--- title: Modern email can be built from borrowed parts | daily.dev description: A design proposal for HMTP (Hypertext Mail Transfer Protocol), a modern email system built entirely on existing, battle-tested technologies over HTTP. The... canonical: https://daily.dev/posts/modern-email-can-be-built-from-borrowed-parts-j4u54lv6u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Modern email can be built from borrowed parts | daily.dev og:description: A design proposal for HMTP (Hypertext Mail Transfer Protocol), a modern email system built entirely on existing, battle-tested technologies over HTTP. The... og:url: https://daily.dev/posts/modern-email-can-be-built-from-borrowed-parts-j4u54lv6u og:image: https://api.daily.dev/og/posts/J4U54Lv6u.png og:image:alt: Modern email can be built from borrowed parts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Modern email can be built from borrowed parts **[Hacker News](https://daily.dev/sources/hn)** · 10 min read · 0 upvotes · 0 comments ## Summary A design proposal for HMTP (Hypertext Mail Transfer Protocol), a modern email system built entirely on existing, battle-tested technologies over HTTP. The design replaces SMTP's 40-year-old flaws by assembling components already in production: WebFinger for user discovery, ActivityPub-style inbox delivery, Ed25519 signatures, HPKE end-to-end encryption, sigchains for key rotation identity, JMAP for reading, and first-contact consent for spam control. Every problem in email — spoofing, spam, PGP adoption, DKIM complexity, duplicate delivery — gets a cryptographic or protocol-level solution. A working Python prototype implementing the full transport layer is available on GitHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community take How the wider developer community reacted, aggregated from 1 discussion and 45 comments across hackernews (as of 2026-07-27). **TL;DR:** The community finds the ideas interesting (especially first-contact consent and optional postage) but is largely skeptical that they solve existing problems or offer meaningful improvements over incremental SMTP enhancements, citing network effects, prior failed attempts, and unresolved technical issues. **Sentiment:** 25% positive · 50% mixed · 25% skeptical **The case for** - First-contact consent / 'requests' inbox is seen as a genuinely appealing UX idea, similar to Signal and Hey.com. - Optional postage (HTTP 402) as a cost on cold spam is considered a creative and potentially effective deterrent. - Building on HTTP/JMAP is viewed by some as a pragmatic choice given existing tooling and capabilities. - The project is framed as a fun learning exercise, which commenters appreciate as honest framing. **The pushback** - The 'requests' folder likely just becomes the new spam inbox, moving rather than solving the problem. - Network effects make any email replacement extremely difficult to gain adoption without backwards compatibility with SMTP. - Prior attempts at similar ideas (challenge-response whitelisting, digital postage) failed in the late 1990s–2000s due to UX friction and provider resistance. - Content-addressed email breaks mailing lists that need to modify headers. - Domain-based key fallback is criticized as a weak security model since domains are rented, not owned. - The proposal copies PGP's mistake of leaving metadata unencrypted. - The website UX (live visitor counter, sliding panels) undermined credibility for some readers. **By community** - hackernews (mixed): Commenters appreciate the creative ideas but raise substantial technical and historical objections, and are broadly skeptical about adoption prospects. **Hottest debate:** Whether the 'requests' inbox genuinely solves spam or merely relocates it, and whether HTTP-based email is a real improvement over incremental SMTP enhancements. **Open questions** - How would the system handle no-reply transactional emails (banks, e-commerce) under a first-contact consent model? - What is the realistic migration/backwards-compatibility path with existing SMTP infrastructure? - How should key rotation and loss of private keys be handled without falling back to domain authority? - Could this protocol also replace direct-messaging protocols like WhatsApp? **Highlights** > "We" tried this in the late 1990s. I remember writing an exim config to do this a couple of ways back in my ISP times: 1. "The recipient will not get this message until you authenticate yourself as a legitimate sender at this URL [...]" - resulted in people never getting mail from no-reply addresses they cared about (banks, e-com, etc.) 2. "This sender has sent you an email, with this subject and this first paragraph. Click here to whitelist, here to blacklist" - created a lot of churn on first setup that users didn't