don't do custom domains, because the whole point of a fuck.it address is that it says fuck.it. If maximum portability is what you're after, we're the wrong shop and you should go buy a domain.

Credit Where It's Due

Two free tiers are worth naming, because pretending otherwise would be dishonest and you'd catch us at it.

Proton Mail and Tuta both offer free accounts with no ads and genuine encryption. Small storage, limited features, and both funded by the people paying for the full version. If budget is the binding constraint, they're a far better answer than an ad-supported inbox.

And Gmail, as a piece of software, is excellent. Best-in-class search, enormous app support, rock solid. We're not going to insult your intelligence by pretending it's badly built. The question was never whether it works. It's what it's for, and who it's for.

When Free Is Good Enough

Stay where you are if:

Email is a utility you think about twice a year.
Nothing load-bearing is attached to the address: no bank, no business, no clients.
The budget genuinely matters. A paid inbox is a luxury next to rent, and anyone implying otherwise is out of touch.
You're on one of the ad-free free tiers above and the storage limit doesn't bite.

When Paying Makes Sense

Your address is infrastructure. It's the recovery key for your bank, your password manager and a few hundred accounts. That deserves better than a free tier and an automated support queue.
You want out of an ecosystem. Separating your email from one company's account system is the first real step, and it's hard to do on a free tier run by that same company.
You need someone to answer. If a week without working email would cost you real money, buy a support channel.
You want the terms to stay still. Paid services change too, but they change with their customers in mind, because customers cancel.
You'd rather pay with money than attention. Perfectly respectable reason, and the honest version of the slogan at the top.

How to Judge a Paid Provider

If you decide to pay, the price is the least interesting question. Ask these instead:

Can you leave? IMAP access and a real export. If getting your mail out is hard, the lock-in is just a different flavor.
Who actually runs it? A named company in a jurisdiction you can find, not a landing page.
What happens if you stop paying? Grace period, read-only access, immediate deletion? Find out before, not after.
Is the storage honest? Shared across services or just mail?
What's the support promise? Email only, response times, and whether a human exists.
What do they claim they can't see? Then check whether the architecture supports the claim, or whether it's a promise in a privacy policy.
How long have they been around, and does the pricing look like a business or a land grab? Services with no revenue model die, and you have to move again.

Where [@fuck.it] Lands

No ads. No tracking. No bullshit. That isn't a slogan we picked because it sounded good, it's a description of our revenue: subscriptions, all of it. There's no second business, no ad network, no profile worth building and nothing to sell to anyone else, because selling you email is the entire company.

What that buys you: a mailbox whose storage isn't shared with a photo library, full IMAP, POP3 and SMTP access, a person on the other end of support, and an account that doesn't expire because you went quiet for a year.

What we won't pretend: we can't give you a custom domain, so your address lives on our domain and depends on us continuing to exist. We can't promise anything about legal process that any other provider can't. If portability above all else is what you're after, go buy a domain.

But let's be honest about what you'd be giving up. Nobody has ever raised an eyebrow at a gmail.com address. Nobody ever will. Ours is the best domain on the internet and the only one that tells people something about you before they've read a word. There's a reason you remember it.

An address on your own domain says you own a domain. An @fuck.it address says something else entirely.

See plans →

Sources & further reading:

Related reads:

This article was originally published on the [@fuck.it] blog at https://fuck.it/blog/is-paid-email-worth-it and is republished here by the author. [@fuck.it] is a privacy-focused, subscription-funded email service by Paradise Circus, Inc. — no ads, no tracking. Facts and product details are accurate as of October 13, 2026; check the original for the latest version.

How to Deduplicate Leads in n8n Before They Reach Your CRM

Sun, 11 Oct 2026 15:50:00 +0000

Lead deduplication is not one filter. A reliable n8n workflow separates repeated submissions from repeated people, normalizes the values used for comparison, checks persistent records, and lets the CRM enforce uniqueness whenever the destination supports it.

Partner disclosure. This guide includes a partner link to n8n Cloud. If you sign up through it, I may earn a commission at no extra cost to you.

Short answer: use a stable source ID to stop the same event twice, normalized email or phone to find an existing person, and a CRM-native create/update or upsert operation for the final write. Never auto-merge two records on name alone.

First identify which duplicate you are stopping

Duplicate type	Example	Best first control
Repeated item in one execution	A spreadsheet import contains the same row twice	Remove Duplicates on the current input
Repeated source event	A webhook or retry delivers submission `lead_8472` again	Persistent check on the stable source ID
Same person from another source	The same customer submits a website form after a Facebook form	Normalized identity lookup in the CRM
Conflicting identity	Email matches one contact while phone matches another	Human review, not an automatic merge

The Facebook Lead Ads workflow uses a Meta lead ID to stop one submission from creating several sheet rows. This guide goes further by handling several sources and an existing CRM full of contacts.

Choose identity keys before building nodes

Key	What it proves	Rule
Source record or submission ID	The same source event or object	Strongest key for replay protection, but not for matching a person across systems
Normalized email	Usually the same inbox	Good exact contact key when present and valid
Normalized phone	Usually the same reachable number	Useful with country context; shared business or family numbers need caution
Name	Only that the text looks similar	Use as review context, never as the only automatic merge key

Decide field ownership too. A new form may fill a missing phone number, but it should not silently replace a verified CRM email, owner, lifecycle stage, or consent value. Deduplication decides which record to use. A separate update policy decides which fields may change.

A practical n8n workflow shape

Lead trigger
  → Edit Fields: normalize keys
  → Remove Duplicates: current batch or repeated event
  → Data Table or CRM: persistent lookup
  → Switch: new / exact match / conflict
  → CRM: create or update
  → Data Table: record source key and CRM ID
  → Alert only when review or failure is needed

Start with one lead source and one CRM. The same pattern can later sit behind Facebook forms, website forms, imports, chat, and email without giving each source a different duplicate policy.

Step 1: normalize the fields once

Add an Edit Fields node immediately after the trigger. Preserve the original values for audit and display, then create separate comparison fields:

source_key
email_original
email_key
phone_original
phone_key
full_name
source
received_at

For an email comparison key, an n8n expression can trim whitespace and use lowercase:

{{ ($json.email || '').trim().toLowerCase() }}

Build source_key from the provider and its stable ID, for example facebook:lead_8472 or website:submission_193. Do not concatenate name and timestamp and call that stable. For phone numbers, remove presentation punctuation and normalize with the correct country context. Simply stripping every non-digit character can make two different international numbers look deceptively similar.

Step 2: use Remove Duplicates for the narrow job it does well

For duplicate rows arriving together, configure Remove Duplicates → Remove Items Repeated Within Current Input, choose Selected Fields, and compare source_key. This is ideal for imports and batched records.

For the same source event arriving in later executions, the node also supports Remove Items Processed in Previous Executions. Use Value Is New and deduplicate on source_key. Scope can be the individual node or the workflow. Current n8n documentation says the default history size is 10,000 items.

Do not treat that history as your customer database. The history has a configured size, can be cleared, and only knows the values you gave that node or workflow. It cannot decide that two different source IDs belong to the same person.

Step 3: add a persistent lookup

Option A: n8n Data Table for a small lead ledger

A Data Table is a practical first version for a small business that does not yet have strong CRM lookup rules. Create a table such as lead_identity with these columns:

source_key
email_key
phone_key
crm_id
status
first_seen_at
last_seen_at

The current Data Table node can check whether a row exists, get rows, insert, update, and upsert using conditions. Search the strongest available key before the CRM write, then upsert the final crm_id only after the CRM succeeds.

n8n describes Data Tables as light to moderate storage. The default total limit across all tables in an instance is 50 MB, although self-hosted instances can change it. That makes a table useful as a compact identity ledger, not a replacement for a mature CRM or warehouse.

