Google announced on October 15, 2026 that AI Inbox is rolling out to paid Workspace users. It has two features: Suggested to-dos, which pull action items, deliverables and deadlines from email threads, and Topics to catch up on, which summarize key topics across multi-message threads. Rollout on Rapid Release domains started October 12 and on Scheduled Release domains October 26, and it is currently only available to US users with EN-US as their language. Google says there is no admin control for this feature.
Our view: If you manage a Workspace domain, plan for staff seeing AI summaries of their mail, because you cannot switch this one off.
Gmail Live: talk to your inbox with voice search on Android and iOS
Gmail Live is a voice search feature that lets you ask questions about your inbox in natural language and hear spoken answers, each with a source email card. Google began rolling it out on October 15, 2026 to paid plans, including Business and Enterprise editions and consumer Google AI Plus, Pro and Ultra. It is mobile only, currently limited to US users with English (US) set, and on by default for organizations with Gemini in Workspace access.
Our view: Voice search over mail is handy, but admins should check the default before staff find it on their phones.
Can email pass SPF, DKIM and DMARC and still be forged? The iCloud spoofing flaw
SEC Consult published research on October 1, 2026 showing two flaws in Apple iCloud's SMTP infrastructure that let a sender show arbitrary @icloud.com addresses in the From header. SPF, DKIM and DMARC all passed, because the DKIM signature was added after a second component had already altered the message. SEC Consult first reported the issue on May 21, 2024, Apple paid a $15,000 bounty on November 19, 2024, and SEC Consult confirmed the fixes on December 9, 2025.
Our view: A pass on SPF, DKIM and DMARC shows the message was authenticated, not proof of who really sent it, so keep treating unexpected requests with care.