⚠️ mail.et Is Currently Non-Functional
Affected domain: @mail.et
First observed: January 2026
Status: Unresolved — awaiting response from the .et registry
Dear Mail.sb Users,
We owe the mail.et community a long-overdue public update. Since January 2026, mail.et has been effectively non-functional for email due to a DNSKEY / DNSSEC chain-of-trust failure at the .et registry level. We've known about this from very early on, we've tried repeatedly to get it fixed on our side, and we have so far been unable to get a reply from the .et registry. We're sorry — both for the service impact and for how long this notice has taken to post.
What's actually broken
The DNSSEC chain is signed at each level: the root delegates to .et, and .et delegates to mail.et. For DNSSEC-validating resolvers to trust records under mail.et, the .et registry must publish a matching DS record for our DNSKEY. That delegation is currently wrong — the DS at the registry doesn't match our active DNSKEY — so any validating resolver returns SERVFAIL when looking up mail.et.
In practice this means:
- Outbound mail fails. Receiving mail servers that validate DNSSEC (and most large providers do, either directly or via DANE/MTA-STS lookups) cannot resolve our SPF, DKIM, or MX records, so mail from
@mail.etis rejected or silently dropped as unauthenticated. - Inbound mail fails. Sending mail servers cannot reliably resolve the
mail.etMX records for the same reason, so messages addressed to@mail.etbounce at the sender's side before ever reaching us. - Webmail and login sometimes fail. Users on DNSSEC-validating networks may also be unable to reach
webmail.mail.et/ API endpoints on themail.ethostname.
What is not affected
Your mailbox data is safe and untouched. The domain itself is still registered and fully under our administrative control — this is not a domain loss, not a hijack, and not a data issue. Specifically:
- All stored mail, folders, filters, contacts, and settings remain intact on our servers.
- Your account credentials continue to work — you just can't currently exchange mail over the
@mail.etidentity. - If you also hold addresses on other mail.sb domains (
@mail.sb,@mail.ss,@mail.tl, etc.), those are unaffected and continue to operate normally.
What we've tried
Since first recognising the problem in January we have:
- Re-rolled our DNSKEY set and re-submitted matching DS records to the registry, multiple times.
- Tested via independent DNSSEC validators (Verisign DNSViz, Google
dns.google, Cloudflare1.1.1.1) to confirm the break is at the.etzone cut — not in our authoritative servers. - Contacted the
.etregistry repeatedly through every official channel we could identify.
To date we have not received any reply. The technical fix is a single registry-side operation, but without their cooperation we cannot force it through.
What happens next
As soon as we get a response from the .et registry and the DS delegation is corrected, full service on @mail.et will restore automatically — typically within one DNS TTL window after the fix. We will post a follow-up announcement the moment that happens.
In the meantime, if @mail.et is your primary address and you need working mail right now, we recommend adding an alias on one of our other domains from your dashboard and using that as your active sending/receiving identity until this is resolved.
We're genuinely sorry for the disruption. Thank you for your patience.
— Mail.sb Team
Comments (0)
No comments yet. Be the first!
Leave a comment