like as a UX Baking it into the protocol - even now in SMTP and IMAP land - is doable, but would be resisted by email providers who, for example, make their money selling data to marketing agencies. Like, you know, Google, Microsoft, Yahoo... I've seen other approaches proposed - even at IETF level - over the years, including digital postage stamps (sender pays to send email, your server gets paid, and may reject non-stamped/paying email), but it's the usual network effect: until it becomes widely supported it won't "stick". The stuff that has been adopted has basically been stuff that Google likes, period. > — [PaulRobinson on hackernews](https://news.ycombinator.com/item?id=49071613) > I think the network effects make email hard to replace, virtually everyone online has an email address. If this could include a migration path, with backwards compatibility with SMTP, I think it would have a better shot of getting adoption. Modern email already depends on HTTP, with protocols like MTA-STS (https://www.rfc-editor.org/info/rfc8461/) using HTTPS/TLS to improve transit encryption, or Web Key Directory (https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...) which uses HTTP for key distribution. Personally I think these incremental improvements of SMTP are more promising than replacements, but we deserve better email however we can build it. > — [8organicbits on hackernews · 1 comments](https://news.ycombinator.com/item?id=49068358) > Content-addressed email breaks mailing lists, as those need to be able to add headers for subscribe/unsubscribe/list id, etc. There is a reason DKIM allows you to pick which headers to sign. > — [AKSF\_Ackermann on hackernews](https://news.ycombinator.com/item?id=49069038) > We could add a friend-of-friend for 1 degree of separation (Alice gets an email from Bob, she doesn't know Bob, so it would go into her Requests folder. But Charlie knows Bob and has said 'yes this guy is legit' and Alice has configured her email to trust Charlie's email recommendations up to 2 degrees of separation, so it goes into the inbox with an explanation that it was allowed by Charlie's trust of Bob). And poof, we've poorly remembered Web of Trust from 20 years ago! Overall I do love the idea of HTMP and if we could get it to easily fall back to standard old bad email, I think it could start as a niche and then upgrade towards HTMP over time as more clients adopted support for it. > — [Multicomp on hackernews](https://news.ycombinator.com/item?id=49071172) > Copies the mistake from PGP with the unencrypted metadata. > — [dinkelberg on hackernews](https://news.ycombinator.com/item?id=49072336) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49066639) · 42 points · 45 comments ## Similar posts on daily.dev - [email encryption](https://daily.dev/posts/email-encryption-vq5mtx7ui) · Lobsters · 0 upvotes · 0 comments - [Email is crazy](https://daily.dev/posts/email-is-crazy-y6xb4vf9s) · Lobsters · 0 upvotes · 0 comments - [Everything You Need to Know About Email Encryption in 2026](https://daily.dev/posts/everything-you-need-to-know-about-email-encryption-in-2026-wpxxvlwtg) · Dhole Moments · 2 upvotes · 0 comments - [Designing Email Infrastructure for a Production Web Application](https://daily.dev/posts/designing-email-infrastructure-for-a-production-web-application-v6hsdq1sd) · SitePoint · 0 upvotes · 0 comments - [Email Has Become Critical Infrastructure](https://daily.dev/posts/email-has-become-critical-infrastructure-ht1ijzht0) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python), [#cryptography](https://daily.dev/tags/cryptography), [#activitypub](https://daily.dev/tags/activitypub) [View this post on daily.dev](https://daily.dev/posts/modern-email-can-be-built-from-borrowed-parts-j4u54lv6u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Modern email can be built from borrowed parts","url":"https://daily.dev/posts/modern-email-can-be-built-from-borrowed-parts-j4u54lv6u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/modern-email-can-be-built-from-borrowed-parts-j4u54lv6u"},"datePublished":"2026-07-27T12:14:49.524Z","dateModified":"2026-07-27T17:14:30.202Z","description":"A design proposal for HMTP (Hypertext Mail Transfer Protocol), a modern email system built entirely on existing, battle-tested technologies over HTTP. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/217465de9a089f48e742c3112cb7b2f3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/217465de9a089f48e742c3112cb7b2f3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/modern-email-can-be-built-from-borrowed-parts-j4u54lv6u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,cryptography,activitypub","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Modern email can be built from borrowed parts"}]} ```