We have DMARC, DKIM, and SPF [1], and while this provides some signal with regards to mail origination, it falls flat when emails are being sent from Gmail, Yahoo, and other large service providers. This is why email security gateways exist, to wrap stronger security controls around inbound email. This might be email content classification and heuristics, this might be replacing links with control middleware to scan and detonate malware or other exfiltration code and prevent clickers from clicking, etc. None of these mitigations will be perfect though, they will each have some degree of failure or miss.

> Even ignoring AI, I don't know much about email but why isn't there something like a CA for email?

Is there demand for this? Would users pay for it? Or would they tolerate the existing experience with whatever does or does not end of in their Spam folder? The options here are to pick an email provider based on what they can offer from an email protection perspective, or wiring up your own defenses using something that can read your inbox and action emails within it (if your email provider's solution is lacking).

[1] https://www.cloudflare.com/learning/email-security/dmarc-dki...

Huh. In 20 years of using gmail I can't remember ever seeing a phishing email in my inbox (they're all filtered out as spam so I never see them). I'm curious what's led to our different experiences.

Microsoft has paid customers, which send emails via Microsoft Azure hosts. So they're specifically allowlisted and are bypassing Microsoft O365 filters.

Same for Google Business customers.

Phishers pay to send the emails. You don't pay to receive no email. So that's the conflict of interest of these businesses.

The "CA" for email is basically SPF/DKIM/DMARC as extensions but they're kind of useless because all email providers are lying about quarantine mechanisms anyways. Nothing happens if you report an abuse of spam policies.

But I'm kind of biased because I maintain my own antispam repository [1].

Most of the professional phishing campaigns use e.g. cloned websites under a different top level domain (like company-global.com or company-eu.com), with even legit looking profiles on LinkedIn which are even LLM controlled in their responses. They use pictures and sometimes even identities of real people, and the humans usually don't know about anything that's happening online with their identity in their name.

[1] https://github.com/cookiengineer/antispam

Simple. There's no money to be made from fixing it.