← All issues

This Week In Email — August 26, 2026

Google quietly built a filtering carve-out for political committees and didn't write a blog post about it. Omnivery published the receipts showing the click is going the way of the open. A TechCrunch investigation found an ESP signup form leaking plaintext passwords to ad-tech. And four separate pieces of email infrastructure fell over in ten days for four unrelated reasons.

Heavy week. Let's get into it.

In This Issue

Top Stories

Gmail Will Let Verified Political Committees Past Its Spam Filter From September 8

Google has opened a Verified Sender Program that gives FEC-registered candidates, parties, PACs and 527 committees a documented path around Gmail's spam filtering. Requirements are SPF, DKIM signed by the sending domain, a verified domain, and a spam rate under 0.3% on a 14-day rolling average. Blow it and you get a 7-day suspension or permanent termination. Users keep mark-as-spam, block and unsubscribe controls.

Here's the number that should get your attention: 0.3%. Last month Postmaster Tools started warning commercial senders in writing at 0.1%. Same metric, same mailbox provider, two different consequences — and the class getting the looser threshold is the one that's exempt from CAN-SPAM and has no legal obligation to honor an unsubscribe.

Note the sequencing. Google floated a version of this in 2022, the FEC pilot drew a public comment process and went nowhere. This time there was no blog post, no press release, no comment period — just a help-center article. Weeks before US midterms.

The industry's standard advice has been that engagement is the only currency and there are no shortcuts. That advice now has an exception, and it's written down. If you're a commercial sender staring at a 0.1% warning while a PAC operates at three times that, you're entitled to ask what the number actually measures.

Sources: Gmail Help, emailexpert, Engadget, Android Authority, FEC AO 2022-14

The Click Is Going the Way of the Open: Omnivery Has Six Years of Data

Omnivery classified billions of production events from 2020 through mid-2026 and published the longitudinal series the industry has been missing. Bot clicks on consumer B2C mail sat at a steady ~2% through 2023. They're at roughly 16% in 2026 — an eightfold rise. On third-party ESP traffic measured through Omnivery's Bot Detection API, bot clicks went from 33.8% in 2025 to ~48% in early 2026, and crossed 50% in June.

Contamination is wildly uneven by mailbox provider. Outlook/Hotmail ~30%. Apple iCloud ~12%. Yahoo and GMX 2–4%. Corporate domains 80–95%. If your list skews B2B, more than four out of five of your clicks may not be people.

One data point deserves its own sentence: Gmail's bot click share jumped 3.5x in late February 2026, from ~6% to ~22%. Google appears to have changed its link-scanning behavior and told nobody.

The click was the metric everyone retreated to when Apple MPP made opens untrustworthy in 2021. Every click-based segmentation rule, every sunset policy, every engagement suppression and reactivation trigger in your program is sitting on top of this data. The channel didn't degrade. Your instrumentation did — again — and this time the fallback position doesn't have a fallback.

Sources: Omnivery State of Email Bots 2026 (PDF), emailexpert

An ESP Signup Form Sent Plaintext Passwords to 31 Third-Party Advertisers

Disclosure: I work at Klaviyo. What follows is the public reporting, stated as neutrally as I can manage.

TechCrunch reported on August 10 that Klaviyo's account registration form lacked an explicit method attribute, so the browser serialized the registration data — including the password — into the URL. From there every third-party tag on the page could read it through referrer and page-URL context. Researcher Melurna's testing showed a password reaching 31 third-party hostnames, including Meta, Google, HubSpot, Microsoft, LinkedIn and X. Email addresses, company names, website addresses and phone numbers went with it. The misconfiguration ran from at least February 2024 through November 2025. Klaviyo described it as "an application configuration issue," said it's fixed, and said it identified fewer than 200 affected individuals from available active logs and contacted them; it did not say how far back those logs extend.

The generalizable part is the story. This is not an exotic exploit chain. It's a missing HTML attribute, the default form method is GET, and the bug is trivially reproducible on any signup form on the internet — including the preference centers, webform embeds and hosted signup pages your own lifecycle program depends on. Go look for method="post" this week. Then go look at how many third-party tags are loading on the same page as your credential fields.

Sources: TechCrunch, emailexpert

Deliverability & Authentication

Microsoft 365 Block Rates Jumped 10–15% Across SendGrid's IP Estate for Three Days

Starting around 21

UTC on August 14 and running through August 17, SendGrid saw Microsoft 365 rejections rise 10–15% across its IP estate. The dominant code was 550 5.7.511 Access denied, banned sender. SendGrid said contacts elsewhere in the industry saw the same behavior, and WorkOS reported concurrent M365 delivery problems — which points at a provider-side change rather than a SendGrid reputation event. Microsoft published no technical explanation. It still hasn't.

Customers on shared IPs got rejected regardless of their own sending practices. That's the part worth sitting with: a mailbox provider can be fully "up," pass every status page check, and still refuse an unusual volume of legitimate mail for three days. If your dashboards only track aggregate delivery, this event was invisible to you. Per-provider rejection monitoring, broken out by SMTP response code, is not a nice-to-have.

Sources: emailexpert, Windows Forum thread, OpenStreetMap community

Postmaster Tools V1 Retirement Resumes — Staged Removal, October 31 Circulating

The pause is over. Al Iverson reports Google is processing domain lists sequentially, so some practitioners have already lost the V1 interface while others still have it. You will not get a warning on the day it goes.