Option B: search the CRM directly

If the CRM already owns the customer record, query it first. The current n8n HubSpot node, for example, supports searching contacts and a Create/Update a contact operation. Other CRM nodes expose different operations, so check the destination's exact contract before copying a pattern.

Prefer a CRM record ID or custom unique source ID once you have one. HubSpot's current Contacts API can retrieve by email and batch upsert by email or a custom unique identifier. It also notes that partial upserts are not supported when email is the identifier, which is one reason not to send an incomplete payload blindly.

Step 4: route new, matched, and conflicting leads

Use a Switch node with three explicit outcomes:

No match: create the contact, then save the returned CRM ID with the source key.
One safe match: update only allowed fields and attach the new source or submission as an activity.
Conflict: do not create or merge automatically. Send the candidate record IDs and incoming values to an owner for review.

A conflict includes more than two search results. It also includes email matching contact A while phone matches contact B, or a source ID pointing to a record whose verified identity now disagrees with the payload. Preserve the lead and notify someone. Silent deletion is not deduplication.

Step 5: make the CRM write duplicate-safe

Use the destination's create/update or upsert operation when it can enforce a unique identifier. This is stronger than a separate search followed by create because two n8n executions can run at nearly the same time, both see no result, and both create a contact before either writes the ledger.

If the CRM cannot upsert atomically, use its unique-field constraint, serialize the critical section, or put the identity key in a database with a unique index. Catch the destination's duplicate response and retrieve the existing record instead of treating every conflict as an unrecoverable failure.

After a successful write, upsert the source key and returned CRM ID into the Data Table. Then send notifications or start follow-up. This ordering prevents the team from receiving a success alert for a contact that never reached the CRM.

Test with a small duplicate matrix

Test	Expected result
Same source ID delivered twice	One CRM record; the replay is stopped or attached without another create
Different source ID, same normalized email	Existing contact updated according to field rules
Same phone with different formatting	One candidate after country-aware normalization
Same name, different email and phone	New record or manual review, never an automatic merge by name
Email matches A, phone matches B	Conflict branch with both record IDs visible
Two identical executions started together	One destination record because the final write enforces uniqueness
CRM write fails	No success alert and no ledger row marked complete

Common mistakes

Comparing raw email or phone values without normalization.
Using name as a unique key.
Assuming a source submission ID identifies the same person across every channel.
Dropping duplicates without recording the new campaign, form, message, or timestamp.
Overwriting verified CRM fields with blank or lower-confidence form values.
Running search and create concurrently without a destination uniqueness control.
Using a temporary in-workflow list as the only long-term duplicate barrier.

Useful questions before publishing

Can Remove Duplicates replace a CRM lookup?

No. It is useful for repeated items and remembered values, but it does not understand an existing customer record, alternate email, shared phone, merge history, or field ownership.

Should email or phone be the main key?

Use the strongest verified identifier your process reliably collects. Email is often the simplest contact key. Phone can be useful after country-aware normalization. Keep a stable source ID for replay protection even when email is the CRM match key.

Should a duplicate lead be discarded?

Usually not. The person may have submitted a new service request or responded to a different campaign. Reuse the contact record, then preserve the new submission as an activity, note, deal, or source event.

Privacy and operating rules

Store only the identity fields needed for matching and follow-up.
Restrict Data Tables, execution data, and CRM credentials to the responsible project members.
Set retention rules for rejected and ambiguous records.
Do not place full lead payloads in chat alerts when a secure CRM link is enough.
Document who resolves conflicts and how quickly the review queue should be checked.

For retries around state-changing API calls, use the separate duplicate-safe n8n API retry pattern. That guide protects one operation from being repeated. This guide protects CRM identity across leads and sources.

Sources checked

n8n Cloud for small teams

Test the duplicate guard without maintaining a server

n8n Cloud is the simplest place to build this workflow if you want to focus on the lead logic instead of hosting. Affiliate disclosure: I may earn a commission if you sign up through this link, at no extra cost to you.

Try n8n Cloud

Need the CRM identity rules mapped?

Send the lead sources, available IDs, CRM, match fields, and examples of known duplicates. I will help define the new, matched, and review paths before the workflow writes production records.

Map the duplicate guard

Originally published on FloxoLab.

The Nigerian Prince: A Brief History of the Internet's Most Famous Scam

Tue, 06 Oct 2026 14:52:59 +0000

Originally published on the fuck.it blog

Everyone has had the email. A prince, a general, a dying widow, a bank official with a dead client and no next of kin. Millions of dollars, trapped. You, a complete stranger, are the only person who can help. There will be a small fee.

It is the most mocked email in history. It has its own punchlines, its own Wikipedia article and its own genre of parody. It also has a proper name: advance-fee fraud, a con in which the victim pays something small to unlock something large that doesn't exist.

Here's where it came from, why the stories are so hard to believe, what it turned into and what to do if it already got you.

TL;DR

The con is centuries older than email. It circulated on paper as the
Spanish Prisoner letter.
"419" is a section of the Nigerian criminal code, the one covering
fraud. The name stuck in the 1980s, when economic collapse turned the
scam into an industry.
One proposed explanation for the absurd stories: a 2012 paper argued
that implausible emails can serve scammers well, by weeding out
everyone except the most promising respondents.
The country in the story tells you nothing about who actually sent
the message.
It never went away. A family of related scams grew up around it:
redirected invoices, romance scams and crypto platforms where your
balance only goes up.
Already paid? Stop, contact your bank or payment provider
immediately, keep everything and report it. Some payments can still
be recovered.

The Letter Before the Email

Long before anyone had an email address, there was the Spanish Prisoner.

The setup went like this. A letter arrives from a stranger. A wealthy man of high birth is imprisoned in Spain under a false name. His identity can't be revealed. If you help pay for his release, you'll be rewarded many times over from his hidden fortune. There's also, in many versions, a beautiful daughter.

Variants are documented back to the era of the French Revolution. The New York Times covered it in 1898 under the headline "An Old Swindle Revived" and it was already old news then. The paper described letters written the way educated foreigners speak English, with the occasional misspelling and an odd turn of phrase.

The ingredients were all there and haven't changed since: a fortune you can't verify, a stranger who needs you specifically, a reason for secrecy and a modest payment up front against an enormous payoff later.

Why Nigeria

In the 1970s Nigeria was flush with oil money. In the early 1980s the oil price collapsed and the economy went with it. What followed was mass unemployment among educated young people, a currency in freefall and a government widely described as spectacularly corrupt.

Out of that came the letters. Millions of them, physically mailed around the world, often using counterfeit postage. They arrived with official-looking documents, letterheads from the central bank and occasionally the United Nations. The story was usually the same: money from an overinvoiced government contract or a dead dictator's estate, stuck in an account and needing a foreign partner to move it.

The scam picked up its nickname from Section 419 of the Nigerian criminal code, the part covering obtaining property by false pretences. In Nigeria the practice became known as "yahoo yahoo."

Then came the fax machine, which was cheaper than postage. Then came email, which was cheaper than everything.

Email Changed the Arithmetic

Paper costs money. Every letter is a bet: stamp, envelope, printing. Send a million and you've spent a fortune before anyone replies.

