Spam filtering, scam trends and deliverability, decoded.
Safe-sender lists are meant to stop good mail being binned. In practice they become a museum of old suppliers, overbroad domains and accounts nobody owns. Here’s how to turn your allowlist into a reviewed, expiring guest list rather than a permanent backstage pass.
Scam emails now arrive dressed in local detail: the right council, a real NHS trust, your actual bin day. That specificity feels like proof, but it is usually just cheap data. Here is how to spot a hyper-local lure and audit which details about your organisation are already doing the rounds.
Shared mailboxes like info@ and sales@ are the workhorses of UK small teams, but they often run on shared passwords, forgotten forwarding rules and unnamed access. This health check walks through the people, rules and defences attached to a generic inbox before a phished click turns it into a team-wide problem.
Alias services promise a wall between you and the internet, but most of them are really just forwarding pipes with good branding. Here's how to audit every burner address you've ever created, spot the one that's leaking, and decide whether to keep feeding it or cut it loose.
Quarantine digests are meant to rescue legitimate mail, but their release and allow-sender links are a ready-made phishing template with a filter logo on top. This audit looks at the patterns attackers copy, the pressures they add, and how UK teams can verify links and configure safe lists without handing over a shortcut.
Every domain with a DMARC record is being quietly audited by Gmail, Microsoft and a long tail of receivers — and the results land in a mailbox almost nobody reads. Here's how to turn a month of XML noise into a short list of unauthorised senders, forgotten subdomains and third parties you'd rather not vouch for.
Inbox logos are becoming the visual shorthand for 'this one is fine' — which is exactly why they deserve a second look. BIMI proves a domain has published a record and, usually, that a certificate backs the mark. It does not prove the sender is honest. Here is how to audit yours before a lookalike borrows the trust.
Backscatter is the email equivalent of someone using your address as the return label on a pile of junk post. Here is how UK teams can spot phantom bounces, check whether their domain is being borrowed, and tighten controls without blocking genuine delivery failures.
A clean-looking PDF, a harmless square, and a prompt to use your camera: 2026's quishing lures are designed to jump from a filtered inbox to an unfiltered phone. Here's why attachment sandboxes and URL reputation miss the handoff, and what UK tech teams can actually check.
A mailbox rule that quietly copies accounts@ to a personal Gmail address can turn a perfectly legitimate message into an authentication failure. This is how forwarding changes the envelope, breaks SPF alignment and sometimes shreds DKIM — plus a practical audit for every hidden relay in your domain.
Thread hijacking doesn't ask for your trust — it borrows someone else's. We walk through how a compromised mailbox turns an existing payroll thread into a payment diversion, why your filters wave it through, and the four checks that actually break the chain.
Calendar invites can land in your diary without a trip through the usual link-scanning gauntlet. Here’s why .ics files are a favourite for UK phishing in 2026, and how to audit auto-add across Outlook, Google and your phone.
A flood of newsletter signups can be more than annoying — it can be cover for a password reset, invoice or bank alert. Here is how UK recipients, senders and filtering admins can spot a subscription bomb and stop it without making the mess worse.
Spammers love a borrowed return address. When your domain gets picked as the fall guy, the bounces and angry replies land in your lap — here’s how to tell a joe-job from a real delivery problem and what actually helps.
Out-of-office messages are meant to be helpful, but they can also confirm live inboxes, advertise empty desks and generate backscatter that spammers lap up. Here is how UK teams can audit auto-replies, tighten the rules and write safer wording without sounding like a robot.
Send the identical email to BT, Sky, Virgin Media, TalkTalk, Outlook.com and Gmail and you'll get six different answers — sometimes six different answers on the same afternoon. We built a repeatable test harness to find out which signals each UK provider actually punishes, and what to do when your campaign works everywhere except one ISP.
The malicious attachment is largely gone. In its place: a tidy PDF invoice with a single link to a 'supplier portal' that exists to harvest credentials and, eventually, redirect payments. Here's how UK finance teams can spot the mismatches, verify bank-detail changes properly and tune filters without burying genuine invoices.
A catch-all domain feels like good manners — no bounced prospects, no awkward 'that address looks wrong' errors. In practice it quietly fattens your list with junk, muddies your reputation and makes incident response guesswork. Here's the audit UK teams can run this week, plus filter rules that keep the genuine catch-all users and bin the rest.
The quietest segment on your UK mailing list is often the one doing the most damage. Spam traps never bounce, never reply and never unsubscribe — they just sit there while your sender reputation slides. Here's how to find them, and what to do when you do.
A message can pass SPF, DKIM and DMARC with flying colours and still be a fraud, because that trio only proves a domain is authorised to send — not who typed the name on the front. Here's why display-name spoofing keeps landing in UK inboxes, and the habits that close the gap.