Email is the last piece of infrastructure everyone assumes still works the way it did. You configure a sending address, you send, it arrives. For a long stretch that was broadly true, and the exceptions were obvious spam.
It is not true now, and the failure mode is what makes it dangerous. Mail that fails authentication is not bounced with an error a sender would notice. It is accepted and filed somewhere the recipient will not look, which means the sender's logs show delivery and the recipient never saw it. Organisations discover this when a customer says they never received the invoice, and the log says otherwise.
Three records, and none of them are set once
The authentication stack has been standardised for years and enforcement is what changed. Large mailbox providers now require the sending domain to publish records establishing which servers may send on its behalf, to sign outgoing mail cryptographically, and to state a policy for what should happen when either check fails.
None of that is difficult to configure. What makes it an ongoing job is that the answer changes constantly. Every department that signs up for a tool which sends mail on the company's behalf — the survey platform, the applicant tracker, the invoicing system, the newsletter — adds a sender that must be authorised, and none of them tell IT. A company that owns more software than it can account for has a sending surface it cannot enumerate, and each unauthorised sender either fails or forces the policy to stay permissive enough to be useless.
Reputation is the second layer and it is not a setting at all. Providers score a sending domain on how recipients behave — opens, deletions, complaints, and above all whether the address exists. Sending to a list with dead addresses damages the score for everything else the domain sends, which is how a marketing campaign takes down transactional mail. Companies that separate these onto different subdomains do so precisely to contain that blast radius.
The consequence for anyone whose business is a mailing list is that deliverability has become an operating cost with a person attached. That is part of why the newsletter economy entered a consolidation phase — the infrastructure competence required scales badly for an individual and fine for a platform.
There is a broader pattern worth naming. Email is following the path passkeys are taking through authentication: a protocol that tolerated ambiguity for decades is being tightened, the tightening is correct, and the transition falls hardest on organisations that were relying on the tolerance without knowing it.
Topics technologyinfrastructure