Email took the cost of sending one more message down to almost nothing, which means a very low success rate can still be profitable. The expense moves elsewhere, into the hours spent on people who reply but never pay.

That's the real reason the 1990s and 2000s were flooded with princes. Not because the story got better, but because distribution became almost free.

One thing worth keeping straight: the country named in the story is no guide to who sent it. These messages are routed through compromised machines and services all over the world, and "Nigerian prince" long ago became a template anyone could download. Treat the flag in the letter as part of the costume.

The One That Actually Worked

For all the jokes, the amounts involved were sometimes staggering.

It began with a fax. Between 1995 and 1998, Nelson Sakaguchi, a director at Brazil's Banco Noroeste, sent around $190 million out of the bank's accounts, chasing a promised contract to build a new airport in Abuja. He believed he was greasing the wheels of a Nigerian government deal. Counting interest and costs, the case is usually cited at about $242.5 million.

Nobody noticed until an audit in early 1998, carried out while the bank was being prepared for sale to Santander. It remains one of the largest advance-fee frauds ever recorded.

So: a director at a national bank, over three years, for nine figures. The victims of this con were never only the naive.

Why the Stories Are So Implausible

Here's the part that sounds like a joke and isn't.

In 2012, Microsoft researcher Cormac Herley published a paper with the magnificent title "Why do Nigerian Scammers Say They are from Nigeria?" His argument is an economic model rather than a confession from any scammer: implausibility can work in the sender's favor.

Think of it from the scammer's side. Sending email is nearly free, but replying isn't. Every conversation takes hours of work and most go nowhere. The expensive part of the business is time spent on people who were never going to pay.

On that model, the opening email functions as a filter. It would need to repel everyone who would eventually back out and keep only the people who might go all the way. A story about a Nigerian prince and twenty million dollars would do that job well: anyone who finds it ridiculous never replies, and the few who don't find it ridiculous have identified themselves as promising prospects.

It's a theory about incentives, not a proven account of how any particular scam was written. But it's the most convincing explanation anyone has offered for why the most mocked emails on earth never got better.

The People Who Fought Back by Wasting Their Time

In 2003, a British man named Michael Berry launched 419eater.com, and a sport was born: scambaiting.

The idea was to answer the emails and keep the sender busy as long as humanly possible. Baiters invented elaborate characters, fake charities and absurd conditions. The site's famous "trophy room" collected photographs that baiters had persuaded scammers to take as proof of good faith, often holding ridiculous signs. One celebrated bait, later featured on This American Life, ran for about 100 days and involved persuading a scammer to travel across Africa for money that did not exist.

It's funny. It was also always a bit uncomfortable. Plenty of baiting slid into humiliation of poor people in West Africa by comfortable people in Europe and North America. Sending someone into a conflict zone for a laugh is also hard to defend, whatever they did for a living.

In 2005, the Ig Nobel Prize for Literature went to the internet entrepreneurs of Nigeria, for enriching world literature with short stories full of rich characters, dramatic plots and money that never arrives.

What It Turned Into

The prince still circulates, but the money has mostly moved to quieter formats. These aren't all the same con. They're relatives, built on the same raw material: a trusted-looking story, time pressure and a payment that's hard to claw back.

Business email compromise. No prince. An invoice from a supplier you
actually use, with changed bank details, arriving when you expected
it. The goal isn't to promise you a fortune, it's to redirect a
payment you were already going to make. It's one of the costliest
forms of email fraud there is.
Romance scams. Months of real conversation, then a crisis. Sometimes
there's a promised payoff, often there's just an emergency and
someone you believe you know.
Investment and crypto scams. Closest to the original. The fortune
sits in an account you can watch grow and withdrawing it requires a
fee. Then a tax. Then another fee.
Recovery scams. The cruelest branch. Someone contacts a victim
offering to recover the money they lost, for a fee paid up front.
Lists of people who have already paid once are valuable precisely
because they've already paid once.

How to Spot the Shape

The stories change. Several signals don't.

An unexpected windfall from someone you didn't know, for reasons you
can't independently check.
A payment to a stranger to release it. Legitimate inheritances really
can involve taxes and legal costs, but those are handled by an
executor or an institution whose identity you verified yourself. A
prize or a lottery win is different: being asked to pay anything to
claim one is a scam, every time.
Secrecy. Don't tell the bank. Don't tell your family. Every version
of this works by keeping you away from anyone who would say "that's a
scam."
Payment methods that are hard to reverse. Wire transfers, gift cards,
crypto. That's not a coincidence.
Urgency. A deadline exists so you don't have time to check anything.
Changed bank details. Any invoice with new account numbers gets a
phone call first, to a number you already had, never the one in the
email.

If You've Already Paid

This matters more than any of the history above and speed matters.

Stop paying. There is never a final fee. The next request will have a
new and excellent reason.
Contact your bank or payment provider immediately, whatever you paid
with. Some payments can be stopped, recalled or disputed and the odds
fall with time.
Keep everything. Emails, headers, account numbers, chat logs,
receipts. Don't delete the correspondence out of embarrassment.
Report it to your national fraud or consumer protection body and to
the police. Reports are how patterns get traced, even when individual
money doesn't come back.
Expect a second approach. Someone may offer to recover your money for
a fee. That's the same con, wearing a rescue uniform.

And for what it's worth: people who fall for this are not stupid. A bank director lost nine figures to it. The con is old because it works on normal human reasoning under time pressure.

Why It Keeps Going

Email filtering has become very good and the crude versions mostly die before you see them. That didn't end the con, because the con was never really about email.

It's about a person believing a story. The Spanish Prisoner worked by post, by telegram, by fax and by email, and it works now over messaging apps and dating sites. Every time a new channel opens, the same letter walks through the door in new clothes.

The same offer, for centuries. There is a fortune. It is nearly yours. It needs just one small payment first.

Where [@fuck.it] Lands

Our filtering kills the obvious material before it reaches you, along with phishing, fake invoices and the rest of the daily sewage. That reduces your exposure. It doesn't reduce it to zero and anyone promising otherwise is selling something.

The hard version has no links, no attachments and no malware. It's a plain message from a real address, properly authenticated, asking a reasonable question. Modern filters look at more than malware: impersonation patterns, unusual correspondents, display names that don't match their addresses. Those signals catch a lot. They don't catch everything and passing SPF, DKIM and DMARC only proves a message came from the domain it claims, not that the request inside it is honest.

So when money and urgency show up in the same message, slow down and verify through a channel you chose yourself.

Disclosure: We run fuck.it, an email service, so we see a lot of this in the filters. Make of that what you will.

IMAP vs POP3: Which One Should You Actually Use?

Sun, 04 Oct 2026 21:12:52 +0000

Somewhere in every mail app's setup screen there's a question most people answer by guessing: IMAP or POP3?

If you guessed wrong, you probably found out later. Your phone showed emails your laptop had never heard of. You deleted something on one device and it lived on, undead, on another. Or you replaced your laptop and ten years of mail went to the recycling center with the old one.

Here's what the two actually do, which one you want and the one situation where the old one still earns its place.

TL;DR

IMAP keeps your mail on the server and syncs it to every device. Read
it on your phone, it's read on your laptop. Use it by default.
POP3 downloads your mail to one device and usually deletes it from
the server. Simple, offline, single-device.
Neither one sends mail. That's SMTP's job, and you need it either
way.
Use POP3 only if you read mail on one computer, want your archive
stored locally and are prepared to back it up yourself.
Gmail's POP news is about Gmail fetching other accounts, not about
your mail app. Apps can still connect to Gmail with either protocol.

