This Week In Email — April 22, 2026

Deliverability · Breaking

Apple's upcoming iOS 26 is expanding Link Tracking Protection — currently in Safari Private Browse mode — to the native Mail and Messages apps. URLs clicked in Apple Mail will have common tracking parameters automatically stripped before the click is registered. That includes utm_, gclid, dclid, and similar identifiers.

This is different from Mail Privacy Protection. MPP broke open tracking. iOS 26 LTP breaks click attribution. If a subscriber clicks a link in Apple Mail, you'll still register the click — but you won't know which campaign, source, or medium drove it, unless you've implemented server-side tracking or first-party attribution. Apple Mail commands roughly 50–60% of mobile opens in many B2C programs.

The migration path: first-party attribution, server-side tracking, and reducing reliance on platform-specific click IDs in favor of UTM-based measurement.

Sources: emailexpert · HMA · MarTech

Deliverability · AI & Email · Major Development

Google's January 2026 Gmail overhaul — powered by Gemini 3 — is still rolling out and its deliverability implications are becoming clearer. The new AI Inbox view reshapes Gmail around summaries, topics, and to-dos rather than individual messages. An email can land in the inbox and still go unseen.

Measured impact: CTR dropped from approximately 4.35% to 3.93% following the AI summary rollout. Up to 40% of emails reaching Gmail inboxes are reportedly being deprioritized by AI filtering. Content quality is now a direct deliverability signal: Gmail's AI evaluates clarity, structure, and value density.

Sources: Google Blog · emailexpert · Folderly · RMA

Infrastructure · Update

Last week's issue flagged April 30 as the hard deadline for Microsoft to fully retire Basic Authentication for SMTP AUTH. That was wrong — Microsoft moved the deadline.

On January 27, 2026, Microsoft revised the timeline: SMTP AUTH Basic Authentication behavior is unchanged through the end of December 2026. The March 1 soft rollout appears to have been paused as part of the extension. If you published or forwarded the April 30 deadline, a correction is in order. The migration path is the same — OAuth 2.0, High Volume Email, or Azure Communication Services — but the urgency has been reset by eight months.

Sources: Microsoft Tech Community (original) · Updated timeline · Office365ITPros

Infrastructure · AI & Email

During Cloudflare Agents Week (April 9–16), Cloudflare moved its Email Service from private to public beta. This is email infrastructure built natively for AI agents, not for humans. Developers can now send and receive email directly from Cloudflare Workers via a native binding, with no API keys, secrets management, or separate SMTP configuration.

An AI agent can receive an email, spend an hour processing external data across multiple systems, and send a fully composed reply — all within native Cloudflare infrastructure. Cloudflare developer Thomas Gauvin also open-sourced Agentic Inbox — a self-hostable email client with a built-in AI agent running on Workers.

Sources: Cloudflare Blog · Agents Week in Review · Agentic Inbox

Security · Research

Sublime Security released its 2026 Email Threat Research Report. Key findings:

The through-line: attackers exploit trust. They use your legitimate tools, your email threads, your vendors' infrastructure. Authentication-based filtering sees none of it.

Sources: Key Findings · Full Report

Security · Platforms

On April 15, Bitdefender launched GravityZone Extended Email Security: a dual-layer product combining a traditional secure email gateway (SEG) with API-based post-delivery protection (ICES). SEG filtering catches threats before delivery; the API layer monitors inboxes after delivery and remediates what got through. Connects to Microsoft 365 via Microsoft Graph API — no MX record changes, live within minutes. Bitdefender claims 3x more BEC and credential phishing caught versus traditional methods.

Sources: Help Net Security · Bitdefender

EvilTokens is a PhaaS kit sold via Telegram since mid-February 2026, targeting Microsoft 365 via device code phishing — explicitly designed to bypass MFA. The attack initiates Microsoft's legitimate device code auth flow; when the victim enters the code, they unknowingly authorize the attacker's session. No credentials captured, no MFA to bypass.

Microsoft Defender: 10–15 distinct campaigns launching every 24 hours since March 15. Each campaign is AI-assisted. Hundreds of Microsoft 365 organizations compromised daily. Gmail and Okta variants in development.

Sources: Microsoft Security Blog · BleepingComputer · Sekoia · The Register

Since October 2025, threat actors have been embedding n8n webhook URLs in phishing emails — volume in March 2026 was 686% higher than January 2025. A LOTS attack using legitimate workflow automation to evade email filtering.

A second variant: invisible tracking pixels force the victim's email client to send an HTTP GET to the webhook automatically, capturing IP address and device telemetry without any click. Enables target profiling before the actual attack.

Sources: The Hacker News · Talos

In March, AgentMail closed a $6M seed round led by General Catalyst, with YC participation and angels including Paul Graham, Dharmesh Shah, Paul Copplestone, and Karim Atiyeh. AgentMail gives AI agents their own email inboxes via REST API — two-way conversations, threading, labeling, searching, and replying.

Demand signal: when OpenClaw launched in late January 2026, AgentMail's user count tripled that week and quadrupled in February.

Sources: TechCrunch · Globe Newswire

On March 31, Postmark announced the completion of its migration from PowerMTA to KumoMTA — every email Postmark sends now runs through KumoMTA. Postmark is a well-regarded transactional ESP; its public migration validates KumoMTA's readiness as a PowerMTA replacement in production ESP environments. Improved queue times reported across Gmail, Yahoo, Microsoft, and Apple.

Sources: Postmark Blog · KumoMTA Spring 2026 Release · 2026 MTA Buyers Guide

Just Wrapped

Coming Up