Blog
How mail is authenticated, scored, filtered and delivered — written by the team that captures it. Long-form, with the headers and the code.
Mailclutch's sandbox is a purpose-built SMTP server written in Go. This is how it listens, negotiates TLS, authenticates a client with PLAIN or LOGIN, and rejects a forged credential at the socket — at HMAC cost, with no round trip to the application.
16 articles · Page 1
Every captured message gets a score out of 100. This is exactly what goes into it — SPF, DKIM, DMARC, BIMI, List-Unsubscribe, X-Priority and a SpamAssassin pass — with the weight of each rule, what a sandbox result says about production, and how to use the score as a gate in staging.
Google and Yahoo's sender requirements, translated from policy into engineering: SPF and DKIM on the right domains, DMARC, aligned From headers, one-click unsubscribe, TLS, reverse DNS and the spam-rate ceiling — and how to verify each one on a message before it goes out.
A protocol-level walk through SMTP authentication — the EHLO handshake, STARTTLS, the PLAIN and LOGIN mechanisms byte for byte, and how to read the reply codes when a login fails — with transcripts you can reproduce with openssl and swaks.
Every action on a Mailclutch account is now written to an append-only journal — sign-ins, invitations, project deletions, share links. This is the shape of a line, why it is written inside your transaction, and the allowlist that keeps secrets out of it.
Every signed-in browser is now listed with its device and approximate location, and can be revoked in one click. How the session row is found without being replayable, how a device is recognised, and why the alert email is idempotent.
TOTP two-factor is now available on every Mailclutch account, with recovery codes and a hardened account-linking path. What is stored, what a recovery code costs you, and why linking a provider is an event rather than a shortcut.
What List-Unsubscribe and List-Unsubscribe-Post do, why Gmail and Yahoo now require them, what your endpoint must accept, which messages should carry them and which must not — with working code for Laravel, Node.js and Python.
A share link can now cover an entire project rather than a single message: password-protected, expiring, revocable, in preview or developer mode, and white-labelled on the plans that include it. What a link exposes, and what it never does.
Two small features that go together: a read-only link to a single captured message for a client or a PM, and browser notifications when a new email arrives in a project you follow. Including why we never put a push endpoint in a page.
See it on your own mail
Point your staging SMTP at Mailclutch and every message comes back with its headers, its spam score and its authentication results — before a customer sees it.
Free plan · no credit card · running in under a minute