Securence stops hosting email on November 11, Mautic patches nine vulnerabilities, and the calendar that decides Q1 sponsorship
Four things an email team can act on this week: a mailbox provider switching off on 11 November with nine domains that stop existing, nine Mautic vulnerabilities to patch, the calendar that decides Q1 sponsorship, and a ten-minute DKIM test.
Coverage window: October 23, 2026 10:15 through October 28, 2026 10:15 (UTC+02:00). Five days, the Friday-to-Wednesday window. Four developments here matter at different speeds: one has a date two weeks out, one is a patch available now, one is a selling window that runs out with the year, and one is a test that takes ten minutes.
A mailbox host switches off on November 11
What changed
U.S. Internet, a Minnesota internet provider, is retiring the hosted services it sells under its own name and under Securence, its email security division. The date is November 11, 2026. 1
The retirement covers Hosted Exchange, POP/IMAP mailboxes and webmail, authoritative DNS hosting, domain registration, FTP, managed firewalls and network monitoring. 1
The vendor's FAQ answers "No" to automatic migration for each of those services, and puts the work on the customer. 1
For Hosted Exchange, new messages to and from the environment stop being accepted on the date, and the administration portal closes with it. 1
Nine domains belong to the provider itself, so the addresses on them disappear rather than move: usinternet.com, usiwireless.com, pixi.com, pixi.net, hula.net, aloha.cm, alohausi.com, usihi.com and luaumail.com. 1
Holders of those mailboxes are told to create an address at a new provider and copy their mail across before the shutdown. Authenticated SMTP goes with POP/IMAP, so any script sending through mail.usinternet.com or mail.securence.com stops at the same moment. 1
Spam Resource flagged the retirement on October 27 and pointed at a snapshot listing more than 1,100 domains that Securence hosted earlier this year. 2
Why it matters
Two exposures sit inside this one announcement, and they call for different work.
The first sits on the receiving side. Addresses at those nine domains are about to stop existing, so mail to them will bounce, and a list that still holds them starts collecting hard failures it cannot repair. 1
Subscribers can still be reached this week. After the cutover, a reminder to update an address has nobody to reach. 2
The second exposure sits on the sending side, for any brand whose own domain resolves through USI nameservers. Authoritative DNS stops answering that day, and a domain still on those nameservers becomes unresolvable, taking its MX records down with it. 1
That outage presents as reputation damage and gets fixed at the registrar. The earlier the nameserver move starts, the less of it lands inside a holiday send. 1
Spam Resource's advice for the addresses is to write to them now, while the mailboxes answer, and to have bounce handling ready for the wave behind them. 2
Checks before acting
- Pull every subscriber whose address ends in one of the nine provider domains, and send those people one message this week asking for a replacement address. 12
- Check whether any domain you send from, including a DKIM or click-tracking subdomain, resolves through USI nameservers, and start the nameserver change at the registrar. 1
- Ask the vendor for a copy of the zone file if the DNS is theirs, and lower the TTL before the cutover so a mistake stays short-lived. 1
- Treat forwarding as a bridge: the vendor's FAQ says forwarding stops when the service does, which leaves the address itself to sort out. 1
- Set the bounce classification for the incoming spike, and suppress the addresses instead of retrying them every send. 2
Mautic fixes nine vulnerabilities, one rated critical
What changed
Mautic published security releases on October 26 for all three maintained branches: 7.2.2, 6.0.10 and 5.2.12. 3
Nine CVEs run across them, and most affect every maintained branch. 4
The critical one is an unrestricted file upload in campaign import, affecting Mautic 7.0.0 through 7.2.1. An authenticated user with permission to import campaigns can copy files out of the uploaded archive into Mautic's public media directory, through the interface or the API. 5
Campaign builders hold exactly the permission the attack needs. On servers that honour per-directory configuration — the default Apache setup in the official Mautic Docker image is one — the upload turns into remote code execution. 5
The advisory lists the impact: code running as the web server user, the Mautic configuration with its database credentials, and read or altered contact data. 5
A second flaw escapes the Twig sandbox in theme templates, and theme creation is a permission administrators hold by default. A third, rated lower, lets an API user who can create assets read any file the web server can reach. 4
That file read is the quiet one. Mautic's configuration holds the database password and the SMTP credentials, and published assets are public, so anyone with the link can download what was read. 4
The release credits 47 outside reporters across the nine issues, 15 of them on the theme flaw, and the agency Leuchtfeuer sponsored it. 4
Why it matters
For a team that hosts its own marketing automation, the install is the sending account.