The Post Office vs. the Filing Cabinet

The names give it away.

POP stands for Post Office Protocol, and it works like a post office box. You go in, empty the box and take everything home. What happens to the letters after that is your business. The post office neither knows nor cares.

IMAP, the Internet Message Access Protocol, is more like a filing cabinet that stays at the post office. You can read letters there, sort them into drawers, flag the important ones and leave everything in place. Come back through a different door with a different key and you'll find the same cabinet in the same state.

That's the whole difference. Everything else follows from where the mail lives.

Two rows of devices. In the top row, a phone, laptop and tablet all show the same email inbox. In the bottom row, only the laptop has messages while the phone and tablet are empty.
Same account, two protocols. One of these is why your phone thinks you have no email.

POP3: Download and Done

POP3 does one thing: it fetches the messages in your inbox and hands them to your mail app. It was built for download-and-delete, and the people who maintain the standard have said explicitly that's what it should stay.

In practice:

It only sees your inbox. Folders on the server don't exist as far as
POP3 is concerned.
Nothing syncs back. Read, flagged, moved, deleted: all of that
happens on your device only.
"Leave a copy on the server" isn't sync. It helps, but your phone and
laptop each download their own copy and keep their own separate
opinions about it.
Sent mail stays put. It lives on whichever device you sent it from.

The upside is simplicity. Your mail sits on your own disk, readable offline, independent of the provider.

IMAP: One Mailbox, Every Device

IMAP was designed in 1986 for exactly the thing POP3 doesn't do: working with a mailbox that stays on the server. The current version, IMAP4rev2, was published in 2021.

In practice:

Everything stays in sync. Read status, flags, folders, deletions:
change it on one device and every other device agrees.
All your folders are there, including Sent, Drafts and Archive.
New device, same mailbox. Sign in and your mail is there. Nothing to
copy.
Offline still works. Your app keeps a local copy for speed and
offline reading, but the server holds the real thing.

The downside: you depend on the server. Your storage quota applies to everything you keep, and if the provider is down, you're reading whatever your device has stored.

Neither One Sends Mail

A common source of confusion: IMAP and POP3 only receive. Sending is handled by SMTP, a separate protocol with its own server settings.

Every mail app asks for both: an incoming server (IMAP or POP3) and an outgoing server (SMTP). If you can receive but not send, check the SMTP settings first.

So Which One?

Use IMAP if:

You read mail on more than one device. That's almost everyone with a
phone.
You want folders, flags and read status to follow you.
You don't want to lose your mail when a laptop dies.

POP3 still makes sense if:

You read mail on exactly one computer and like it that way.
You want your archive on your own disk rather than a provider's
server.
You're up against a storage limit and want the server emptied
regularly.

There's a privacy argument for POP3 too: mail you've downloaded and deleted from the server isn't sitting there anymore, apart from whatever backups the provider keeps for a while. It's a fair point with a catch. Your computer now holds the only copy. If it's stolen, broken or unencrypted, that's on you. Encrypt the disk and back it up, or your privacy win turns into a data-loss plan.

Settings Cheat Sheet

Your provider lists its exact server names. The ports are usually standard:

IMAP: port 993, SSL/TLS
POP3: port 995, SSL/TLS
SMTP: port 465 with SSL/TLS, or 587 with STARTTLS

Always pick an encrypted option. If your app offers "None" as a security setting, that's the one not to choose. Your password would travel in plain text.

Switching From POP3 to IMAP Without Losing Anything

If you've been on POP3 for years, your old mail probably lives only on your computer. Here's how to move it without an accident:

Back up first. Copy your mail app's data folder or export your
mailbox before you touch anything.
Add the same address again as an IMAP account alongside the POP3 one.
Don't remove the POP3 account yet.
Drag your local folders into the IMAP account. That uploads them to
the server. Big archives take a while.
Check the server copy. Log in to webmail and confirm the folders and
message counts match.
Only then remove the POP3 account. In some apps, removing an account
also deletes its locally stored mail. That's exactly why steps 1 and
4 come first.

About Gmail "Dropping POP"

You may have read that Gmail is dropping POP. That's about Gmail's own "Check mail from other accounts" feature, which used POP to pull mail from other providers into Gmail. It stopped taking new users after the first quarter of 2026 and ends completely in January 2027.

It doesn't affect mail apps connecting to Gmail. Google says third-party apps can still reach Gmail over POP or IMAP. POP3 as a protocol isn't going anywhere. It's just losing one of its bigger fans.

The full story is in our guide to Gmail's Send As changes.

Where [@fuck.it] Lands

Every [@fuck.it] account includes IMAP, POP3 and SMTP, so the choice is yours. We recommend IMAP: it keeps your phone, laptop and webmail in sync, so whatever you do in one place shows up everywhere else.

If you prefer POP3, that works too. Just remember that mail downloaded and deleted from the server won't be in your webmail anymore, and your device holds the only copy. Back it up.

Why your cold emails are landing in spam (and how to actually fix it)

Wed, 30 Sep 2026 11:22:42 +0000

You wrote a good email. You checked the spelling. You hit send on 200 of them this morning. And somehow, most of them are sitting in a folder nobody opens.

If you have ever wondered why your emails go to spam with no warning and no explanation, you are not imagining it and you are not alone. Cold email deliverability is not one setting you flip on. It is six or seven small things, and mailbox providers do not tell you which one you got wrong. This guide walks through every real cause, in the order worth checking, with a free way to test each one.

Quick answer

Most cold email lands in spam for one of six reasons: a missing or broken SPF, DKIM or DMARC record; a new domain or inbox that never warmed up; wording that trips spam filters; sending too many emails too fast from too few accounts; a bounce or complaint rate that is already too high; or no real one-click unsubscribe. Fix the technical record first, then warm up, then watch your pace and your numbers.

1. Your SPF, DKIM or DMARC record is missing or broken

This is the most common cause, and the easiest to check.

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. When a message arrives, the receiving server looks at the envelope sender domain, the address used in the SMTP MAIL FROM command, fetches the SPF record for that domain, and checks whether the sending IP is listed. If it is not, and the record ends in -all, the message typically fails and gets rejected or spam foldered. SPF records also have a hard limit of 10 DNS lookups. Stack enough include: statements from different tools and you can quietly blow past that limit without any error message.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The receiving server checks that signature against a public key published in your DNS. If the message was altered in transit, or the signature does not match, DKIM fails.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the layer that ties the two together. It tells receiving servers what to do when SPF or DKIM fails on a message claiming to be from your domain, and it is checked against the visible From header, the address a recipient actually sees, not the hidden envelope address SPF checks. A domain can pass SPF and still get flagged if DMARC alignment fails.

Most people set up SPF once, when they first configure their sender, and never check it again. Then they add a new tool, a new subdomain, or a new sending platform six months later and the record silently breaks.

Check yours for free: SPF checker · DKIM checker · DMARC checker

2. You're sending from a domain or inbox that never warmed up

A brand-new domain, or a new mailbox on an old domain, has no sending history. Mailbox providers do not know if you are a real person or a spam operation on day one, so they place mail from unknown senders with extra caution, regardless of how clean your SPF and DKIM are.
A gradual warmup, typically 2 to 4 weeks, spread across a slowly increasing daily volume, is what builds that reputation before you send at full scale. Skip it and send 500 cold emails from a domain that is three days old, and you will likely see most of them land in spam even though nothing is technically misconfigured.