V1 is where IP reputation and domain reputation lived — the bad/low/medium/high buckets. V2 has no equivalent. It has compliance status and the newer deliverability-analysis section, which answer different questions. The practical loss lands hardest on consultants: the reputation trend line was the single artifact you used to show a client that a three-month repair engagement actually worked. There's no replacement metric, so the workflow changes, not just the URL.

The nuance worth flagging rather than papering over: Google's own deprecation help page still says "stay tuned for more information on timing" and carries no firm date, while October 31 circulates from the earlier announcement. Treat October 31 as the planning date and the staged rollout as the real one.

Sources: Spam Resource, Google deprecation page, Braze, Inbox Monster

Infrastructure & MTAs

CISA Adds an Actively Exploited Unauthenticated Zimbra RCE to KEV

CVE-2026-73570 (CVSS 8.9) is a command injection in Zimbra's SNMP notification handling. An attacker sends specially crafted SMTP requests and gets arbitrary OS command execution as the zimbra user. No authentication. The attack path is inbound mail, which means accepting mail is enough. Affected: ZCS before 10.1.20 where the optional zimbra-snmp package is installed with SNMP notifications enabled. The fix shipped in 10.1.20 back in July.

CISA added it to KEV on August 21 with a federal remediation deadline of August 24. A three-day window is not a routine listing — that compression is itself the signal.

This is the direct sequel to last issue's Roundcube argument, and the shape is identical: your webmail and groupware box is the attack surface, exploitation is confirmed in the wild, and the patch was already sitting there. Patch immediately. If you can't, disable SNMP notifications today.

Sources: The Hacker News, CISA KEV

Proofpoint Lost DNS for Ten Hours

A configuration synchronization failure in Proofpoint's Global Traffic Manager infrastructure broke DNS resolution for gslb.pphosted.com, starting around 12

UTC on August 14. Sending servers couldn't reach the processing infrastructure at all. Mail delayed and failed. Cloud Admin Portal, TAP Dashboard and Threat Response were unreachable too. Proofpoint confirmed it wasn't a security incident, rolled back to a known-good config, hit initial stability at 17
UTC, then spent another five hours chasing stale cached records before declaring final stability at 21
UTC. A small subset of customer DNS records stayed flaky through recovery.

If you send to enterprises and your August 14 deferral spike never got explained, that's your explanation. A security gateway sitting in front of an enormous share of enterprise inbound mail went dark for most of a working day, and it wasn't an attack — it was a config sync and a TTL.

Source: emailexpert

Exchange's August Patch Carried a Mailbox-Takeover Bypass Demoed at Pwn2Own

Following up on last issue's Exchange coverage: the August 11 bundle we wrote about for killing OWA Light also carried a CVE nobody named. CVE-2026-62911 (CVSS 8.0) is an authentication bypass by capture-replay (CWE-294) in on-prem Exchange. Successful exploitation lets an attacker take over the mailboxes of all Exchange users — read mail, send mail, download attachments. It was demonstrated at Pwn2Own Berlin, so working exploit knowledge exists outside Microsoft.

It shipped alongside CVE-2026-62914 (XSS spoofing) and CVE-2026-62915 (security feature bypass via missing authorization). Exchange Server SE, 2019 and 2016 are all affected.

The interface deprecation got the coverage because it breaks user workflows and generates helpdesk tickets. The auth bypass generates nothing until it generates everything.

Sources: Microsoft Tech Community, ZDI, CrowdStrike, Cybersecurity News

Email Marketing & Platforms

Amazon SES Now Tells You Which Opens and Clicks Are Bots

SES Open and Click event notifications now carry an isBotEvent field with a value of Likely or Unlikely. It's live in every region SES operates in, and it appears automatically for anyone already publishing Open or Click events through a configuration set. No opt-in, no configuration change — it is already in your event stream whether you noticed or not. Go check your consumer today.

Pair this with the Omnivery numbers above and you have the whole story: a major sending platform shipping first-class bot classification is the vendor-side admission that a raw click count is no longer a usable number.

The catch: AWS explicitly calls it a "likelihood signal, not a definitive determination," and has published neither accuracy rates nor detection methodology. It's a data point, not ground truth. Be skeptical of the first vendor deck you see that reports a precise "human click rate" derived from it.

Sources: AWS What's New, emailexpert

Regulatory & Compliance

Lithuania Drops Prior Consent for B2B Email Marketing

You probably missed this one — it took effect April 22 and only surfaced in industry press last week. An amendment to Article 81 of Lithuania's Law on Electronic Communications moves qualifying direct marketing to legal entities from consent-first to opt-out. The old regime was an outlier even by EU standards: guidance required consent from the company's director or an authorized person. Now B2B contact is permitted provided recipients get a clear, free and easy way to opt out.

An EU member state loosening consent requirements cuts hard against the direction everyone assumes the bloc is traveling — France's CNIL is tightening on B2C prospecting consent in the same period. GDPR still applies wherever identifiable employees are involved, so this is not a license to scrape a list and fire.

Sources: emailexpert, B2B Data Index, Fieldfisher EU comparison

Links Worth Your Time

Events & Community

What to Watch

That's the week. Four independent infrastructure failures in ten days, a measurement layer that keeps eroding under us, and a mailbox provider quietly writing an exception into the rules it spent three years telling us were absolute.

As always, I'd love your feedback. If something here is wrong, hit reply and tell me — I read every response. Better yet, hit forward and send it to someone who's going to have a bad Monday if they don't patch Zimbra.

— John

This Week In Email — thisweekin.email

Enjoyed this issue?

Subscribe to This Week in Email and get future issues delivered to your inbox.