Generator Labs

Microsoft moved SNDS to a new URL and set automated access links to expire after 30 days. A 404 in a forgotten cron job is exactly how reputation data stops flowing with nobody noticing. What to audit now: generatorlabs.com/blog/microso...

Anyone had a DNSSEC outage because the signing job quietly stopped? The signatures don't expire until days or weeks later, so it breaks long after whatever caused it. What tipped you off? generatorlabs.com/blog/dnssec-...

Anyone running MTA-STS in enforce mode on their own domain? Curious what finally got you to flip it from testing, or what's still holding you back.

June 2025 is when Let's Encrypt stopped sending expiry reminder emails. So if a renewal job breaks quietly now, there's no email on the way to warn you. letsencrypt.org/2025/01/22/e...

New: every Generator Labs account now gets one HTTPS certificate monitor free, for good, with no card required. Handy for that one site you've been meaning to keep an eye on. generatorlabs.com/changelog/fr...

The certificates on the third-party APIs you call deserve the same monitoring as your own. When a vendor's cert expires, it's your checkout that throws the error.

If mail to Microsoft 365 bounces with "550 5.7.606-649 Access denied, banned sending IP", you're on Microsoft's own block list, and you can file the removal yourself. learn.microsoft.com/en-us/defend...

Somewhere, a contact form with no CAPTCHA is sending mail from your server.

eMudhra's weak CA keys showed an early sign in May 2025: the CRLs for six of the intermediates failed signature checks. eMudhra re-signed the CRLs with the weak keys and closed the bug. generatorlabs.com/blog/emudhra...

Quick check: if your mail server has an IPv6 address, look in the logs for outbound connections over it. Mail can leave over v6 whenever the receiver supports it, from an address with its own reputation. generatorlabs.com/blog/ipv6-rb...

What's the hardest blocklist removal you've ever had to chase? Curious which list it was, and what finally got you off it.

0.1% and 0.3%: Gmail wants the spam rate in Postmaster Tools under the first and never at the second. On a 10,000-message send, that's roughly 10 complaints versus 30. support.google.com/a/answer/81126

Most small setups would be better off without a backup MX. Senders already retry for days when the main server's down, and the backup tends to be where spam slips past your filtering.

If Gmail bounces you with "550 5.7.26 This email has been blocked because the sender is unauthenticated", neither SPF nor DKIM passed. Gmail asks that of every sender now, even the small ones. support.google.com/a/answer/372...

Expired certificates have a real talent for picking long weekends.

Quick one for anyone running their own mail server: add a TLS-RPT record, and senders that support it will email you a daily report of encrypted connections to you that failed. generatorlabs.com/blog/smtp-tl...

Anyone running BIMI on a Common Mark Certificate? No trademark needed, Gmail still shows the logo, you just don't get the checkmark. Does anyone actually miss it? generatorlabs.com/blog/bimi-an...

Curious how other mail teams handle this: when one of your sending IPs gets listed, do you pull it out of rotation right away, or keep it sending while the delisting goes through?

48 hours after the malware's cleaned up, a URLhaus listing drops off by itself. Blacklist Monitoring now checks URLhaus too, for your IPs and your domains. generatorlabs.com/changelog/ur...

Hot take: email shouldn't be your only alert channel for mail problems. When the mail server's the thing that's broken, that's the one alert that can't reach you.

Somewhere, a calendar reminder is the only thing renewing a certificate.

When a mail server moves to a new IP, the forward record moves with it and the PTR record stays on the old IP. Who here found that one out from a bounce? generatorlabs.com/blog/reverse...

If a container throws "x509: certificate signed by unknown authority" while your laptop's perfectly happy, it's probably missing your internal CA. Images ship their own list of trusted CAs, and yours isn't on it yet. docs.docker.com/engine/netwo...

Mail admins: when a blocklist listing hits, who finds out first at your shop? Monitoring, or a customer forwarding a bounce? Honest answers welcome.

2 days is how fast Gmail and Yahoo expect an unsubscribe to be honored. CAN-SPAM allows 10 business days, but the inbox providers quit waiting that long back in 2024. generatorlabs.com/blog/gmail-y...

Just added a security header at the origin? It's worth checking it survives the CDN on the way out. This shows what a visitor actually gets back: mrdns.com/http-headers

Friday afternoon DNS change? We've all done it exactly once.

A footer unsubscribe link doesn't satisfy Gmail and Yahoo. They want the one-click List-Unsubscribe header, signed by DKIM. Is anyone still seeing big senders miss it? generatorlabs.com/blog/gmail-y...

Give every service that sends mail its own subdomain. Marketing and receipts each get one, and a bad campaign has a much harder time dragging your password resets into spam with it.

Port 25 outbound is blocked by default on AWS, Google Cloud and most Azure subscriptions, so a new mail server there can look perfectly set up and still never deliver a thing. docs.aws.amazon.com/AWSEC2/lates...

What's the oldest thing still sending mail as your domain that nobody on the team remembers setting up? Our money's on a printer or an old monitoring box.

ERR_CERT_COMMON_NAME_INVALID only on www usually means the cert doesn't list www. The redirect can't help, because the browser checks the cert before the redirect ever runs. generatorlabs.com/blog/wildcar...

If DMARC has sat at p=none for years, the reports it's collected show the servers sending mail as your domain. Worth a read before you move to quarantine. mrdns.com/dmarc-check

400 Bad Request No required SSL certificate was sent nginx completes the TLS handshake and refuses at the HTTP layer, so an expired client certificate reads as a broken client. mTLS doubles the certificates you have to keep alive: generatorlabs.com/blog/mtls-in...

How many DNS lookups does your SPF record really cost? Count every include your vendors nest inside theirs. Past ten, it fails with permerror: generatorlabs.com/blog/spf-ten...

5 days. That is how long Postfix holds deferred mail by default before it gives up and bounces it. A blocklist listing you clear on day six does not bring that mail back, and the default config sends the user no warning while the clock runs.

Now in Blacklist Monitoring: Google Postmaster Tools. Gmail grades your domain every day. A bad grade now reaches you as an alert, the same day, like a blacklist listing would: generatorlabs.com/changelog/go...

When a certificate expiry alert fires at 2am, who receives it? If it lands in one person's inbox and that person left two years ago, the alert is going somewhere nobody reads. Where do yours point?

Nobody sets a calendar reminder for the internal root CA that signs everything.

example.com. IN CAA 0 iodef "mailto:security@example.com" CAA records usually stop at issue and issuewild. The iodef tag adds an address for the CA to report a refused request to, so you hear when someone else asks for a certificate on your domain.

Leave the old DKIM selector up for a week after you rotate. Mail you signed yesterday may still be sitting in a retry queue, and it can't verify against a record you deleted: generatorlabs.com/blog/dkim-ke...