Heavy week. Chinese hackers turned a Google Workspace admin feature into a year-long mail exfiltration channel. Gmail's Postmaster Tools now renders a plain-English verdict on your domain. Béis got hit with three Washington class actions over "Fraud Alert" subject lines — filed in time to dodge the new $100/email cap. And Salesforce signed to buy Contentful, so the "neutral" content layer just picked a side. Let's get into it.

Google's Threat Intelligence Group published attribution this week on UNC6508, a Chinese-nexus espionage group that turned Google Workspace's own admin features into an exfiltration channel against North American medical, academic, and defense institutions. The attackers compromised REDCap research servers, escalated to Workspace domain admin, then created a content-compliance rule watching for ~150 keywords and email addresses. Every match auto-forwarded to an attacker-controlled Gmail inbox. Activity dated as far back as September 2023 and continued through November 2025.

The trick: this wasn't a vulnerability. It was a legitimate admin feature operating exactly as designed. Almost no forensic trace on the mail system itself — no rules were "abused" in the security-vendor sense, they just existed and ran. Every Workspace admin needs to audit tenant-level content-compliance rules this week. Look for rules you didn't create, rules forwarding to external addresses, keyword lists you can't justify. Detection has to live one layer up from the mail data plane, because the mail data plane saw nothing wrong.

Sources: The Hacker News, Google Cloud Threat Intelligence, The Next Web

Following up on last week's Postmaster Tools API v2 GA coverage: Google has quietly added a Compliance Status "Deliverability analysis" section that translates the dashboard into one of seven plain-English verdicts. The headline one — and the one your CMO will read directly: "users signal they don't want to receive email messages from your domain."

That phrasing isn't an accident. The 0.1% spam-rate threshold and engagement-honoring criteria stopped being guidance the moment Google's own UI started rendering the conclusion. It's a much harder thing for a marketing stakeholder to argue with than a Postmaster Tools graph. Action item this week is concrete: log in, find the new section, and read your domain's verdict. If it's the bad one, you don't have a vendor-data debate anymore. You have an inbox-provider verdict, in writing.

Sources: emailexpert / Andrew Bonar, 171mails, Google Postmaster Tools API reference

Relay is a interview with a member of the email community. I seek to find multiple perspectives to highlight in this feature, so if you have suggestions for who to interview next, reply to this email and tell me! This week's interview is with David Harris, CEO of GreenArrow Email.

We've actually always provided our solution as an OnPrem MTA (since 2005) and a Cloud Managed Service (since 2006); however, we have evolved this thesis over time.

It's important to know if we're talking about brands or ESPs. Brands that send email are better served by using a cloud service or ESP, since they don't have the specialized experience that it takes to run email infrastructure and they can get a full-suite marketing application powered by the ESP. (There are a limited number of us with this very specialized experience!) This is clearly the way that the market has gone for a large brand sending their own email: SaaS has won the day for these customers. (However, brands with incredibly large volumes might want to go in-house, but it's not cheap to do right.)

Email Service Providers are a different story: In the past, starting an Email Service Provider meant that you had to run your own infrastructure and MTA, as services like SendGrid or Mailgun didn't even exist yet, so the first generations of ESPs all ran their own infrastructure.

Then a new generation of Email Service Providers got started which outsourced their final delivery to an Email API and focused all their engineering efforts on building the best possible customer experience and email marketing engine. This coincided with an industry focus on better marketing experiences such as personalized content, triggered messaging, and a move away from batch-and-blast. These ESPs built great value for their customers and successful businesses, all while using an Email API.

This generation of ESPs is now looking to evolve their email infrastructure, but that does not necessarily mean going OnPrem. We've spoken with a large number of these ESPs using Email API services who would like to: (a) significantly reduce their email delivery costs, (b) avoid being locked-in to their vendor, (c) deliver email fully from IPs they own (BYOIP) and domains they own (i.e. use their own domain name as the infrastructure double-signing domain and MX domains), and (d) get access to the "under-the-hood" features of an MTA (such as the ability to customize backoff rules, bounce classification rules, automatic warmup schedules, override throttling limits when needed, etc).

