GoKawiilEmail authentication: the trust layer that the future of email depends on
Email has always had a spoofing problem. Anyone can put anything in the “From” field of an email. For most of email’s history, that was manageable. A careful reader could catch the tells, such as a slightly off domain name, implausible urgency, or phrasing that doesn’t quite work. However, as AI usage becomes increasingly widespread, the way we engage with email is changing.
AI assistants are increasingly reading, summarizing, and actioning email on users’ behalf. AI filters are making consequential decisions about what reaches inboxes at all. In that world, “Did the message arrive?” matters a lot less than “Can we actually verify where it came from?” The answer to that question depends on a set of standards most email users have never had reason to think about, but that are quietly becoming the foundation everything else is built on.
What is email authentication?
Email authentication is made up of three interlocking standards: SPF, DKIM, and DMARC. SPF verifies that the server sending a message was authorized to do so on behalf of that domain. DKIM attaches a cryptographic signature to each message so the receiving server can confirm it hasn’t been altered in transit. DMARC ties those two together and tells receiving servers what to do when a message fails those checks: reject it, quarantine it, or let it through.
Together, they’re how your inbox can tell whether a message claiming to come from your bank or your employer really did. Without them, a spoofed message is indistinguishable from a legitimate one. While this is not a new problem, as the way we interact with email changes, it becomes a much bigger one.
How AI factors into this
Two kinds of AI are now becoming standard features of the email experience. The first is AI filtering: the systems that decide what’s spam, what’s phishing, and what deserves your attention. These have existed for years, but modern versions are significantly more capable, and authentication results are increasingly a core input into how they make decisions.
The second is AI assistance: tools that summarize your inbox, surface action items, draft replies, and in some cases take actions on your behalf. It’s worth being transparent about what that looks like at Fastmail: we haven’t integrated AI into your inbox, and your mail isn’t being processed by a model in the background. Our MCP server is simply an API endpoint available if you want to connect an AI client of your choosing with your explicit authorization, and nothing changes if you don’t.
But across the broader email landscape, AI assistants acting autonomously on inboxes are becoming increasingly common. That’s where authentication becomes critical. A person reading a suspicious email might notice that the sender’s domain has an extra character, or that something about the request feels off. An AI assistant scanning your inbox for items that need action may not slow down to check those things. It reads the content, notes the urgency, and acts accordingly. If that message is a convincing spoof, as much AI-generated phishing is now, authentication is the safeguard that should stop it before it ever reaches your mailbox.
... continue reading