Email

2 articles

Tech 19 Sep 2026 7 min read

SMTP Does Not Grant Sender Identity: From Headers, SPF, DKIM, and DMARC

SMTP answers a transport question: which server accepts this message and relays it toward its destination? It does not, by itself, prove that the address displayed in the message’s From: header belongs to the system that opened the SMTP connection. That distinction explains a common surprise. A mail client can connect to an external SMTP service, authenticate successfully, and submit a syntactically valid message with From: user@gmail.com. The SMTP login proves that the client may use that service. It does not give the service authority over gmail.com.

SMTP Email

Go 19 Sep 2026 7 min read

Email OTP in Go: Single-Use Codes, Expiration, and Replay Protection

Email OTP in Go: Single-Use Codes, Expiration, and Replay Protection An email OTP looks simple: generate six digits, send them, and compare what the user types. The security boundary is not the email API, though. It is the server-side challenge lifecycle. A correct implementation has to make the code unpredictable, expire it quickly, limit guesses, invalidate older challenges when appropriate, and guarantee that a successful code cannot be consumed twice. Those properties are different from TOTP, even though both mechanisms are commonly described as OTP.

Golang OTP