Two invisible failures made visible: unencrypted mail, and email that looks machine-made

Both of these were already failing. Neither of them told anyone, which is the point.

You can now see when encryption fails

Mail between servers is normally encrypted. When it cannot be, the fallback is to send it in the clear anyway - and neither end reports it. An expired certificate on your mail host, a misconfigured MX record, a sending provider quietly downgrading: all of it is invisible from both sides, indefinitely.

TLS reporting is now offered on every sending domain. Publish one TXT record and the servers that deliver to you send a daily report of every connection where encryption failed or a policy did not validate. We collect and read them for you. One record, nothing to maintain, and genuinely no downside - it changes nothing about how your mail is handled, it only makes the failures visible.

This is also the groundwork for requiring encryption rather than preferring it. That is a much bigger step, because an incorrect policy makes mail to your domain undeliverable rather than merely unencrypted - so it is deliberately not on offer until these reports show a clean run first. Evidence before enforcement, the same order we take with DMARC.

Automated email now looks like a real system sent it

A sign-in notice from Solstral landed in a customer’s junk folder while every authentication check on it passed - SPF, DKIM, DMARC, all green. The reason had nothing to do with cryptography. Authentication proves who sent a message. The envelope is most of what says a real operator sent it, and that message had almost none of one: a bare address on the From line with no name in front of it, no plain-text version for clients that do not render HTML, nothing identifying the organisation, and nothing telling an out-of-office responder not to reply to it.

Every automated email the product sends now carries those things. Where we know your brand, it is your name on the From line rather than a bare address. Each message is also individually identified, so your inbox stops collapsing three separate sign-in alerts into one thread and hiding the two you needed to see.

Nothing here overrides a choice you made: an address you set, a subject you wrote, a campaign’s own unsubscribe link all stay exactly as they are. It fills in what was blank. And it is applied centrally rather than template by template, which is the actual fix - the original defect was one template quietly missing what fourteen others had.