Build a warmup schedule for your target volume: Warmup schedule generator

3. Your email reads like spam to content filters

Spam filters score the actual words, formatting and structure of your message, separately from your domain's reputation. All caps in a subject line, certain phrases mailbox providers associate with spam, excessive links, image-only bodies, or a mismatch between your display name and your actual sending domain, all raise that score.

None of this is guesswork you have to do by eye. A spam word checker scans your subject and body against known trigger patterns before you send, the same category of check a filter would run on the other end.

Scan your draft before sending: Spam word checker

4. You're sending too many emails, too fast, from too few accounts

Every mailbox provider enforces a sending cap, and it exists for exactly this reason: a sudden burst of outbound mail from one account is the clearest signal of automated sending a filter can see. Google Workspace paid accounts, for example, are capped at 2,000 messages per user per 24 hours, and that is a ceiling, not a target. All providers can throttle you below their published cap if your bounce rate climbs above roughly 5 percent or your complaint rate above roughly 0.1 percent, so the practical safe volume is often lower than the number on the page.

Spacing sends at a human pace, and rotating across multiple sender accounts instead of pushing everything through one, keeps you well inside those limits instead of testing them.

See the real caps for your provider: ESP sending limits reference

Your bounce or complaint rate is already too high

This compounds every other problem on this list. A high bounce rate usually means your list has stale or invalid addresses. A high complaint rate means real people are marking your mail as spam, which mailbox providers weight far more heavily than a simple unsubscribe. Once either number climbs, providers start routing more of your mail to spam by default, on top of anything else already working against you, and that reputation damage does not reset the moment you fix the underlying cause.

Verifying your list before you send, and keeping an eye on your infrastructure score as a whole, catches this before it becomes a reputation problem.

Check your overall score: Email infrastructure grader

6. You don't have a working one-click unsubscribe

Gmail and Yahoo both require bulk senders to support one-click unsubscribe (RFC 8058), and mail that does not comply gets penalized independent of everything else. Beyond the compliance angle, a real unsubscribe link reduces the single strongest negative signal you can send: someone hitting spam instead, because leaving your list was harder than that one click.

The six-cause checklist

Broken SPF, DKIM or DMARC. Check it with a free checker, takes seconds. Fix it by correcting the DNS TXT records with your domain host.

No warmup on a new domain or inbox. Check it by comparing domain or inbox age against your sending volume. Fix it with a 2 to 4 week gradual warmup schedule.

Spam-triggering wording. Check it by running your draft through a free spam word scanner. Fix it by rewriting the subject line and any flagged phrases.

Sending too fast from too few accounts. Check it by comparing your volume to your provider's caps. Fix it by throttling sends and rotating sender accounts.

High bounce or complaint rate. Check it by verifying your list and reviewing your infrastructure score. Fix it by cleaning your list and slowing down while you rebuild reputation.

No real unsubscribe. Check it by clicking it yourself. Fix it by adding a one-click unsubscribe that complies with RFC 8058.

Frequently asked questions

Why do my emails go to spam even though I didn't do anything wrong? Deliverability is rarely one mistake. A domain can have a correct SPF record and still get spam foldered because of sending volume, wording, or a stale SPF record that broke after you added a new tool months ago. Check all six causes above rather than assuming it is just one.

What is the difference between SPF, DKIM and DMARC? SPF authorizes which servers can send for your domain. DKIM cryptographically signs the message so it cannot be altered in transit without detection. DMARC is the policy layer that ties both together and tells receiving servers what to do when either check fails, evaluated against the domain a recipient actually sees in their inbox.

How long does email warmup take? Typically 2 to 4 weeks of gradually increasing volume before sending at full scale, though the right length depends on how much daily volume you are warming up toward.

How many cold emails can I send per day without hurting deliverability? It depends on your provider and your account's age and reputation, not a single universal number. Google Workspace paid accounts cap at 2,000 per user per 24 hours, but providers throttle well below their published cap once bounce rate or complaint rate climbs, so the safe practical number is usually lower than the ceiling.

Is there a free way to test cold email deliverability before sending a full campaign? Yes. Checking SPF, DKIM and DMARC, scanning your draft for spam-triggering wording, and reviewing your infrastructure as a whole are all free checks you can run before a campaign goes out, rather than finding out after open rates come back low.

Where to start

If you have not checked your domain in the last few months, start with SPF, DKIM and DMARC. It is the fastest of the six to check and the most common cause of silent, unexplained spam foldering.

EmailQo checks your domain, your sending account and every message you write before it sends, then sends at a safe, human pace instead of leaving that up to guesswork. Start a 7-day free trial, no card needed.

Building Email Aliases with Amazon SES: Lessons from EpicMail.org

Mon, 21 Sep 2026 14:02:27 +0000

You create an email address for a project. A month later, the project ends, but the email keeps coming.

Having a separate address helped you organize the mail. Being able to switch that address off would make it much more useful.

That is the idea behind managed aliases in EpicMail. Instead of giving users another mailbox to maintain, we wanted to give them more control over the addresses feeding the mailbox they already have.

I'm Serge, the founder of EpicMail. We use Amazon SES for our built-in email service. Building aliases around it led to some useful product and engineering lessons, especially about forwarding, identity, and what a successful send actually means.

Decide what an alias promises

Consider these example addresses:

john+project [AT] epicmail.org
john+shopping [AT] epicmail.org
john+newsletters [AT] epicmail.org

They all belong to the same base mailbox, but each can represent a different relationship. A project has an end date. A shopping address might become noisy. Newsletters might be more useful in another account.

We chose aliases that users explicitly create and manage. Once created, an alias can receive mail, appear as the sending address, show activity, be blocked, or forward to another connected account the user owns.

An arbitrary suffix does not automatically become an active EpicMail address. That is a deliberate product choice: the aliases area should show the addresses the user has chosen to use.

There is also a privacy distinction worth making clear. Plus addresses expose the base address. They are useful for organization and control, but they are not anonymous email masks. Someone who sees john+shopping [AT] epicmail.org can also see john.

Know what SES provides

SES gives developers sending and receiving capabilities. The user experience around an alias is something the application still has to define.

For straightforward sending, a verified domain identity can cover addresses beneath that domain without individually verifying each address. AWS documents the details and exceptions in its identity verification guide.

Receiving is a separate setup. It requires a supported receiving region, the appropriate MX records, receipt rules, and permissions for the resources involved. The AWS receipt-rule walkthrough covers those pieces.

Those capabilities make a feature like this possible. They do not decide whether an alias should work automatically, which account should receive a forward, or what a user should see after blocking an address.

Writing down those behaviors before building the screens makes the implementation much easier to reason about.

Test the whole conversation

Receiving a message is only the start. A user also expects to reply without accidentally switching identities.

For an alias feature, a useful acceptance test is a complete conversation:

Send a message to the alias from another mailbox.
Open it and reply using the alias.
Check the address the other person sees.
Reply back and confirm the conversation returns to the intended mailbox.

Do the same with a message sent directly from the alias. It is easy to make the compose selector look correct while overlooking what happens at the other end.

BCC deserves a test too. The visible To and Cc headers do not describe every legitimate delivery. AWS distinguishes envelope recipients from message headers in its receiving-notification documentation.

These are useful tests even if you use a different email provider. The recipient experiences the entire exchange, not just your compose window.

Forwarding changes the inbox experience

Suppose someone forwards an alias to another account they have also connected to EpicMail. If both copies remain in their inboxes, a unified view can show the same message twice.

The forward worked, but the resulting experience is annoying.

