{
  "id": 12124029,
  "title": "Our outreach address stopped being unguessable, so a reply now has to prove it belongs to the thread",
  "url": "https://urgent.news/2026/10/05/our-outreach-address-stopped-being-unguessable-so-a-reply-now-has-to",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-05T10:07:20.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/daniel_pertu/our-outreach-address-stopped-being-unguessable-so-a-reply-now-has-to-prove-it-belongs-to-the-thread-278b"
  },
  "original_language": "en",
  "account": "Nakodo emails creators on a brand's behalf, with each conversation having its own address on their sending domain. The Reply-To field in these emails is a suggestion that mail clients are free to ignore, so the From field becomes the thing that identifies the conversation. The address used in that post was acme-coffee-q7mkz3xpt2vn@nakodo.app, which consists of 12 characters from a 31-character alphabet, making it about 59 bits and nearly impossible to guess. This address is also clearly a robot. When a creator sees the sender before replying, they should treat the email as a genuine approach from a real brand. The new address format for a thread is acme-coffee-outreach-12@nakodo.app, which reads like a mailbox at a company. However, this address is guessable, which means it no longer serves as proof of anything.\n\nThere are two main functions regarding these addresses. The first is the opt-out links, which use the token unsubscribe+ for the mailto part of List-Unsubscribe and /o/ token for the page. The second is the brand's own reply address, which is used when a creator asks something only the brand can answer. When a brand responds to such an email, its words go to the creator from the thread, ensuring the creator never sees the brand's address until introduced. The token address remains random and secure.",
  "summary": "Nakodo emails creators on a brand's behalf and each conversation has its own address on our sending domain. I wrote about why each thread gets its own address a couple of days ago: Reply-To is a suggestion that mail clients are free to ignore, so the From has to be the thing that identifies the conversation. The address in that post was acme-coffee-q7mkz3xpt2vn@nakodo.app . Twelve characters from…",
  "key_points": [
    "Nakodo emails creators with unique addresses for each conversation",
    "Reply-To field in emails is ignored by mail clients",
    "New outreach address format is guessable and no longer secure"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}