Email authentication protocols like SPF, DKIM, and DMARC play a critical role in protecting domains from spoofing and phishing. However, when SEGs are introduced into the email path, the interaction with these protocols becomes more complex. Security gateways(SEGs) are a core part of many organizations’ email infrastructure. They act as intermediaries between the public internet and internal mail systems, inspecting, filtering, and routing messages. This blog examines how security gateways handle SPF, DKIM, and DMARC, with real-world examples from popular gateways such as Proofpoint, Mimecast, and Avanan. We’ll also cover best practices for maintaining authentication integrity and avoiding misconfigurations that can compromise email authentication or lead to false DMARC failures. Security gateways often sit at the boundary between your organization and the internet, managing both inbound and outbound email traffic. Their role affects how email authentication protocols behave. An inbound SEG examines emails coming into your organization. It checks SPF, DKIM, and DMARC to determine if the message is authentic and safe before passing it to your internal mail servers. An outbound SEG handles emails sent from your domain. It may modify headers, rewrite envelope addresses, or even apply DKIM signing. All of these can impact SPF,  DKIM, or DMARC validation on the recipient’s side. Understanding how SEGs influence these flows is crucial to maintaining proper authentication and avoiding unexpected DMARC failures. Inbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When an email comes into your organization, your security gateway is the first to inspect it. It checks whether the message is real, trustworthy, and properly authenticated. Let’s look at how different SEGs handle these checks. Avanan (by Check Point) SPF: Avanan verifies whether the sending server is authorized to send emails for the domain by checking the SPF record. DKIM: It verifies if the message was signed by the sending domain and if that signature is valid. DMARC: It uses the results of the SPF and DKIM check to evaluate DMARC. However, final enforcement usually depends on how DMARC is handled by Microsoft 365 or Gmail, as Avanan integrates directly with them. Avanan offers two methods of integration:1. API integration: Avanan connects via APIs, no change in MX, usually Monitor or Detect modes.2. Inline integration: Avanan is placed inline in the mail flow (MX records changed), actively blocking or remediating threats. Proofpoint Email Protection SPF: Proofpoint checks SPF to confirm the sender’s IP is authorized to send on behalf of the domain. You can set custom rules (e.g. treat “softfail” as “fail”). DKIM: It verifies DKIM signatures and shows clear pass/fail results in logs. DMARC: It fully evaluates DMARC by combining SPF and DKIM results with alignment checks. Administrators can configure how to handle messages that fail DMARC, such as rejecting, quarantining, or delivering them. Additionally, Proofpoint allows whitelisting specific senders you trust, even if their emails fail authentication checks. Integration Methods Inline Mode: In this traditional deployment, Proofpoint is positioned directly in the email flow by modifying MX records. Emails are routed through Proofpoint’s infrastructure, allowing it to inspect and filter messages before they reach the recipient’s inbox. This mode provides pre-delivery protection and is commonly used in on-premises or hybrid environments. API-Based (Integrated Cloud Email Security – ICES) Mode: Proofpoint offers API-based integration, particularly with cloud email platforms like Microsoft 365 and Google Workspace. In this mode, Proofpoint connects to the email platform via APIs, enabling it to monitor and remediate threats post-delivery without altering the email flow. This approach allows for rapid deployment and seamless integration with existing cloud email services. Mimecast SPF: Mimecast performs SPF checks to verify whether the sending server is authorized by the domain’s SPF record. Administrators can configure actions for SPF failures, including block, quarantine, permit, or tag with a warning. This gives flexibility in balancing security with business needs. DKIM: It validates DKIM signatures by checking that the message was correctly signed by the sending domain and that the content hasn’t been tampered with. If the signature fails, Mimecast can take actions based on your configured policies. DMARC: It fully evaluates DMARC by combining the results of SPF and DKIM with domain alignment checks. You can choose to honor the sending domain’s DMARC policy (none, quarantine, reject) or apply custom rules, for example, quarantining or tagging messages that fail DMARC regardless of the published policy. This allows more granular control for businesses that want to override