We added an auto-archive option alongside alias forwarding. It lets the user keep the original stored in the EpicMail mailbox while clearing it from Inbox after the forward is accepted for sending. Archiving preserves the message without keeping it in the way.

It also makes the setting easier to explain. The user chooses where they want to read the message, while retaining a copy in the original mailbox.

A forwarding feature should answer that practical question, not leave the user to discover the duplicate-copy problem afterward.

Use honest status language

Email has more than one meaning of "sent."

Your sending service can accept a message before the destination server receives it. Even acceptance by a destination server does not guarantee that a person will find it in their inbox or read it.

SES provides separate delivery, bounce, and complaint notifications. Those events help describe different outcomes; they should not be collapsed into an unsupported promise that every accepted message reached a person's inbox.

This affects product language as much as infrastructure. A count of forwarded messages needs a clear meaning. An error needs to tell the user whether they should take action. A success message should describe the stage the application actually knows about.

For our auto-archive option, the boundary is acceptance for sending. It is not a guarantee of final delivery, and a later bounce does not automatically restore an already archived original. That is a useful limitation to state plainly.

Treat suppression as part of deliverability

SES suppression lists are another reason an address can look valid without a message being delivered as expected.

AWS distinguishes bounce and complaint reasons, and its account-level suppression list applies to an AWS account in a particular region. The suppression-list documentation explains the behavior and available controls.

For developers, the lesson is to understand the reason and scope before changing suppression settings. A complaint carries different meaning from a delivery failure. Removing an entry is not a universal fix for deliverability, and changing your own account's list does not control another sender's system.

This is part of the operational knowledge needed around email features, even when the interface itself is small.

Make control easy to find

A useful aliases screen should answer ordinary questions quickly:

What did I create this address for?
Is it still active?
Where does its mail go?
Has it been used?
How do I stop receiving mail through it?

In EpicMail, aliases have an area for management and activity, with search and paging as the list grows. The sending identity is available from the compose window, where that choice belongs.

The aliases share the original mailbox's received-message allowance. Creating more addresses does not create additional mailboxes or additional allowances. Keeping that relationship clear avoids surprises later.

Why we added this to EpicMail

EpicMail brings existing accounts into one place: A unified inbox for Gmail, Outlook, Yahoo, iCloud, IMAP, and POP3.

Managed aliases add another way to organize incoming mail, specifically through the optional paid @epicmail.org inbox. They are included with that inbox without a separate fee per alias, and share its 5,000-message received allowance per usage period. This feature does not create aliases at a user's connected Gmail, Outlook, or other provider account.

There is a walkthrough on the EpicMail email aliases page.

The design question I would leave other developers with is this: when someone no longer wants to use an address, how easily can they take control of it? That answer can make an alias much more useful than a different spelling of the same inbox.

What Email Marketing Means for Customer Loyalty

Thu, 17 Sep 2026 09:34:16 +0000

Building strong customer relationships is one of the most important goals for any growing business. Customers are more likely to stay with a company when they feel valued, informed, and connected to the brand. This is where Email Marketing Birmingham can play an important role. By delivering useful and relevant messages directly to customers, businesses can maintain regular communication and create experiences that encourage people to return. A thoughtful email strategy can turn occasional buyers into loyal customers while helping businesses build trust over time.

Builds Strong Customer Relationships

Customer loyalty does not happen after a single purchase. It develops through consistent communication and positive experiences. Email Marketing allows businesses to stay connected with customers even when they are not actively shopping. Regular messages can remind customers about the brand and show that the business understands their interests.
When customers receive useful information rather than constant sales promotions, they are more likely to appreciate the communication. Helpful tips, product information, company updates, and personalised recommendations can make customers feel that the brand is interested in providing value instead of simply making a sale.

Keeps Customers Engaged

Customer engagement is essential for maintaining long-term relationships. People can easily forget about a business when they have not interacted with it for a long time. Email Marketing provides a simple way to keep the brand visible without requiring customers to visit the website regularly.
Businesses can use newsletters, special updates, seasonal content, and useful resources to encourage customers to remain connected. When communication is consistent and relevant, customers have more opportunities to interact with the brand and remember it when they are ready to make another purchase.

Creates Personalised Experiences

Customers appreciate communication that feels relevant to their needs. Sending the same message to every customer may not always produce strong results because different people have different interests. Email Marketing makes it possible to divide audiences into groups and create messages based on their preferences, previous purchases, or interactions.
Personalisation can make communication feel more natural and useful. For example, a customer who previously purchased a particular product could receive information about related products or helpful guidance. This approach can improve the overall customer experience and encourage people to continue engaging with the business.

Encourages Repeat Purchases

Customer loyalty is closely connected with repeat business. A company that successfully brings existing customers back can build a stronger and more sustainable customer base. Email Marketing can support this goal by reminding customers about products, services, new arrivals, and relevant offers.
A well-timed message can encourage a previous customer to return when they need something similar again. However, successful communication should focus on relevance rather than sending excessive promotional messages. When customers receive offers that genuinely match their interests, they are more likely to respond positively.

Rewards Loyal Customers

Customers like to feel appreciated, especially when they have continued supporting a business. Email Marketing gives companies an effective way to recognise their loyal customers through exclusive offers, early access, special announcements, or personalised rewards.
These benefits can make customers feel that their relationship with the brand has additional value. A simple thank-you message can also make a difference. Showing appreciation helps create positive emotions around the brand and can encourage customers to remain loyal instead of looking for alternatives.

Builds Trust Over Time

Trust is a major part of customer loyalty. People are more comfortable buying from businesses that communicate clearly and consistently. Email Marketing can help establish this trust by providing customers with accurate information and maintaining a professional communication style.
Businesses can use emails to explain their services, answer common questions, share useful advice, and keep customers informed about important changes. Transparent communication can make customers feel more confident about their decisions and strengthen their relationship with the company.

Supports Customer Retention

Finding new customers can require significant time and effort, so retaining existing customers is extremely valuable. A strong communication strategy can help businesses remain connected with people who have already shown interest in their products or services. Email Marketing gives companies a direct channel for maintaining these relationships.
Retention messages can include helpful content, reminders, product updates, or information designed around customer interests. When customers continue receiving meaningful communication, they may be less likely to forget the company or move to a competitor.

Makes Communication More Convenient

Modern customers often prefer communication that is quick and easy to access. Email provides this convenience because customers can read messages whenever it suits them. They do not need to visit a physical location or spend time searching for information.
Email Marketing can also provide customers with important information in one place. Whether the message includes an update, an offer, useful advice, or information about a service, customers can access it from their phones, tablets, or computers. This convenience can contribute to a better overall customer experience.

Provides Valuable Customer Insights

Customer loyalty strategies become stronger when businesses understand what their audiences want. Email Marketing can provide useful insights through customer interactions. Businesses can learn which types of content receive attention, which offers generate responses, and what information customers appear to find useful.
These insights can help companies improve future communication. Instead of relying entirely on assumptions, businesses can use customer behaviour to create more relevant messages. Over time, this can lead to better engagement and stronger relationships with their audience.

Final Words

Customer loyalty is built through trust, value, consistency, and meaningful communication. Businesses that make customers feel appreciated are more likely to develop long-term relationships and encourage repeat business. Email Marketing provides a practical way to maintain these relationships while delivering useful and personalised content directly to customers.
From increasing engagement and encouraging repeat purchases to rewarding loyal customers and building trust, effective email communication can support many parts of the customer journey. When businesses focus on relevance and quality instead of sending unnecessary messages, their communication becomes more valuable. With the right strategy, email can become an important tool for creating lasting customer loyalty and supporting long-term business growth.

