> First-contact consent: an unknown sender doesn't get into the mailbox; they land in a "requests" box with their first message visible (like Signal's message requests). You accept, and the thread opens forever. A stranger can knock on your door, which is the essential property of mail, but they can't fill up your living room.
I like this.
Question: can this e-mail specification/implementation also replace direct-messaging protocols (like WhatsApp)?
I'm very excited by this idea. I feel like email/chat is ripe for reinvention.
I don't agree with "Domain control as a fallback", as the author said "a domain is not owned, it is rented" and I want to normalise the idea that if you lose your private key, you need to start again. I hate that we keep giving so much authority to domains, it's such a big weakness. The author even left the key rotation chain out of the initial implementation.
I still think root/signer keys or sigchains are decent options.
I think the network effects make email hard to replace, virtually everyone online has an email address. If this could include a migration path, with backwards compatibility with SMTP, I think it would have a better shot of getting adoption.
Modern email already depends on HTTP, with protocols like MTA-STS (https://www.rfc-editor.org/info/rfc8461/) using HTTPS/TLS to improve transit encryption, or Web Key Directory (https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...) which uses HTTP for public key distribution. Personally I think these incremental improvements of SMTP are more promising than replacements, but we deserve better email however we can build it.
Yeah, this subject comes up every couple months. The problem is not getting it working. Its that email is a captured system at this point and the real work is various reputation management processes that the big providers control or you can't send email to/from them. They also have no real interest in letting you be your own email provider so its just pushing a rock up a hill grind, for what? To save <$100 a year piggybacking on another provider as a custom domain? or just use a free provider?
There is an easy way to mostly replace email over a decade, with the NewEmail protocol
NewEmailServers are able to send and receive messages using either the Email or the NewEmail protocol.
Before sending a message, the NewEmailServer checks a directory (similar to DNS) to see if any of the recipients are on another NewEmailServer. If so, the message is sent to those recipients via NewEmail. Others get it by Email.
Completely backward compatible. Once google/microsoft shift to NewEmail, the rest will follow quickly except some legacy servers. All that is needed is a standards body.
I think Gmail did this! Gmail can send and receive messages to either Email or Gmail. Google and Microsoft talk to each other with something proprietary too.
We shouldn't be discussing the best ways to Embrace, Extend, Extinguish, because EEE and its consequences have been a disaster for internet openness, and we don't want to be increasing its spread.
> Optional postage for strangers: the server can answer a first contact with a 402. Configurable per mailbox; the cost of cold spamming stops being zero.
Interesting take re putting a cost on spam. Perhaps another take would be functionally implementing introductions.
> First-contact consent: an unknown sender doesn't get into the mailbox; they land in a "requests" box with their first message visible (like Signal's message requests). You accept, and the thread opens forever. A stranger can knock on your door, which is the essential property of mail, but they can't fill up your living room.
Unfortunately, this will only move the problem, and only reduce it in the case when all outside communication is ignored.
Content-addressed email breaks mailing lists, as those need to be able to add headers for subscribe/unsubscribe/list id, etc. There is a reason DKIM allows you to pick which headers to sign.
Unfortunately, stopped reading at one moment, because though the idea might be interesting, the packaging was unbearable. The obnoxious real time visitors counter seriously screws with my screen reader. I don't care how many people are reading this every 3 seconds updated not only with numbers, but with randomly chosen emois in my speech stream.
If you have a website, please, don't subject your visitors to something like that.
I think a lot of these concepts are fun/interesting, but I like that email today functions more like a mailbox than WhatsApp or Telegram. Whilst digital (or paper) spam is obnoxious I dislike the idea of binning every sender into a "unread" box until I approve them. I miss unreads all the time across apps like X and Telegram.
As a first step I would focus on something like broad S/MIME support. Unfortunately I suspect that the biggest email providers are disincentivized from doing this as it would disrupt their business models.
None of them have good (or any) support for managesieve.
Without managesieve (or some other autotagging mechanism), email is just a big pile of junk.