Additionally they want a future-proofed solution that provides a path to going OnPrem without needing to have customers update DNS, and enables them to take over more of the management of the infrastructure in phases, but they don't necessarily want to go OnPrem right now.

We have a product that scratches these itches: A fully managed MTA in the cloud, which we call GreenArrow CloudMTA. We provide a Mailgun- or SendGrid-like API that an ESP can plug into. We have baked avoiding infrastructure lock-in into the core of the service: everything runs on the ESP's domain names and IPs, the email authentication setup API has the brand setup CNAMEs to the ESP's domain names (and we run the dynamic DNS service for the ESP). This makes it easy for the ESP to migrate to another vendor or go OnPrem in the future.

We provide access to the DKIM private keys. IP warmup and throttling is automatically managed like with an Email API service, but if the ESP wants to override or take manual control they can. Or the ESP can override our set of backoff rules or tweak things like connection reuse parameters. We can provide click tracking or allow the ESP to do their own click tracking. Each ESP gets their own dedicated infrastructure.

All of this is competitively priced, so there are major cost savings compared to the major Email APIs. For ESPs that don't currently have the operational experience of running an MTA, we're finding that it's a compelling proposition.

The OnPrem market is not going away: we have many self-hosted OnPrem GreenArrowMTA ESP customers, massive ESPs such as Klaviyo and Zeta, and many smaller ESPs, so we will continue to serve this market and develop the product. The software is almost completely the same, with the delivery method being different, so most of our development benefits both products.

We're even seeing serious interest from ESPs running OnPrem MTAs that want to migrate to the GreenArrow CloudMTA, as they want to focus their engineering efforts on areas other than infrastructure and gain the features of a modern MTA such as GreenArrow. In some of these cases, we're able to reduce the overall costs of email delivery compared to what ESPs are paying in software licensing and AWS costs to run a legacy, non-auto-scalable MTA.

Our thesis has evolved: the goal was never OnPrem for its own sake, but giving ESPs genuine ownership and control of their infrastructure. CloudMTA is how we deliver that for ESPs that aren't ready — or don't need — to operate the pipes themselves.

I don't see this as human judgment vs automation, but human judgment and automation working together.

I think of AI as a tool like any other tool that serves as a complement or enablement to humans. For example, backhoes, cordless drills, and battery-powered circular saws are amazing labor saving devices, and we have had them on construction jobsites for quite some time, but we still have many people employed doing construction. To build a home, you still need experienced professionals with the know-how to use the tools. The labor-savings have gone into having nicer and larger homes than people enjoyed a few generations ago.

There's the Jevons paradox: as something becomes cheaper, the demand for it actually goes up. This was first noticed in the industrial revolution in England, that as steam engines got more efficient, they got deployed for more purposes, and the demand for coal went up instead of down. I expect this will happen for software: that with AI-enabled software engineering, we will have more software, not fewer people employed creating software.

So what effect does this have on the email landscape?

AI-driven filtering (and AI-enabled software engineering) is going to empower Mailbox Providers to do even a better job with spam filtering, such that it's going to get harder for senders to hide bad practices or get away with marginal practices that may have been able to slide under the radar.

This creates a need for deliverability teams to work with more customers. For smaller SMB customers, a fully AI-built tool can point them in the right direction. I believe that larger senders are still going to want to work with an experienced person, although much gruntwork of collecting data can be automated through AI. We're also going to see more deliverability teams leveraging AI to build their own reporting interfaces and internal automations. Bottom line: deliverability teams will be able to help more of their customers using AI, but we will still need human judgment.