Visit Coder Legion for more informative blogs.

Send your first transactional email with BYOC mode

Wed, 20 May 2026 11:48:08 +0000

There is a particular kind of developer frustration that comes from needing to send a single password reset email and ending up three hours deep into AWS documentation. Transactional email should be simple. This post gets you from zero to a working send using SendFleet's BYOC (Bring Your Own Credentials) mode - your own AWS SES account, your domain, your sending reputation.

What is BYOC and why does it matter?

Most email APIs route your mail through their own infrastructure. That means your sending reputation lives in a shared pool with thousands of other senders. One bad actor spamming on the same IP range and your deliverability suffers for it. BYOC flips this: SendFleet acts purely as a routing layer, temporarily assuming a role in your AWS account to dispatch email directly through your SES. The email content never touches SendFleet's database. Your reputation is yours alone.

There are three things you need before you start:

An AWS account with SES approved for production access (out of sandbox mode)
A domain you control so you can add DNS records
Permission to create IAM roles in your AWS account

Step 1: Create a SendFleet account

Register at sendfleet.net/register. Email verification is required before you can send anything. The Starter plan is free with 50 BYOC emails per month and no credit card required. If you need more volume you can upgrade to the paid BYOC plan at $9/month with no SendFleet-imposed cap.

Step 2: Create an IAM role in AWS

This is the step most people overthink. Open your AWS console, navigate to IAM, then Roles, then Create role. Choose "Custom trust policy" when prompted.

Do not write the trust policy yourself. Go to your SendFleet account settings under the BYOC section and copy the trust policy shown there. It already contains your unique ExternalId — a 48-character random value that prevents anyone else from assuming your role through SendFleet's infrastructure. This protects against what is known as the confused deputy problem (more on that in next week's post).

The trust policy will look roughly like this:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::SENDFLEET_ACCOUNT:root" },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "YOUR_UNIQUE_EXTERNAL_ID_HERE"
      }
    }
  }]
}

After setting the trust policy, attach the required SES permissions listed in your SendFleet settings. These cover sending email and verifying domain identities. The role name must be SendFleet-BYOC-Role (exact case-sensitive).

Step 3: Connect the role to SendFleet

In your SendFleet dashboard, go to Settings. Paste your IAM Role ARN — it looks like this:

arn:aws:iam::123456789012:role/SendFleet-BYOC-Role

Select the AWS region where your SES account operates. Click Validate and save. SendFleet will attempt to assume the role and verify that your SES account is out of sandbox mode. If the validation fails, double-check that the trust policy ExternalId matches exactly what SendFleet shows in settings.

Step 4: Add and verify a sending domain

Go to Dashboard, then Domains, then Add BYOC domain. Enter your root domain - for example acme.com, not mail.acme.com.

SendFleet uses your assumed IAM role to register the domain identity in your SES account and return the DNS records you need to add. You will see five record types in the dashboard:

Domain ownership TXT record (required)
Three DKIM CNAME records (all three required)
SPF TXT record (recommended, not required to send)
MAIL FROM subdomain MX and SPF records (recommended)
DMARC TXT record (recommended)

Add the TXT ownership record to your DNS. Once it propagates — usually five to fifteen minutes but sometimes up to an hour — click Verify ownership in the dashboard. Then add all three DKIM CNAMEs and click Verify DKIM. DKIM verification is the gate: you cannot send until it passes.

Step 5: Generate an API key

Go to Dashboard, then API Keys, then New key. Name it something clear like "Production" or "Development". The full secret key is shown exactly once. Copy it immediately and store it in your environment variables or a secrets manager. If you lose it there is no recovery — you generate a new one (*Revoke the lost keys).

Step 6: Send your first email

With your domain verified and API key in hand, you can send your first email with a single curl call:

curl -X POST https://sendfleet.net/api/send/ \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "*Emails are not allowed*",
    "from_email": "*Emails are not allowed*",
    "from_name": "Acme",
    "subject": "Welcome aboard",
    "message": "Thanks for signing up!"
  }'

A 200 OK response means your email has been accepted and queued. Delivery is asynchronous -SendFleet validates the request, places it in the SQS queue, and a background worker dispatches it to your SES account. The response includes a message_id you can use for tracking and a mode field confirming byoc.

{
  "success": true,
  "message": "Email queued for delivery via your SES account.",
  "message_id": "1a2b3c4d-5e6f-7890-abcd-ef1234567890",
  "mode": "byoc"
}

Set Up a Free Professional Email Address With Gmail and Cloudflare. Even If You Don't Own a Domain

Fri, 08 May 2026 18:17:20 +0000

Tired of using a plain @gmail.com for business, newsletters, portfolios, or professional emails? You can set up unlimited custom email addresses eg:yourname[at]yourdomain.com completely free, with no monthly fees for Google Workspace or similar services.

This guide became super popular after a viral X (Twitter) thread, but many people get stuck because they don't have a domain yet, or they try the wrong SMTP settings for sending emails.

This complete beginner-friendly tutorial covers everything from getting your first domain (free or very cheap) → setting up incoming mail with Cloudflare → sending from Gmail. No tech experience needed, follow along step by step.

Why This Setup Is Awesome (and What to Know)

Pros

Totally free after you get the domain (domain can cost $0 to $12/year)
Unlimited email addresses/aliases (e.g., info@, support@, yourname@)
Emails arrive in your regular Gmail inbox
Send emails from your custom address directly in Gmail (web, mobile app, etc.)
Perfect for creators, freelancers, students, indie hackers, or side projects

Limitations

Cloudflare handles receiving only, and we use Gmail to send
Outgoing emails use Gmail's servers → good deliverability, but not perfect for massive cold emailing (may hit spam folders sometimes)
Gmail free account limit: \~500 emails/day
For super high volume or perfect branding, you could add a cheap SMTP service later

If you're just starting, this is one of the best zero-cost setups in 2026.

Step 0: Get Your Domain Name (Free or Super Cheap Options)

You need a domain name first (like yourname.com). Here's how to get one easily:

Option 1: Free for Students (Best if Eligible)

If you're a student (university, college, bootcamp, etc.):

Go to education.github.com/pack
Sign up or log in with your GitHub account → verify student status (usually with school email or ID)
Once approved (usually instant or 1 to 2 days), scroll to the "Domains" section
Choose an offer:

Namecheap: Free 1-year .me domain (great for personal sites/emails)
Name.com: Free 1-year on extensions like .dev, .app, .live, .studio, .rocks, etc.

Redeem the offer → follow their instructions to register the domain
Done! You get a real domain for free for 1 year (renewal is usually cheap afterward).

Option 2: Very Cheap for Anyone (\~$1 to $10 First Year)

Popular beginner-friendly registrars with promos (as of February 2026):

Namecheap (recommended for simplicity): Often $0.99 to $6.49 for first-year .com, .site, .online, etc. Use promo codes like 99SPECIAL for 99¢ domains or check current deals at namecheap.com/promos. Free WHOIS privacy included.
Porkbun: At-cost pricing, beginner dashboard, often $5 to $10 for .com.
Cloudflare Registrar (if you plan to use Cloudflare anyway): At-cost renewals, no markup (\~$10 to $11/year for .com).
Hostinger or Wix: Sometimes bundle a free domain for 1 year with cheap hosting (but you don't need hosting here, just the domain).