external domain policies based on specific contexts. Integration Methods Inline Deployment: Mimecast is typically deployed as a cloud-based secure email gateway. Organizations update their domain’s MX records to point to Mimecast, so all inbound (and optionally outbound) emails pass through it first. This allows Mimecast to inspect, filter, and process emails before delivery, providing robust protection. API Integrations: Mimecast also offers API-based services through its Mimecast API platform, primarily for management, archival, continuity, and threat intelligence purposes. However, API-only email protection is not Mimecast’s core model. Instead, the APIs are used to enhance the inline deployment, not replace it. Barracuda Email Security Gateway SPF: Barracuda checks the sender’s IP against the domain’s published SPF record. If the check fails, you can configure the system to block, quarantine, tag, or allow the message, depending on your policy preferences. DKIM: It validates whether the incoming message includes a valid DKIM signature. The outcome is logged and used to inform further policy decisions or DMARC evaluations. DMARC: It combines SPF and DKIM results, checks for domain alignment, and applies the DMARC policy defined by the sender. Administrators can also choose to override the DMARC policy, allowing messages to pass or be treated differently based on organizational needs (e.g., trusted senders or internal exceptions). Integration Methods Inline mode (more common and straightforward): Barracuda Email Security Gateway is commonly deployed inline by updating your domain’s MX records to point to Barracuda’s cloud or on-premises gateway. This ensures that all inbound emails pass through Barracuda first for filtering and SPF, DKIM, and DMARC validation before being delivered to your mail servers. Deployment Behind the Corporate Firewall: Alternatively, Barracuda can be deployed in transparent or bridge mode without modifying MX records. In this setup, the gateway is placed inline at the network level, such as behind a firewall, and intercepts mail traffic transparently. This method is typically used in complex on-premises environments where changing DNS records is not feasible. Cisco Secure Email (formerly IronPort) Cisco Secure Email acts as an inline gateway for inbound email, usually requiring your domain’s MX records to point to the Cisco Email Security Appliance or cloud service. SPF: Cisco Secure Email verifies whether the sending server is authorized in the sender domain’s SPF record. Administrators can set detailed policies on how to handle SPF failures. DKIM: It validates the DKIM signature on incoming emails and logs whether the signature is valid or has failed. DMARC: It evaluates DMARC by combining SPF and DKIM results along with domain alignment checks. Admins can configure specific actions, such as quarantine, reject, or tag, based on different failure scenarios or trusted sender exceptions. Integration methods On-premises Email Security Appliance (ESA): You deploy Cisco’s hardware or virtual appliance inline, updating MX records to route mail through it for filtering. Cisco Cloud Email Security: Cisco offers a cloud-based email security service where MX records are pointed to Cisco’s cloud infrastructure, which filters and processes inbound mail. Cisco Secure Email also offers advanced, rule-based filtering capabilities and integrates with Cisco’s broader threat protection ecosystem, enabling comprehensive inbound email security. Outbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When your organization sends emails, security gateways can play an active role in processing and authenticating those messages. Depending on the configuration, a gateway might rewrite headers, re-sign messages, or route them through different IPs – all actions that can help or hurt the authentication process. Let’s look at how major SEGs handle outbound email flow. Avanan – Outbound Handling and Integration Methods Outbound Logic Avanan analyzes outbound emails primarily to detect data loss, malware, and policy violations. In API-based integration, emails are sent directly by the original mail server (e.g., Microsoft 365 or Google Workspace), so SPF and DKIM signatures remain intact. Avanan does not alter the message or reroute traffic, which helps maintain full DMARC alignment and domain reputation. Integration Methods 1. API Integration: Connects to Microsoft 365 or Google Workspace via API. No MX changes are needed. Emails are scanned after they are sent, with no modification to SPF, DKIM, or the delivery path.  How it works: Microsoft Graph API or Google Workspace APIs are used to monitor and intervene in outbound emails. Protection level: Despite no MX changes, it can offer inline-like protection, meaning it can block, quarantine, or encrypt emails before they are delivered externally. SPF/DKIM/DMARC impact: Preserves original headers and signatures since mail is sent directly from Microsoft/Google servers. 