Even Gmail doesn't support editing filters on the mobile app. It's ludicrous in 2026. And their filters are strictly weaker than Sieve.
None of them have a feature to "quickly generate a filter rule from a message".
None of them have a way to generate a forum-like interface from a mailing list more or less automatically.
None of them (except deltachat, I think), support displaying messages linearly, one below another, rather than one at a time.
One at a time is also important. When I'm writing to my boss, I am writing a message as if it is a document. But when I'm writing to my girlfriend, I often want it to a be a one-line response.
Overquotting is badly managed. Gmail hides the previous message under a button, which is super slow, but most of the time overquotting is not even needed. There should be a button to "not quote" and "strip quotes automatically".
It's not a good idea, I'd call it terrible in fact. We have MX Records, might as well use those. If not, use SRV records. Requiring mail server to involved in root of the domain is terrible idea.
Email currently uses an HTTP request to https://mta-sts.<domain>/.well-known/mta-sts.txt, per RFC 8461. Depending on HTTPS/TLS instead of DNSSEC is one major reason you see this approach gaining popularity.
I like that the author at least head fakes towards postage, which is how spam gets solved, for real. It's far too late for SMTP, but I don't mind folks thinking hard about it.
I'd take this the opposite direction - HTTP should get more like SMTP.
Take this thought experiment - how does nearly every other standard protocol (DNS, SMTP, etc.) except for HTTP survive at scale without server-side load balancing?
Thankfully we're heading in this direction due to happy eyeballs and related client-side retry mechanisms.
More people should be aware of their history. This text made the rounds in the late 1990s as spam was starting to become a problem. Everybody and their dog had their own “ultimate solution” to the spam problem, which they all thought was obviously the correct one, but all of them were more or less equally unworkable: <https://craphound.com/spamsolutions.txt>
I would advise reconsidering keeping the current format exactly. Something that would allow conventional email addresses to kept in a list that disambiguates them unambiguously would probably be a good idea.
You don't want to embed the entire email in JSON. Too many parsers past, present, and future tend to want to decode the entire JSON document into memory before doing anything else, and so you'd be forcing entire email documents to be held in memory at scale, which causes you major problems. I'd recommend something more like either a JSON header that defines what parts are in the email, followed by a normal MIME document, which is perfectly normal in HTTP with other things that use the format as well, or having the top level continue to be a MIME document and specify that the first part must be a JSON document containing the headers. JSON replacing the headers is generally something that would be a good idea, though.
That improves the ability of more language environments to be able to handle the email as a stream or in chunks with "normal" libraries and practices. MIME parsers in languages that tend to favor pulling everything into RAM as a string are still more likely to have been forced to face this issue already.
Username is your public key, password is your private key. So we get end to end encryption and account ownership out of the box. Something similar to how .onion addresses work.
Needing easy to remember addresses? Build aliases on top of that. Needing server-side automation? Handle trusted server your private key.
Also, almost everyone carry a 24/7 powered and Internet connected device in their pockets. The Internet - network that allows globally sending any data between devices. Maybe with full redesign third-party email servers should be made optional.
I believe we should focus less on how to redesign whole service and build more universal layers instead.
First, vsending any data to any machine. Second, optionally remotely accessing our data. Third, mail-like format of data.
Tightly coupling identity to cryptosystems should be entirely dismissed for anything that is supposed to have broad adoption.
First off, these systems always require indefinitely-lived secrets. To rotate keys (or the whole cryptosystem—think future possible quantum computers) is to change identity. Therefore, to change keys is to break the previous identity. Anything that requires users to think about long-term secrets is user hostile and leads to a fragile system.
Second, the economics of pubkey-as-address are untenable. Can you imagine publishing .onion addresses on billboards and business cards, let alone sharing them verbally? Absolutely not.
Unless there’s something I’m missing (please do say), these problems are intractable when you’re dealing with cryptosystem-based identity.
