A thing that trips people up constantly, and the numbers behind it are worth having in one place. 𝟰𝘅𝘅 𝗶𝘀 𝗻𝗼𝘁 𝗮 𝗯𝗼𝘂𝗻𝗰𝗲. 𝗜𝘁 𝗶𝘀 𝗮 𝗱𝗲𝗹𝗮𝘆. The receiving server is saying try again later, and RFC 5321 section 4.2.1 is explicit that the client should. Mailbox full, greylisting, rate limit, transient DNS trouble. 𝟱𝘅𝘅 𝗶𝘀 𝗳𝗶𝗻𝗮𝗹. Same section: the client must not try again to the same recipient. So when a platform reports a soft bounce, nothing has failed yet. A queue has opened. How long that queue stays open is where it gets interesting, because it is a local decision and not a standard. 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁𝗲𝗱 𝗱𝗲𝗳𝗮𝘂𝗹𝘁𝘀:

• 𝗣𝗼𝘀𝘁𝗳𝗶𝘅: maximal_queue_lifetime defaults to 𝟱𝗱. Retry interval runs from minimal_backoff_time 300s to maximal_backoff_time 4000s.
• 𝗔𝗺𝗮𝘇𝗼𝗻 𝗦𝗘𝗦: 𝟭𝟰 𝗵𝗼𝘂𝗿𝘀 by default, configurable from 300 to 50,400 seconds since October 2024.
• 𝗚𝗺𝗮𝗶𝗹: no published retry window at all. That last one deserves a note. The 45 hours figure that circulates comes from DSN message bodies quoted in forums, not from any Google documentation. I went looking properly and it is not there. If someone has an actual documented source I would genuinely like to see it. The 5 day Postfix default is not arbitrary either. RFC 1123 section 5.3.1.1, which RFC 5321 inherits, says the give up time generally needs to be at least four to five days. Practical consequence: the same address gets an 8.5x difference in second chances depending on what is sending. If you suppress on first soft bounce you are throwing away deliverable addresses on one stack and not the other. What is your queue lifetime set to, and did you choose it or inherit the default?

Posting this because I only found out this week and I suspect I am not alone. 𝗥𝗙𝗖 𝟵𝟵𝟴𝟵, Standards Track, published May 2026. The header line reads 𝗢𝗯𝘀𝗼𝗹𝗲𝘁𝗲𝘀: 𝟳𝟰𝟴𝟵, 𝟵𝟬𝟵𝟭. RFC 7489 is the document that essentially every DMARC guide, tutorial and vendor doc has cited since 2015. It has been historical for three months. 𝗪𝗵𝗮𝘁 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗰𝗵𝗮𝗻𝗴𝗲𝗱, 𝘄𝗵𝗶𝗰𝗵 𝗶𝘀 𝗹𝗲𝘀𝘀 𝘁𝗵𝗮𝗻 𝘆𝗼𝘂 𝘄𝗼𝘂𝗹𝗱 𝗲𝘅𝗽𝗲𝗰𝘁: Identifier alignment was section 3.1 in 7489. It is 𝘀𝗲𝗰𝘁𝗶𝗼𝗻 𝟯.𝟮.𝟭𝟬 in 9989. The definitions survived intact: relaxed alignment means the Author Domain shares an Organizational Domain with an authenticated identifier, strict means they are identical. So if your runbook or your internal wiki links to 7489 section 3.1, the section number is wrong and the concept is fine. That is the whole migration for most people. 𝗧𝗵𝗲 𝗽𝗮𝗿𝘁 𝘄𝗼𝗿𝘁𝗵 𝗿𝗲𝗿𝗲𝗮𝗱𝗶𝗻𝗴 𝗿𝗲𝗴𝗮𝗿𝗱𝗹𝗲𝘀𝘀: SPF can pass while DMARC fails, and this is not a bug or a misconfiguration. A forwarder that rewrites the return path makes SPF pass, but it passes for the forwarder's domain, which no longer shares an Organizational Domain with the From header. Alignment fails, so DMARC fails, on a message that authenticated perfectly. DKIM survives forwarding and SPF does not, because DKIM is a cryptographic property of the message while SPF is a property of the connecting IP. One caveat stated plainly: no RFC writes that in a single sentence. It is a derivation from the alignment definition plus RFC 7960 on interoperability. I would rather say that than pretend I found a quote. Links: RFC 9989 https://dub.sh/qIpjYgm RFC 7960 https://dub.sh/iioNfqn Has anyone here already migrated their internal documentation, or is everyone still pointing at 7489? https://dub.sh/zkBKfMr

cross-posted from: https://lemmy.world/post/46687168

AtomicMail.io has recently emerged as a significant player among "next-generation" email services, specifically targeting the privacy and security-conscious demographic. From the perspective of an email security specialist, let's analyze the platform's promises of "unlimited capacity" and "free service," alongside its corporate structure and technical foundation.