2. Inline Integration: Requires changing MX records to route email through Avanan. In this mode, Avanan can intercept and inspect outbound emails before delivery. Depending on the configuration, this may affect SPF or DKIM if not properly handled. How it works: Requires adding Avanan’s Protection level: Traditional inline security with full visibility and control, including encryption, DLP, policy enforcement, and advanced threat protection. SPF/DKIM/DMARC impact: SPF configuration is needed by adding Avanan’s include mechanism to the sending domain’s SPF record. The DKIM record of the original sending source is preserved. For configurations, you can refer to the steps in this blog. Proofpoint – Outbound Handling and Integration Methods Outbound Logic Proofpoint analyzes outbound emails to detect and prevent data loss (DLP), to identify advanced threats (malware, phishing, BEC) originating from compromised internal accounts, and to ensure compliance. Their API integration provides crucial visibility and powerful remediation capabilities, while their traditional gateway (MX record) deployment delivers true inline, pre-delivery blocking for outbound traffic. Integration methods 1. API Integration: No MX record changes are required for this deployment method. Integration is done with Microsoft 365 or Google Workspace. How it works: Through its API integration, Proofpoint gains deep visibility into outbound emails and provides layered security and response features, including: Detect and alert: Identifies sensitive content (Data Loss Prevention violations), malicious attachments, or suspicious links in outbound emails. Post-delivery remediation (TRAP): A key capability of the API model is Threat Response Auto-Pull (TRAP), which enables Proofpoint to automatically recall, quarantine, or delete emails after delivery. This is particularly useful for internally sent messages or those forwarded to other users. Enhanced visibility: Aggregates message metadata and logs into Proofpoint’s threat intelligence platform, giving security teams a centralized view of outbound risks and user behavior. Protection level: API-based integration provides strong post-delivery detection and response, as well as visibility into DLP incidents and suspicious behavior.  SPF/DKIM/DMARC impact: Proofpoint does not alter SPF, DKIM, or DMARC because emails are sent directly through Microsoft or Google servers. Since Proofpoint’s servers are not involved in the actual sending process, the original authentication headers remain intact. 2. Gateway Integration (MX Record/Smart Host): This method requires updating MX records or routing outbound mail through Proofpoint via a smart host. How it works: Proofpoint acts as an inline gateway, inspecting emails before delivery. Inbound mail is filtered via MX changes; outbound mail is relayed through Proofpoint’s servers. Threat and DLP filtering: Scans outbound messages for sensitive content, malware, and policy violations. Real-time enforcement: Blocks, encrypts, or quarantines emails before they’re delivered. Policy controls: Applies rules based on content, recipient, or behavior. Protection level: Provides strong, real-time protection for outbound traffic with pre-delivery enforcement, DLP, and encryption. SPF/DKIM/DMARC impact: Proofpoint becomes the sending server: SPF: You need to configure ProofPoint’s SPF. DKIM: Can sign messages; requires DKIM setup. DMARC: DMARC passes if SPF and DKIM are set up properly. Please refer to this article to configure SPF and DKIM for ProofPoint. Mimecast – Outbound Handling and Integration Methods Outbound Logic Mimecast inspects outbound emails to prevent data loss (DLP), detect internal threats such as malware and impersonation, and ensure regulatory compliance. It primarily functions as a Secure Email Gateway (SEG), meaning it sits directly in the outbound email flow. While Mimecast offers APIs, its core outbound protection is built around this inline gateway model. Integration Methods 1. Gateway Integration (MX Record change required) This is Mimecast’s primary method for outbound email protection. Organizations route their outbound traffic through Mimecast by configuring their email server (e.g., Microsoft 365, Google Workspace, etc.) to use Mimecast as a smart host. This enables Mimecast to inspect and enforce policies on all outgoing emails in real time. How it works: Updating outbound routing in your email system (smart host settings), or Using Mimecast SMTP relay to direct messages through their infrastructure. Mimecast then scans, filters, and applies policies before the email reaches the final recipient. Protection level: Advanced DLP: Identifies and prevents sensitive data leaks. Impersonation and