Steps to register (example with Namecheap):

Go to namecheap.com
Search for your desired name (e.g., rdjarbeng.com or mybrand.online)
Add to cart → apply any promo code at checkout
Create account → pay (credit card, PayPal, etc.)
After purchase, you'll get login access to manage the domain

Tip: Choose .com, .me, .dev, or .app — they look professional and are widely accepted.

Step 1: Add Your Domain to Cloudflare & Enable Email Routing (Incoming Mail)

Cloudflare is free and secure. It will handle receiving emails and forward them to your Gmail.

Go to dash.cloudflare.com and sign up for a free account (email + password).
After logging in, click Add a site (or Onboard a domain).
Enter your domain (e.g., yourdomain.com) → Continue.
Cloudflare scans your existing DNS (if any) → select the Free plan → Continue.
Cloudflare gives you two nameservers (something like ns1.cloudflare.com and ns2.cloudflare.com).
Go back to your domain registrar (Namecheap, Porkbun, etc.):

Find "Nameservers" or "DNS" settings
Change from default to Custom → paste the two Cloudflare nameservers
Save

Wait 5 to 60 minutes (sometimes up to 24 hours) for changes to propagate → refresh Cloudflare dashboard until it says "Active".
In Cloudflare dashboard → select your domain → go to Email → Email Routing.
Click Get started or Enable → Cloudflare adds the needed MX records automatically.
Go to Email → Routes or Custom addresses → Create address.
- Enter email: e.g., *yourname[at]yourdomain.com* (or info@, hello@, etc.)
- Destination: your real Gmail address (e.g., *yourname[at]gmail.com*)
- Save
Test: Send an email to your new custom address → it should appear in Gmail within seconds!

Note: You can create unlimited addresses, all forwarding to the same Gmail (or different ones).

Step 2: Prepare Gmail to Send (Must-Do: App Password)

Gmail needs extra security for sending from custom addresses.

Go to myaccount.google.com/security
Turn on 2-Step Verification if not already enabled (use your phone).
Search for App passwords → click it.
Select app: Mail
Select device: Other (name it e.g., "Custom Email")
Generate → copy the 16-character password (save it somewhere safe, no spaces).

Step 3: Add Your Custom Email to Gmail (Send From It!)

Important: Do not use Cloudflare's server for sending. Use Gmail's.

Open Gmail → click the gear icon → See all settings → Accounts and Import tab.
Under Send mail as → click Add another email address.
Fill in:

Name: Your name or brand
Email: *yourname[at]yourdomain.com*
Uncheck "Treat as an alias" → Next

SMTP settings:

SMTP Server: smtp.gmail.com
Port: 587
Username: Your full Gmail (e.g., *yourname[at]gmail.com*)
Password: The App Password from Step 2
Use TLS: Yes (usually default)

Click Add Account.
Gmail sends a verification code to your custom email → it forwards to Gmail inbox.
Find the code → enter it → verified!

Now compose emails in Gmail → click the "From" dropdown → choose your custom address.

Step 4: Boost Deliverability (Optional but Helpful DNS)

In Cloudflare DNS → add/update these TXT records:

SPF (prevents spam flags):

v=spf1 include:_spf.mx.cloudflare.net include:_spf.google.com ~all

(Name/Host: @)

DMARC (monitor reports):

v=DMARC1; p=none; rua=mailto:*yourname[at]gmail.com*

(Name/Host: _dmarc)

No DKIM from this free setup, which is normal.

Testing & Tips

Send test emails to friends → check inbox/spam.
Set your custom address as default in Gmail if you want.
Mobile: Works perfectly in Gmail app.
Stuck on verification: Regenerate App Password (common issue).
Propagation slow: Wait and refresh, normal for new domains.

Alternatives If You Need More

Zoho Mail free tier: Full features + DKIM (limited storage)
Paid SMTP (e.g., SMTP2GO free tier) for better sending reputation
Self-hosted if advanced

This Cloudflare + Gmail trick is still one of the top free email hacks in 2026. Share your custom email or any questions in the comments below.

Happy emailing!

Media mentions:

Also posted on dev.to for Richard Djarbeng

PS: Got this email, 5th March, 2026 from someone who was able to follow this tutorial and set up their professional email:

Glad to know this post helped someone

4 new Playwright email templates with shadcn/ui — and how to make shadcn work in email

Mon, 30 Mar 2026 13:28:00 +0000

What is this?

@playwright-labs/reporter-email is a Playwright reporter that emails your team the test results after each CI run. This release adds 4 new templates built on shadcn/ui.

The core challenge

shadcn/ui is not email-compatible out of the box. Three things break:

Radix UI — shadcn uses Radix for interactive behaviour (Select, Dialog, etc.). Radix calls browser APIs (window, document) at import time. @react-email/render runs in Node.js with none of these.
CSS variables — shadcn default config generates hsl(var(--foreground)). Email clients don't support CSS variables.
JSX transform conflict — in a Playwright project, esbuild replaces React's JSX with Playwright's own internal representation. That breaks @react-email/render.

Fixes

Radix: Rewrote all primitives as plain HTML. SelectItem is a <div> with a conditional ✓ span. Button is an <a> tag. No Radix import anywhere.

CSS variables: Set "cssVariables": false in components.json. shadcn then generates bg-slate-900 (concrete value) instead of bg-background (CSS variable).

JSX transform: Added /* @jsxImportSource react */ pragma to every .tsx component file. esbuild respects per-file pragma overrides, so React's JSX runtime is used instead of Playwright's.

New templates

`base-chart` — pass-rate bar

import { PlaywrightReportShadcnChartEmail }
  from "@playwright-labs/reporter-email/templates/shadcn/base-chart";

<PlaywrightReportShadcnChartEmail result={result} testCases={testCases} >

Adds a stacked horizontal bar showing the percentage of passed / failed / skipped tests. Pure CSS, no images.

`base-button` — CTA links

import { PlaywrightReportShadcnButtonEmail }
  from "@playwright-labs/reporter-email/templates/shadcn/base-button";

<PlaywrightReportShadcnButtonEmail
  result={result}
  testCases={testCases}
  reportUrl="https://ci.example.com/report/42"
>

A footer with "View Full Report" and optionally "View N Failure(s)". Buttons are <a> tags styled with shadcn button variants.

`base-themes` — 6 color themes

import { PlaywrightReportShadcnThemesEmail }
  from "@playwright-labs/reporter-email/templates/shadcn/base-themes";

<PlaywrightReportShadcnThemesEmail result={result} testCases={testCases} theme="green" >

Import only what you need

Each template is a separate bundle under dist/templates/shadcn/. Individual imports:

// Only loads base-select bundle, nothing else
import { PlaywrightReportShadcnSelectEmail }
  from "@playwright-labs/reporter-email/templates/shadcn/base-select";

Or use the barrel for multiple templates:

import {
  PlaywrightReportShadcnChartEmail,
  PlaywrightReportShadcnThemesEmail,
} from "@playwright-labs/reporter-email/templates/shadcn";

Requires "moduleResolution": "bundler" in tsconfig.json to resolve the exports subpaths.

Run the preview locally

git clone https://github.com/vitalics/playwright-labs
cd playwright-labs && pnpm install
pnpm --filter @playwright-labs/reporter-email build
cd packages/reporter-email/examples && pnpm email:preview

Opens at http://localhost:3000. Edit any file in emails/ and the server hot-reloads.

GitHub: https://github.com/vitalics/playwright-labs

npm: @playwright-labs/reporter-email