https://pdfhost.io/v/6VW4SA83NT_AtomicMail_io_Cybersecurity_and_Strategic_Analysis__2026_

1. Corporate Profile and Background Origin: The service is operated by AtomicMail Systems OÜ, based in Estonia. Estonia is a jurisdiction renowned for robust digital rights and strict data protection laws (fully GDPR compliant). Server Location: Physical data servers are located in Germany. This is a positive indicator, as Germany maintains some of the world's most stringent data privacy regulations. History: Unlike Gmail or Proton, which have decades of history, AtomicMail is a modern startup that gained significant popularity during the 2024–2025 period.
2. Revenue Model: Why is it Free? While "free and unlimited" often serves as a red flag in tech, Atomic Mail utilizes the following model: Freemium Model: Basic email features are free for everyone. However, "Plus" packages— including custom domain support, professional alias management, and priority support—are paid. Prestige Alias Sales: The platform generates revenue by selling highly sought-after, short (1-4 character) email aliases through annual or three-year subscriptions. No Data Harvesting: Unlike Gmail, the company declares that it does not scan user data or display ads; revenue is strictly derived from user subscriptions.
3. Security and Infrastructure Features Zero-Access Architecture: Your messages are stored encrypted. Not even company employees can read the content without your password. Crypto-Style Recovery: During account creation, you are provided with a Seed Phrase (recovery words). If you forget your password, this is your only way back in. The company cannot reset your password; this is a massive security asset, but a total risk for those who lose their phrase. Advanced Encryption: They employ OpenPGP (4096-bit) and their proprietary Atomic Encryption (ECIES) systems. Anonymity: No phone numbers or personal information are required during registration.
4. Current User Sentiment (2026 Update) Pros (Positive) Cons (Negative) Unlimited Capacity: No more worrying about Gmail’s 15GB limit. UI Deficiencies: Some users still complain about the lack of basic features like "Dark Mode." Privacy: The ability to sign up without a phone number is a major draw for anonymity seekers. Deliverability: As it is a newer domain, there are rare reports of emails occasionally landing in recipients' spam folders. Alias Support: Being able to create 10 free aliases on a single account is excellent for shielding your primary address. Mobile App: While rated well (4.3+), some features like text selection/highlighting are limited compared to the web version.
5. Technical Verdict and Strategic Advice Atomic Mail is a formidable alternative for those tired of Gmail’s surveillance-based model and storage fees.Critical Warning: You must physically write down the Seed Phrase provided during registration. If you lose it and forget your password, even a skilled hacker could not recover your emails; by design, the system allows no external intervention. While it appears to be a "safe harbor" for privacy, I recommend using it for non-critical testing for a few weeks before making it your primary address. AtomicMail.io and the Thunderbird/POP3/IMAP Relationship
6. Current Status: Currently Inaccessible: As of May 2026, AtomicMail.io does not support standard POP3, IMAP, or SMTP protocols. Why? Because of the "Zero-Access" end-to-end encryption, emails remain encrypted on the server. Standard clients like Thunderbird cannot natively decrypt this specific encryption type. Solution: Currently, access is limited to their proprietary Web interface and native Mobile/ Desktop apps.
7. Future Roadmap: The "Encryption Bridge": A "Bridge" application is being developed for third-party apps like Thunderbird and Outlook. Mechanism: Much like the Proton Mail Bridge, you will install a small software on your PC that decrypts emails in the background and presents them to Thunderbird as a local IMAP/ POP3 connection. Will it be free? This remains unclear. Usually, these bridge tools are part of paid (Plus) packages. However, AtomicMail's aggressive "everything free" policy might change this.
8. Thunderbird Users: If Thunderbird integration is a "must-have" right now, AtomicMail may not be your first choice. For manual archiving, you can still export emails manually from the web interface. Direct synchronization is not yet active. Email Forwarding Analysis Based on detailed research, the forwarding feature at AtomicMail.io differs from standard services.
9. Automatic Forwarding: The free plan currently does not offer automatic forwarding to other addresses (like Gmail or Outlook). Technical Obstacle: Gaining access to an email to forward it would break the "Zero- Access" promise, as the email would have to be decrypted to be sent to an unencrypted service.
10. Aliases vs. Forwarding: AtomicMail provides 10 free aliases. These are 10 different addresses that all land in your single primary inbox. This feature is entirely free.
