M3AAWG69 in Vancouver, CA, February 15–18, 2027 – Topic Submissions are open through December 1, 2026: https://m3aawg.org/submissions
With the highest attendance of any European M3AAWG General Meeting since the pandemic, members, speakers, and guests gathered in Paris to transform shared challenges into collective action. M3AAWG68 marked a pivotal moment in strengthening global collaboration and shaping the future of the fight against online abuse.
Tom Bartel, Chairperson of the M3AAWG Board of Directors, opened M3AAWG68 by reinforcing the purpose behind our work: preventing online abuse. He framed M3AAWG’s mission through three defining principles:
- Our posture of confronting online threats
- Our worldview of defending an open internet
- Our commitment to protecting people.
Bartel then went on to explore how we work to prevent online harm, outlining four essential steps that guide our efforts:
- Recognize the problem: Identify what’s wrong and where harm is occurring.
- Envision what’s right: Define the outcomes we want to achieve.
- Seek understanding: Explore the challenges and underlying causes.
- Find solutions: Identify actionable ways to drive meaningful change.
Attendees were then introduced to a new addition to the M3AAWG framework called L.E.A.D., which has been designed to align and focus outcomes for M3AAWG Initiatives
- Learn: Understand the problem.
- Educate: Share what you know, ask what you don’t.
- Amplify: Multiply our impact.
- Disrupt: Change the outcome.
“M3AAWG excels at Learn and Educate, and the next stage of our evolution must put a focus on how we improve our impact and follow-through with Amplify and Disrupt, which will ultimately improve internet safety,” said Bartel of the addition of L.E.A.D.
As Bartel wrapped up the opening, he made it clear that the next time someone asks attendees what it is that M3AAWG does, they should be able to confidently say:
At M3AAWG, we work to end online abuse, we protect people, and we do it by working together.
There’s much more to come on the implementation of LEAD and the outcomes of M3AAWG68. As we prepare to share deeper insights in upcoming publications, let’s take a closer look at some of the compelling discussions, emerging challenges, and actionable ideas that made M3AAWG68 in Paris a central gathering for the global anti-abuse community.
The Risk of the Messy Closet: How Good DNS Hygiene & DMARC Data Help Prevent Domain Abuse
Presented by Faisal Misle, Steven Iacoviello, and Carel Bitter
The session explored how bad actors capitalize on poor DNS hygiene by leveraging unused DNS records that point to stale infrastructure. This is partly due to cloud deployments changing what DNS was being used for. Estates grew from hundreds to tens of thousands of records, in some cases hundreds of thousands. Ownership fragmented: infrastructure, marketing, dev, SaaS vendors, and cloud providers are now all requesting additions to a DNS zone, and nobody removes them after the lifecycle ends. The session proposed a 5-stage framework for teams to manage their DNS estate and monitor for gaps. Lastly, it offered a glimpse of how to use DMARC data to detect email traffic originating from a hijacked stale subdomain.
Technical Responses to IBSA and Deepfake Abuse: How You Can Be Part of the Solution
Presented by Betsy Broder, Jean-Christophe Le Toquin, Wido Potters, Amélie Rives, Paul Vixie
The session explored how anti-abuse teams, helplines, and authorities can collaborate to prevent the non-consensual creation and sharing of intimate imagery while avoiding further victimization. Cooperation and engagement must be central to this effort, and M3AAWG is well positioned to take a leadership role.
IBSA differs from CSAM (child sexual abuse material) as its severity depends on personal and cultural contexts, with consent at its core. Effective harm mitigation requires swift content removal and measures to prevent reuploads. Laws in the EU, UK, and US increasingly support rapid removal. Some also underscore the importance of hash-listing systems: by detecting and blocking the redistribution of previously identified content, they help prevent further harm and reputational damage while offering an efficient, cost-effective, and scalable solution.
What's Your Real Age?: Keeping Kids Safe Online
Presented by Betsy Broder, Antonin Molle, Florent Tournois
This focused on a simple principle: proving your age online should not necessarily mean proving who you are. For many services, the relevant information is simply whether a user meets an age threshold, such as “over 18”, rather than their exact age, date of birth, or identity. France Identité presented this privacy-preserving approach, while Antonin Molle shared complementary insights on reusable age assurance and the OpenAge Initiative’s work to enable private and interoperable age signals. The discussion at M3AAWG showed how data minimisation, interoperability and trusted age assurance can work together to support a safer internet.
Mail Transfer Agent (MTA) Fundamentals
Presented by Liam Kelly and Kieran Cooper
This was presented as a vendor-agnostic training on “MTA Fundamentals”, targeted at M3AAWG attendees who don’t necessarily administer their own Mail Transfer Agent but could benefit from better understanding the concepts and functions on which MTAs are built. The training covered topics like SMTP fundamentals, ingress, delivery, queueing, observability, mail ops roles, and infrastructure deployment. It concluded with some collaborative workshopping of hypothetical scenarios - e.g., “An alert fires to say that the delayed queues are growing bigger than usual. What would you look for to resolve this?” While some M3AAWG members have been answering these kinds of questions for years, the training served as a boot camp for those new to the topics.
Can We Work Together on a More Secure Internet? Introducing the Global Internet Standards Testing Community
Presented by Alena Muravska from RIPE NCC, Chair of the Global Internet Standards Testing Community (GISTC)
Every day, almost 400 billion emails are sent and received worldwide. Without adequate protection, however, email is vulnerable to eavesdropping, spoofing, and phishing—risks that are exploited on a massive scale. More than 90% of cyberattacks begin with email, making it a major digital attack surface. Proven standards can significantly reduce these risks. SPF, DKIM and DMARC help prevent domain spoofing, while STARTTLS and DANE protect email in transit. Despite being freely available and effective, adoption of these standards remains incomplete.
Internet.nl helps organisations assess their implementation of email security standards and other modern Internet standards. Its email test checks a domain’s configuration and provides an overall score, detailed results and pointers to areas for improvement. Organisations can use these results to identify gaps and work with their email or hosting provider to address them. The GISTC builds on this practical foundation to accelerate adoption through international knowledge exchange, coordination and joint development. Bringing together organisations and individuals around the Internet.nl test tool and its open-source code, the community is open to anyone interested in advancing modern Internet standards. Membership is voluntary. To get involved, contact international@internet.nl.
These are only a handful of the impactful sessions and trainings held at M3AAWG’s 68th General Meeting in Paris, France, October 26–29, 2026. Keep an eye out for additional publications detailing lessons learned and the road ahead.
Members of the global anti-abuse community have an opportunity to contribute to our upcoming 69th General Meeting, taking place in Vancouver, Canada, February 15–18, 2027, by submitting general topics by December 1, 2026. Subscribe to this blog to receive new article updates.
Not a M3AAWG Member? Maybe you should be.
Visit m3aawg.org/join to learn more about the benefits of being part of the M3AAWG community and the application process.