Deploying bwak.news to the public landed differently. The level of abstraction between the users and me lowered the stakes. They are people I don’t know sitting on the other side of a computer monitor.
So when I decided to deploy bwak.email to my family’s email domain, theeberts.us, I was naturally terrified of how my wife, Charlotte, would accept the change.
There was no hiding behind a screen of anonymity like bwak.news afforded me. This time, the user lives under the same roof.
She watched me toil over its development. I reported the progress to her as I tested it on my personal email domain, k3bert.net.
She understands the concept; it’s a tool for controlling who sends you emails. You get an email from our bank, approve it. You get an email from a Prince from Sub-Saharan Africa; you deny it. The difference is, these decisions are made before the email lands in your inbox.
Not a spam filter.
Not inbox rules.
Just a gate; you control who gets to enter your inbox.
The software flips the script; instead of anyone with your address emailing you, they have to pass through a gate that you hold the key to. You don’t let them in; their email never sees the light of day in your inbox.
Until last week, the concepts were just that, concepts to her. She lacked any hands-on experience. The things I told her about what the software would do had no meaning until now.
This was the first time I got to launch software where the primary user lived under the same roof as I did. Her ability to understand and operate the software is the litmus test I’ll use to decide whether to take the software public.
So, I was excited and nervous.
I hit the deploy button and in the immortal words of Vivian Ward (played by Julia Roberts) in the movie “Pretty Woman”
Big mistake. Big. Huge.
You see, I did something stupid. Not only did I deploy bwak.email to the theeberts.us domain, but I also decided to move our primary email provider from Proton Mail to Apple’s iCloud Plus (iCloud+) at the same time.
You never deploy two breaking changes at the same time. Never. Full stop.
So, it won’t come as a surprise to you when I tell you that she went to the USPS website and signed up to receive delivery notifications for a package she was receiving later in the week. Bwak.email sent her the approval request, “Let USPostalService@usps.com through” and she clicked the link to approve, and nothing happened.
I swear you could see the blood leave my face. Something I had tested hundreds of times before didn’t work.
Digging through the logs gave me the error.
Blocked due to content: The message was rejected because it contained content that the recipient’s server doesn’t allow
And as if the software gods were watching and laughing at me, another approval request came in, this time from our bank alerting us to a new statement.
She approved it.
And again, nothing delivered.
I sent my own test message in from my Gmail account, approved it, and it works!
After digging through the Resend API documentation and a few expletives later, I found the root cause.
The way Resend forwarded the email to the inbox after approval broke the email’s chain of custody and removed the original DKIM signature. Apple was interrogating the message, recognizing it originated from the USPS. But without the original DKIM signature, it flagged the message as spoofed and would not deliver the forwarded message from bwak.email.
This behavior was different. All my testing to date used Proton Mail as my mail provider, but as part of this changeover, I moved the domain to Apple’s iCloud+ service for our mail hosting, essentially negating the months of testing I did with k3bert.net.
I had a choice to make: roll back to the last known good state, which meant moving back to Proton Mail and undeploying bwak.email from theeberts.us domain. This didn’t excite me; by now it was 1:30 AM and any rollback would be a three- to four-hour process.
Emails weren’t being lost; I still had the failed messages in the logs, but my wife couldn’t see them.
So I did the next logical thing, I forged ahead.
Forging ahead meant finding another mailing service, Mailgun, that had an API that supported forwarding original MIME-type messages, which meant the DKIM would remain intact.
On paper, it should work.
It took 12+ hours to set up the Mailgun account. There was a verification process I had to go through to prove ownership of the domain I was using, and to describe the system I built, which required a human to review and approve.
In the end, I swapped out Resend for Mailgun, and I was ready to test again.
I might be making it up, but I swear I saw the clouds part and the sun come through the moment Charlotte hit approve on the same USPS message from the day before, and bwak.email delivered the message.
You could hear Katrina and the Waves’ song “Walking on Sunshine” start up in the background. That was me, walking on sunshine and partying like you’d expect a 54-year-old retired technologist would party.
A few days later, Charlotte is managing our email domain theeberts.us like a boss. I’ve purposefully stepped back to let her go at it. I spent 60 seconds explaining how to use the app, and here she was a few days later, owning it, approving and blocking senders like the pro she is.
Interesting Read
This week, I’m adding a new section to the newsletter that you’ll see from time to time. It’s part experiment and part advertisement for bwak.news, the first app I built to bring to market.
The whole point of this section is that it’s a quick take on something I read over the last week that got me thinking, and I want to share.
Hiding Out — Seth Godin
Originally published via Seth’s Blog Newsletter: https://app.bwak.news/share/aoci2PpJ10w
My Take
I have a long history of playing things safe, or at least holding things close to my chest.
Safe works until it doesn’t.
Being reminded that time is batting a thousand for outing safety motivates you to bet on yourself.
Truer words couldn’t be spoken for where I’m at in my life at this point. I’m calling myself retired, but I’m learning I have a lot more to give. So recoiling into the safety of my home is no longer a stance I’m taking because time will out me.
What’s something you built, wrote, or made that you didn’t really trust was good enough? Not until someone picked it up on their own and got it, without you there to explain it?
—Kevin