11. Alternative: Password Protected Messages: If you want to send a secure message, you can send password-protected emails for free. The recipient gets a link and reads the mail via a portal using the password you set. Complete Technology and Risk Analysis
12. The Metadata Reality Content: Fully encrypted. Metadata: Who you talk to, when, and the Subject line may technically be visible to the server. AtomicMail claims to keep this to a minimum, but subject lines are usually not encrypted so they can be listed. Tip: Do not put sensitive info in the subject line.
13. Is "Unlimited" Sustainable? Technical Trick (Deduplication): If a 100MB PDF is sent to 1,000 people, the system stores one copy but shows it to everyone. This slashes storage costs. Economics: They are currently in a growth phase. "Unlimited" is often a marketing tactic. A "Fair Use Policy" (e.g., speed throttling after 500GB) is likely in the future.3. IP Reputation and "Spam" Risk Risk: Anonymous and free services attract spammers. If AtomicMail's IP addresses are blacklisted, your emails might land in the spam folder of other users. Currently, their reputation is moderate.
14. Legal Shield: The Estonia Factor Estonia is a world leader in digital bureaucracy. If a foreign authority wants to inspect your emails, they must obtain a court order from Estonia—a notoriously difficult and lengthy process.
15. User Experience Details File Size: Individual email attachments are likely limited to 25MB or 50MB. Search Function: Because content is encrypted, the server cannot search your emails. Searching only works for emails already indexed on your local device. Final Recommendation: Professional Setup Strategy Primary Email Transition: Initially, test it for 3–6 months with newsletters and forums. Seed Phrase Discipline: Never store your recovery words in a digital notepad. Write it on paper and keep it in a secure physical location. Own Your Domain: Connect your own domain for professional use. 2FA: Always use an Authenticator app. Final Verdict: AtomicMail.io is a "rising star" for 2026. It is a digital fortress for private communication, but one should always maintain a backup plan. Deep Technical Analysis: "Atomic Encryption" AtomicMail's "Atomic Encryption" is based on the ECIES (Elliptic Curve Integrated Encryption Scheme). Zero-Knowledge Proof: Your password never reaches the server. Instead, an SRP (Secure Remote Password) key is used. Even if the servers are breached, your password remains safe. Financial Sustainability: The Cost of "Unlimited" Venture Capital: AtomicMail is likely burning through investment capital to acquire users. Expect an "archive quota" by 2027-2028. Low Operational Cost: By utilizing efficient data centers in Germany, they maintain low overheads. Comparison: Infomaniak vs. AtomicMail.io (2026) Feature Infomaniak (Swiss Powerhouse) AtomicMail.io (Security Fortress) History Since 1994 (30+ years) Since 2024 (Modern Startup) Location Switzerland (Geneva) Estonia / Germany Focus Complete Cloud Ecosystem Pure Anonymity & E2EE Registration Requires Phone Number No Phone / Fully Anonymous Recovery SMS/Support Possible Only via Seed Phrase Storage 20 GB (Fixed) Unlimited (Campaign) Which should you choose? Choose Infomaniak if: You want Swiss reliability and don't mind providing a phone number. Choose AtomicMail.io if: You want absolute anonymity and 100% encryption. Backup and Account LimitsAccount Limits: Infomaniak usually limits users to one free account per phone number. AtomicMail has no physical link to your identity, allowing multiple accounts, though anti-abuse AI monitors bulk creations. Backup Strategy (3-2-1 Rule):
16. 3 Copies: One on the server, one on your PC, one on an external drive.
17. 2 Formats: Keep emails in the inbox and export important ones as .eml or PDF files.
18. 1 Remote Backup: Keep one physical copy in a different location. Summary: Infomaniak is like a high-security bank vault; AtomicMail is like an encrypted black box in an underground bunker.

For anyone using AWS SES inbound to route email into S3 — there is now a native email client that reads directly from your bucket.

QuickMailBites v0.1.0:

• Native S3 backend: browse SES-routed emails as if they were in an inbox
• Also works as a normal IMAP or Gmail client
• Flutter-based (Linux, Windows, Android)
• Keyboard-driven (vim shortcuts)
• Free and open source

I'm about to start the journey to become my own email provider. I've got a domain and a Hetzner server going, got NextCloud up. Just discovered there's no included mailserver or installable plugin. The one NextCloud plugin called "Mail" recommends Mail-in-a-Box as a back end.

It looks good so far. They've got a setup video.
I'm no expert, but I've some experience with email DNS entries. I understand email routing well enough to fix it when other people break it.

I've been using a free email redirect service called ImprovMX to forward my domain email to my gmail, and those entries will have to come out. (If you're unaware, ImprovMX is cool, its free, and I've used it with zero issues for years.)
https://improvmx.com/

I know this is a really vague question, but if anyone has any advice pertaining to my little project, please feel free to comment.