Modern email can be built from borrowed parts

Let's design the successor to email on top of HTTP, fixing the design flaws SMTP has been dragging along for 40 years. Piece by piece. The goal is not to replace the current mail system, heaven forbid!, but to learn, have fun and discover current technologies to swap out every element: sending, receiving, gateway, keys, and so on. The system will never talk to Gmail or any classic email provider: it only talks to itself. The only thing we are going to keep is the shape of the addresses, user@domain . Everything else gets reinvented.

Since it is a mail system over HTTP, a good name for the protocol would be HMTP: Hypertext Mail Transfer Protocol (the S for Simple in SMTP gives up its seat to the H for HTTP).

Now it's time to prepare the tech stack: HTTP, TLS, WebFinger, ActivityPub, Webmention, Ed25519, HPKE, sigchains, etc.

The bill of materials

This design doesn't invent a single technology: everything already exists.

Problem Existing technology Who uses it today Transport and status codes HTTP The whole web Transport encryption TLS + Let's Encrypt The whole web User discovery WebFinger (RFC 7033) Mastodon and the Fediverse Message delivery POST to an inbox ActivityPub Sender verification at the source The Webmention and DKIM pattern IndieWeb, all of email Signatures Ed25519 SSH, Signal Content encryption HPKE (RFC 9180) MLS, TLS ECH Identity that survives key rotation Sigchains ATProto (Bluesky), Keybase Reading and synchronization JMAP (RFC 8620) Fastmail Push notifications SSE / WebPush Every browser First-contact consent Message requests Signal, Instagram Attachments by reference with hashes Content addressing Git, IPFS, Matrix

Every piece we are going to use is standardized, deployed and battle-tested at scale by millions of people; the only new thing is the assembly.

Choosing HTTP is not just pragmatism. It solves, right out of the gate, several things any new protocol would have to build at some point:

TLS, virtual hosting and SNI : for free.

: for free. Status codes : the catalog a mail protocol needs already exists in HTTP. 202 Accepted (queued for delivery), 429 Too Many Requests + Retry-After (rate control), 404 / 410 (mailbox unknown/gone), 3xx (mailbox moved), 413 (too large). Even paid anti-spam has had a code reserved since 1997: 402 Payment Required .

... continue reading