Ask HN: How the hell haven't we solved phishing emails yet?

We have DMARC, DKIM, and SPF [1], and while this provides some signal with regards to mail origination, it falls flat when emails are being sent from Gmail, Yahoo, and other large service providers. This is why email security gateways exist, to wrap stronger security controls around inbound email. This might be email content classification and heuristics, this might be replacing links with control middleware to scan and detonate malware or other exfiltration code and prevent clickers from clicking, etc. None of these mitigations will be perfect though, they will each have some degree of failure or miss.

> Even ignoring AI, I don't know much about email but why isn't there something like a CA for email?

Is there demand for this? Would users pay for it? Or would they tolerate the existing experience with whatever does or does not end of in their Spam folder? The options here are to pick an email provider based on what they can offer from an email protection perspective, or wiring up your own defenses using something that can read your inbox and action emails within it (if your email provider's solution is lacking).

[1] https://www.cloudflare.com/learning/email-security/dmarc-dki...