In the end, identity and naming and fundamentally human concerns. If you try to kludge around this with purely technical solutions, all you’ll end up with is a system that doesn’t adequately reflect what identity means to people. Good systems support this (DNS, email); bad systems fight this (cryptocurrency, nostr).
I don't want to replicate email. I want to fix it.
Sending email should not be free. It should be really, really cheap to send an email to one person (like a fraction of a fraction of a cent), but get exponentially more expensive the more you send.
People shouldn't be able to send emails to you without your prior approval (which you can revoke at an instant).
The recipient should be able to charge a tack-on fee for having email sent to him. I should be able to charge annoying people a lot to send to me, and charge my friends almost nothing. People who send annoying stuff to me should pay more to get my attention.
All of a sudden, forwarding that stupid article without thinking about the content (or even reading the article they're sending) will be second guessed. Save the money (and time), by sending only worthwhile stuff that you penned.
HTTP? It would be a more interesting thought experiment with CoAP. And, is it really “modern” if it still uses a model (essentially) requiring stateful compute like JMAP?
Asymmetric signature generation has been a solved problem for more than a quarter of a century. So are distributed hash tables. I can't believe email hasn't been replaced. My take on it is to follow the money. Microsoft, Google and Yahoo have a vested interest in being the only big identity providers along probably with some 3 letters agencies.
49 comments
[ 0.22 ms ] story [ 21.3 ms ] threadI like this.
Question: can this e-mail specification/implementation also replace direct-messaging protocols (like WhatsApp)?
at one point Gmail had a service for this - if I remember well - but google being google - I guess it was just a promotion project for someone.
https://blog.nawaz.org/posts/2018/Sep/solving-my-email-probl...
(Not answering your question, but referring to the approach).
They've since changed the design so it uses its own protocol and servers instead of email.
I don't agree with "Domain control as a fallback", as the author said "a domain is not owned, it is rented" and I want to normalise the idea that if you lose your private key, you need to start again. I hate that we keep giving so much authority to domains, it's such a big weakness. The author even left the key rotation chain out of the initial implementation.
I still think root/signer keys or sigchains are decent options.
Modern email already depends on HTTP, with protocols like MTA-STS (https://www.rfc-editor.org/info/rfc8461/) using HTTPS/TLS to improve transit encryption, or Web Key Directory (https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...) which uses HTTP for public key distribution. Personally I think these incremental improvements of SMTP are more promising than replacements, but we deserve better email however we can build it.
NewEmailServers are able to send and receive messages using either the Email or the NewEmail protocol.
Before sending a message, the NewEmailServer checks a directory (similar to DNS) to see if any of the recipients are on another NewEmailServer. If so, the message is sent to those recipients via NewEmail. Others get it by Email.
Completely backward compatible. Once google/microsoft shift to NewEmail, the rest will follow quickly except some legacy servers. All that is needed is a standards body.
We shouldn't be discussing the best ways to Embrace, Extend, Extinguish, because EEE and its consequences have been a disaster for internet openness, and we don't want to be increasing its spread.
Let's start with grouping messages into conversations reliably. Whatever black magic they are currently using is almost there, but has it's flaws.
Interesting take re putting a cost on spam. Perhaps another take would be functionally implementing introductions.
> First-contact consent: an unknown sender doesn't get into the mailbox; they land in a "requests" box with their first message visible (like Signal's message requests). You accept, and the thread opens forever. A stranger can knock on your door, which is the essential property of mail, but they can't fill up your living room.
Unfortunately, this will only move the problem, and only reduce it in the case when all outside communication is ignored.
If you have a website, please, don't subject your visitors to something like that.
As a first step I would focus on something like broad S/MIME support. Unfortunately I suspect that the biggest email providers are disincentivized from doing this as it would disrupt their business models.
You can stop there, I've heard enough. Not everything is hypertext.
Other than that...
The most important thing is not the protocol, it's the gui.
At the moment email's gui is horrible on all platforms without exception.
If/when a decent gui appears, protocols will follow.
Also, JMAP did reading can probably be just WebDAV?