A configuration file holding SMTP credentials turns a file-read bug into a sending bug. Whoever holds those credentials sends as the brand, and the mail passes SPF, DKIM and DMARC because it leaves on the brand's own setup. 4
Campaign import is the permission worth reviewing. It is a working permission for the person who builds journeys, and the advisory's own interim step is to take it away from everyone who does not strictly need it. 5
Every maintained branch needs a release, so an install held back on 5.x or 6.x for stability gets its own set of fixes to apply. 3
Mautic 4.4 receives the theme fix only through the project's paid extended long-term support. 4
Checks before acting
- Move each install to 7.2.2, 6.0.10 or 5.2.12, after a backup and a run on staging, as the release asks. 3
- Remove campaign-import creation from every role that does not build campaigns, and review who can create themes and assets. 5
- Deny script execution in the media/ directory at server or virtual-host level, where files inside the application cannot override the rule. 5
- Audit existing local assets for paths outside the upload directory, and rotate the SMTP password in the configuration file if the install was reachable and unpatched. 4
Sponsor budgets run on a calendar, and the calendar says now
What it advises
CrossLetter's fifteenth issue, published October 23, treats sponsorship as a buying calendar and sells against it. 6
The shape it describes: Q4 is where the money is, because brands push holiday campaigns and teams spend what is left of the year. January resets and stalls. February and March pick up as plans get signed off. 6
The price evidence behind that shape comes from display advertising, where January prices commonly fall by a quarter to a third. The issue names display advertising as its source. 6
The instructions follow from that. Fill the Q4 slots still open, and hold the rate while demand is high. Pitch Q1 inventory this month, opening with the recap from the campaign the sponsor already ran. 6
The follow-up it suggests runs one line: "Want to lock in your Q1 dates before they go?" 6
Q4 conversations also carry the longer deal — three issues, a quarter, a year at a locked rate — because the sponsor wants price certainty and the operator wants revenue in the quiet months. A five-line written confirmation closes it. 6
January gaps become cross-promotion swaps, since a January discount teaches sponsors to wait for January. The habit the issue recommends for 2027 is one question: when does your financial year end, and when do you plan budgets. 6
Why it matters
This converts "sell more sponsorships" into a date on the reader's own calendar.
The decisions that cost an operator money are taken in the next five weeks: leftover Q4 budget is allocated before December, and Q1 plans are signed before January. 6
The Q1 window is the one that gets missed. A pitch sent in January arrives at a marketing team that has already decided where the money goes. 6
Keeping the Q4 rate protects the price the operator set. An unsold January slot has a second use as swap inventory, which grows the list going into February. 6
One caveat sits in the issue and travels with the advice: financial years vary. A sponsor whose year ends in June runs its own peak in May. 6
Checks before acting
- Put every open slot on the profile with a date and a price, since partners book what they can find. 6
- Package one seasonal hook — a year in review, a gift guide, a tools roundup — and attach a specific issue date to it. 6
- Pull the sponsors who ran this year, send the recap, and ask the Q1 question in the same email this month. 6
- Hold the Q4 rate, and route unsold January slots into swap pitches. 6
A DKIM body hash you can check in one email
What it shows
Word to the Wise published a walkthrough on October 27 that starts DKIM from the body hash, the one part with a published answer. 7
Signing canonicalises the body, hashes it with SHA-256 and base64-encodes the result into the signature's
bh= field. 7Simple canonicalisation strips trailing blank lines and leaves exactly one CRLF at the end. Relaxed canonicalisation also strips trailing whitespace on each line and collapses runs of whitespace inside it. 78
An empty body makes the arithmetic visible. Simple turns nothing into two bytes; relaxed turns nothing into zero. 7
RFC 6376 prints the expected hash for both, so a sender can compute one and compare:
frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY= for simple, 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU= for relaxed. 78Send yourself a message with an empty body, open the DKIM-Signature header, and read
bh=. The c= tag says which canonicalisation was used, with the headers described before the slash. 7Why it matters
Body canonicalisation is the part of DKIM that implementations get wrong, and the trailing CRLF is where they get it wrong first. 7
A wrong body hash surfaces late, as a mailbox provider filtering or rejecting mail the sending team believes is authenticated. 7
The empty body isolates the body half of the signature, because the expected result is already published. Anything that still fails afterwards sits in the headers, the folding or the published DNS record. 7
That makes it a smoke test. It costs one email, and it runs before a new signing library, a new sending domain or a re-platformed stream goes live. 7
Checks before acting
- Run the empty-body test on each stream you sign, and run it again after any change to signing code or configuration. 7
- Record which canonicalisation each stream uses, so the expected hash is known before the test starts. 7
- Keep both hashes in the release checklist; the whole test is one shell command and a header read. 7
Also on the wire
Vonage has added email to its Messages API, alongside SMS, MMS, RCS and WhatsApp, and says the new Email API is available now. Email arrives as a channel for one-time passwords, order confirmations and notifications, with a fallback from SMS to RCS or email inside a single call. 9
For a CRM team already buying messaging from that vendor, it is a second route for transactional mail. List sending and deliverability work continue in their own systems. 9
Next audit
One date, one patch, one selling window, one test. November 11 does the work in the first item: pull the subscribers at those nine domains this week and check whose nameservers your sending domains sit on. The Mautic releases are available now, and the permission review costs an afternoon. Q1 sponsorship is decided this month, whatever January does to prices. The empty-body test takes ten minutes, which is a shorter afternoon than finding out later why a signature failed.
References
- 1Securence Service Retirement FAQs
securence.com
- 2Dead Domains: Securence and USI Email Shutdown
spamresource.com
- 3Mautic Community 7.2.2 release
github.com
- 4Mautic releases fixes for nine security vulnerabilities
emailexpert.com
- 5
- 6The Collaborator by CrossLetter #15
crossletterplatform.beehiiv.com
- 7Fun with DKIM
wordtothewise.com
- 8RFC 6376, sections 3.4.3 and 3.4.4
datatracker.ietf.org
- 9
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.