Fluent, targeted phishing is now cheap. We review the figures and their weaknesses, explain what authentication can and cannot stop and set out what legitimate senders should do next.
BIMI shows a verified logo beside authenticated email, but its entry ticket is enforced DMARC. We set out Gmail's requirements, VMC against CMC, the unverified vendor claims and three scenarios to 2028.
A new class of sender is arriving: software agents with their own inboxes. We review the 2026 funding and product signals, the deliverability and security risks and three scenarios to 2030.
Two independent 2026 studies show DMARC records are common while enforcement lags. We compare their numbers, explain why domains stall at p=none and set out a 90-day plan to move to reject.
Authentication went from best practice to the price of entry in under three years. This analysis traces the Gmail, Yahoo and Microsoft timeline, compares their requirements and looks at where the rules are heading.
Google brought Gemini to Gmail in January 2026. This analysis separates what was announced from what is guesswork, uses Litmus and Radicati data to size the stakes, and lays out three scenarios for senders through 2028.