It's good to remember that there is no magic-bullet for deliverability: as long as the infrastructure is not getting in the way, or a shared pool sender is in an inappropriate pool, each sender gets the deliverability that they earn through their sending practices. So while there is some benefit to using AI to make better infrastructure and shared pool decisions, most of the benefit of AI is going to be enabling deliverability teams to do more in helping their customers adopt better practices, which is still a very human thing.

We built Studio over a decade ago in response to our OnPrem MTA customers that were using out-of-the-box PHP email sending applications that were not able to keep up with GreenArrow MTA. The MTA was our first product.

As CEO, I'm focused on improving our OnPrem MTA and CloudMTA products — that's where our growth is coming from. To be transparent, the Studio product is in maintenance mode; we are putting virtually all of our development into the MTA.

There's not much tension to be managed, as ESPs' products are significantly more mature than Studio; we're not seeing them compete with each other in practice. A recent Studio customer was a bank that needed an OnPrem solution for compliance reasons. Studio has become a niche product, and we're comfortable with that.

Classically, a commodity is a product where there is little or no competitive differentiation. I don't believe we've arrived at that place in the MTA landscape; modern MTAs like ours do accomplish the same core function, but there are real competitive differentiators between the products and whole solution packages that we each offer.

For example, a big competitive differentiator for GreenArrow is offering both OnPrem software and a Fully Managed CloudMTA service, designed to put ESPs in the captain's chair with zero lock-in, access to the MTA details they want, and a graceful migration path to OnPrem without having to re-integrate or re-warm up. Halon and Kumo both have their own competitive differentiators, so I don't feel that MTAs are on a collision course with becoming a commodity.

I would say this is our "risky bet": offering a Managed Service that is designed to make it easy for a customer to leave if they want, and paving that pathway by offering both a Cloud Managed Service and OnPrem MTA that are the same core software. I'm not aware of any other MTA vendors that have done this at scale.

Following last week's coverage of HB2274's June 11 effective date: Béis just became the first big test of the standard. Three proposed class actions (Huong / Noble / Mott v. Béis LLC) were filed in King, Pierce, and Spokane counties over Cyber Monday 2025 emails carrying the subject line "Action required: fraud alert." Body copy opened with "the fraud is us… sale now extended."

The catch: because the emails went out in late November and early December 2025, plaintiffs are positioning to litigate under the old $500/email CEMA framework, not the new $100/email cap that took effect June 11. The exact race we flagged in W24, now playing out in court filings. And the subject-line theory has escalated — "Fraud Alert" mimicking a real security notification is a step beyond the "Today Only" / "Last Chance" template the Skechers complaint targeted. It's not just urgency; it's deception that maps onto a recognized consumer-harm category. If your marketing team is still drafting security-adjacent urgency language, you now have two adverse litigation patterns to template against — and the new cap doesn't apply.

Sources: emailexpert, Top Class Actions, Inc., Ad Age

Announced June 1, closing Q3 FY2027 (~Aug–Oct 2026). The Information puts the deal at $1B–$1.5B. Contentful is the headless CMS for 4,800+ enterprises — KraftHeinz, DocuSign, SumUp among them — and a meaningful percentage of those customers route email content through Braze, Klaviyo, Adobe Journey Optimizer, and other non-Salesforce ESPs.

The acquisition gives Agentforce the structured-content layer it needs to "assemble and deliver content dynamically without manual publishing steps." That's wonderful for Salesforce shops. It's an awkward dependency for every customer running a competing ESP downstream of a now-Salesforce-owned content layer. Pair this with Connections 2026 and the consolidation thesis is hard to miss — Salesforce is buying the layers around messaging (content, identity, data), not the messaging capacity itself. The "neutral" content layer just picked a side.

Sources: Salesforce newsroom, emailexpert, Salesforce Ben, The Next Web

emailexpert's June 12 analysis pulled DMARC adoption stats from the top 1.8M domains. The headline: 937,931 (52.1%) publish a valid DMARC record. The catch: 525,996 of those — more than half of all adopters — are stuck at p=none. Monitoring-only. Producing aggregate reports. Blocking nothing.