Without managesieve (or some other autotagging mechanism), email is just a big pile of junk.
Even Gmail doesn't support editing filters on the mobile app. It's ludicrous in 2026. And their filters are strictly weaker than Sieve.
None of them have a feature to "quickly generate a filter rule from a message".
None of them have a way to generate a forum-like interface from a mailing list more or less automatically.
None of them (except deltachat, I think), support displaying messages linearly, one below another, rather than one at a time.
One at a time is also important. When I'm writing to my boss, I am writing a message as if it is a document. But when I'm writing to my girlfriend, I often want it to a be a one-line response.
Overquotting is badly managed. Gmail hides the previous message under a button, which is super slow, but most of the time overquotting is not even needed. There should be a button to "not quote" and "strip quotes automatically".
* DNS lookup for MX record
New version
* DNS lookup for A record
* HTTP request for .wellknown/htmp/known_hosts
Not sure why this is being considered as an improvement?
> each mailbox of a domain on a different provider
Why is this useful/necessary or even 'good'?
Take this thought experiment - how does nearly every other standard protocol (DNS, SMTP, etc.) except for HTTP survive at scale without server-side load balancing?
Thankfully we're heading in this direction due to happy eyeballs and related client-side retry mechanisms.
No, no one wants to do that.
You don't want to embed the entire email in JSON. Too many parsers past, present, and future tend to want to decode the entire JSON document into memory before doing anything else, and so you'd be forcing entire email documents to be held in memory at scale, which causes you major problems. I'd recommend something more like either a JSON header that defines what parts are in the email, followed by a normal MIME document, which is perfectly normal in HTTP with other things that use the format as well, or having the top level continue to be a MIME document and specify that the first part must be a JSON document containing the headers. JSON replacing the headers is generally something that would be a good idea, though.
That improves the ability of more language environments to be able to handle the email as a stream or in chunks with "normal" libraries and practices. MIME parsers in languages that tend to favor pulling everything into RAM as a string are still more likely to have been forced to face this issue already.
Username is your public key, password is your private key. So we get end to end encryption and account ownership out of the box. Something similar to how .onion addresses work. Needing easy to remember addresses? Build aliases on top of that. Needing server-side automation? Handle trusted server your private key.
Also, almost everyone carry a 24/7 powered and Internet connected device in their pockets. The Internet - network that allows globally sending any data between devices. Maybe with full redesign third-party email servers should be made optional.
I believe we should focus less on how to redesign whole service and build more universal layers instead. First, vsending any data to any machine. Second, optionally remotely accessing our data. Third, mail-like format of data.
First off, these systems always require indefinitely-lived secrets. To rotate keys (or the whole cryptosystem—think future possible quantum computers) is to change identity. Therefore, to change keys is to break the previous identity. Anything that requires users to think about long-term secrets is user hostile and leads to a fragile system.
Second, the economics of pubkey-as-address are untenable. Can you imagine publishing .onion addresses on billboards and business cards, let alone sharing them verbally? Absolutely not.
Unless there’s something I’m missing (please do say), these problems are intractable when you’re dealing with cryptosystem-based identity.
In the end, identity and naming and fundamentally human concerns. If you try to kludge around this with purely technical solutions, all you’ll end up with is a system that doesn’t adequately reflect what identity means to people. Good systems support this (DNS, email); bad systems fight this (cryptocurrency, nostr).
And don't just say we'll build that on HTTP too!
Sending email should not be free. It should be really, really cheap to send an email to one person (like a fraction of a fraction of a cent), but get exponentially more expensive the more you send.
People shouldn't be able to send emails to you without your prior approval (which you can revoke at an instant).
The recipient should be able to charge a tack-on fee for having email sent to him. I should be able to charge annoying people a lot to send to me, and charge my friends almost nothing. People who send annoying stuff to me should pay more to get my attention.
All of a sudden, forwarding that stupid article without thinking about the content (or even reading the article they're sending) will be second guessed. Save the money (and time), by sending only worthwhile stuff that you penned.