Postbox Consultancy Services is an Email Deliverability Company and Your Emailing Partner.
Bhopal, India
Joined September 2017
- Tweets183
- Following173
- Followers162
- Likes150
Postbox Services is now a ChatGPT plugin and in Claude’s directory.
Ask your AI to “run a spam test”, send one email to the address it gives you, and get a live score out of 10. Free, no account.
ChatGPT: chatgpt.com/plugins/plugin_a…
Claude: claude.ai/directory/postbox-…
35
Where did your email actually land - inbox or spam?
APRF is a new IETF draft: publish one DNS record, get daily placement + engagement reports by email. Like Google Postmaster Tools, but from any mailbox provider.
Plain-English guide + 3 free tools:
postboxservices.com/blogs/po…
47
TLS certificate lifetimes are already down to 200 days. 100 in Mar 2027. 47 in Mar 2029.
Everyone read this as a web story. It's also an email story.
MX, MTA-STS, TLS-RPT, DANE and BIMI all sit on that clock.
And unlike the web, mail fails quietly.
postboxservices.com/blogs/po…
61
The fix:
Long term - DKIM2 (an IETF draft) binds each signature to its intended recipients.
Today - set a short DKIM signature expiry, so a captured message can't be replayed forever.
1
18
And this isn't theoretical.
In 2025, DKIM replay spoofed PayPal, Apple, and even Google's own [email protected].
Real senders. Real signatures. Fake intent.
1
20
"Just enforce DMARC" won't save you.
A replay carries a real, aligned DKIM signature, so DMARC passes via DKIM.
p=reject only blocks what fails. A replay doesn't fail.
1
12
The uncomfortable truth:
A DKIM "pass" only proves a message was signed by a domain.
Not that the domain sent THIS copy, to you.
DKIM signs the message - not the delivery.
1
6
The trick:
They type the fake charge + phone number into a field PayPal lets you fill in yourself.
PayPal then generates and DKIM-signs a 100% genuine email to an inbox they control.
They forward that signed message to thousands. The signature stays valid.
1
11
A "PayPal invoice" hits your inbox.
DKIM: ✅ valid
DMARC: ✅ passed
It genuinely came from PayPal's servers.
And it's a scam. The attacker never touched PayPal.
Here's how that's possible 🧵
1
33
