What I meant was that Email as a whole should be overhauled, though SMTP is by far the weakest link there. All the kludges and workarounds like DMARC, SPF etc don't fix the issues, and this is why so many companies are inventing the wheel. For example, Microsoft won't let your server deliver mail to them if you don't have enough 'reputation', meaning you must send a certain number of emails that are not spam. Otherwise you will find yourself in the doghouse (I've commented on this more detailed before). Even if you never sent spam in your entire life and your server isn't on any blocklist!
SMTP is decentralised yes and that is a great thing. But such measures like MS are doing totally undermine this decentralisation. And it will continue to do so, it's already super hard to run your own small-time server for the issues mentioned below. This decentralisation is already disappearing. It's time for a new protocol that is ready for the future.
> It depends, B2B absolutely still do.
They do for now because people involved in sales are usually hungry for business and don't care about the risks. They want to have low barriers for the customers, which is understandable. However there are significant risks depending on how the customer does their mail. We're on O365 and comms with other companies that are also on that are obviously pretty secure because they never go unencrypted through the public internet. Again a point that Microsoft (and Google) make into a selling point for their services, further undermining decentralisation.
We in the cybersecurity realm are imposing rules, e.g. any confidential info must be shared through secure filesharing. But it's hard to avoid this happening.