The split by tier tells the rest. Fortune 500 adoption is 95% with >80% at enforcement. Inc. 5000 adoption is 76.2% with only 15.2% at enforcement. That gap is a direct artifact of the Gmail/Yahoo bulk-sender baseline — compliance forced the record, but no one pushed the second step. The practical implication: when a B2B counterparty's auditor shows you "DMARC pass," having a DMARC record and being protected by DMARC are two entirely different things. Check the policy. Then check the percentage tag if it's still set. Presence is not protection.

Sources: emailexpert, DmarcDkim.com adoption data

Microsoft disclosed CVE-2026-42897 on May 14 — a spoofing/XSS vulnerability in Exchange Outlook Web Access that lets a single crafted email execute attacker-controlled JavaScript in OWA when the victim opens it in a browser. CVSS 8.1, Critical. Microsoft confirmed active exploitation pre-patch. The permanent fix shipped in the June 10 Patch Tuesday cumulative update.

Affects Exchange Server 2016, 2019, and Subscription Edition. Exchange Online (Microsoft 365) is not impacted. This is the rare email-server vulnerability with an email-delivered exploit vector — open the message in OWA, get popped. If you run on-prem Exchange, the June rollup is the patch. Apply it this week, not next.

Sources: Microsoft Tech Community, The Hacker News, BleepingComputer, Help Net Security

emailexpert's June 6 dual-feature reframed the engagement-platform market as cleanly bifurcating. Braze (Q1 FY2027) reported 30% revenue growth (27% organic), $211M revenue, $195.2M subscription, 110% net revenue retention, 371 net-new customers (2,713 total), and >$1B in remaining performance obligations. Klaviyo hit $358M revenue at 28% YoY, raised full-year guidance, authorized a $500M share buyback, and publicly rebranded as "the autonomous B2C CRM." EMEA ex-UK grew 51%.

Meanwhile, Intuit announced 17% workforce cuts with Mailchimp specifically called out as shrinking. The through-line: enterprise behavior-triggered orchestration is taking share. Basic SMB campaign-send is bleeding to bundled features in commerce, website, and AI-assistant stacks. The Klaviyo buyback also signals where the enterprise engagement-platform layer is in the consolidation cycle — returning cash to shareholders rather than buying neighbors.

Sources: emailexpert (Braze/Mailchimp), emailexpert (Klaviyo)

Announced June 12 as part of Infobip's AgentOS layer. The agent ingests sending data in real time and produces interpretation plus prioritized remediation across reputation monitoring, authentication review, inbox placement, and provider-by-provider troubleshooting. Infobip's positioning is explicit: "expert-level deliverability guidance, no specialist required."

Currently advisory only. Automation of low-risk actions sits on the roadmap with human approval gates. Read this alongside Salesforce's Marketing Expert Agent (W24) and the broader autonomy debate from the Klaviyo Q&A in W23 — vendors are openly competing on replacing the human deliverability specialist as a layer in the stack, not just augmenting the dashboard. The question isn't whether vendors will keep trying. It's how long it takes the failure mode — an agent confidently recommending the wrong fix on a real reputation problem — to land in a postmortem.

Source: emailexpert

That's the week. If you patch one thing, make it Exchange. If you check one dashboard, make it Postmaster Tools. And if your marketing team is still drafting "Fraud Alert" Cyber Monday subject lines, send them the Béis complaints over coffee — and tell them to reconsider.

On a personal note, it was great to catch up with so many of you in Montreal at M3AAWG last week!

Reply and tell me what I missed. I read every response. If you enjoyed this week's issue, forward it to a friend! (And if you were forwarded this and found it helpful, subscribe for free at https://thisweekin.email!)'

— John

This Week In Email — thisweekin.email