Threat Protection: Blocks malware, phishing, and abuse from compromised internal accounts. Email Encryption and Secure Messaging: Applies encryption policies or routes messages via secure portals. Regulatory Compliance: Enforces outbound compliance rules based on content, recipient, or metadata. SPF/DKIM/DMARC impact: SPF: Your SPF record must include Mimecast’s SPF mechanism based on your region to avoid SPF failures. DKIM: A new DKIM record should be configured to make sure your emails are DKIM signed when routing through Mimecast. DMARC: With correct SPF and DKIM setup, Mimecast ensures DMARC alignment, maintaining your domain’s sending reputation. Please refer to the steps in this detailed article to set up SPF and DKIM for Mimecast. 2. API Integration (Complementary to Gateway) Mimecast’s APIs complement the main gateway by providing automation, reporting, and management tools rather than handling live outbound mail flow. They allow you to manage policies, export logs, search archived emails, and sync users. APIs enhance visibility and operational tasks but do not provide real-time filtering or blocking of outbound messages. Since APIs don’t process live mail, they have no direct effect on SPF, DKIM, or DMARC; those depend on your gateway (smart host) setup. Barracuda – Outbound Handling and Integration Methods Outbound Logic Barracuda analyzes outbound emails to prevent data loss (DLP), block malware, stop phishing/impersonation attempts from compromised internal accounts, and ensure compliance. Barracuda offers flexible deployment options, including both traditional gateway (MX record) and API-based integrations. While both contribute to outbound security, their roles are distinct. Integration Methods 1. Gateway Integration (MX Record / Smart Host) — Primary Inline Security How it works: All outbound emails pass through Barracuda’s security stack for real-time inspection, threat blocking, and policy enforcement before delivery. Protection level: Comprehensive DLP (blocking, encrypting, or quarantining sensitive content)  Outbound spam and virus filtering  Enforcement of compliance and content policies This approach offers a high level of control and immediate threat mitigation on outbound mail flow. SPF/DKIM/DMARC impact: SPF: Update SPF records to include Barracuda’s sending IPs or SPF include mechanism. DKIM: Currently, no explicit setup is needed; DKIM of the main sending source is preserved. Refer to this article for more comprehensive guidance on Barracuda SEG configuration. 2. API Integration (Complementary & Advanced Threat Focus) How it works: The API accesses cloud email environments to analyze historical and real-time data, learning normal communication patterns to detect anomalies in outbound emails. It also supports post-delivery remediation, enabling the removal of malicious emails from internal mailboxes after sending. Protection level: Advanced AI-driven detection and near real-time blocking of outbound threats, plus strong post-delivery cleanup capabilities. SPF/DKIM/DMARC impact: Since mail is sent directly by the original mail server (e.g., Microsoft 365), SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. Cisco Secure Email (formerly IronPort) – Outbound Handling and Integration Methods Outbound Logic Cisco Secure Email protects outbound email by preventing data loss (DLP), blocking spam and malware from internal accounts, stopping business email compromise (BEC) and impersonation attacks, and ensuring compliance. Cisco provides both traditional gateway appliances/cloud gateways and modern API-based solutions for layered outbound security. Integration Methods 1. Gateway Integration (MX Record / Smart Host) – Cisco Secure Email Gateway (ESA) How it works: Organizations update MX records to route mail through the Cisco Secure Email Gateway or configure their mail server (e.g., Microsoft 365, Exchange) to smart host outbound email via the gateway. All outbound mail is inspected and policies enforced before delivery. Protection level: Granular DLP (blocking, encrypting, quarantining sensitive content) Outbound spam and malware filtering to protect IP reputation Email encryption for sensitive outbound messages Comprehensive content and attachment policy enforcement SPF: Check this article for comprehensive guidance on Cisco SPF settings. DKIM: Refer to this article for detailed guidance on Cisco DKIM settings. 2. API Integration – Cisco Secure Email Threat Defense How it works: Integrates directly via API with Microsoft 365 (and potentially Google Workspace), continuously monitoring email metadata, content, and user behavior across inbound, outbound, and internal messages. Leverages Cisco’s threat intelligence and AI to detect anomalous outbound activity linked to BEC, account takeover, and phishing. Post-Delivery Remediation: Automates the removal or quarantine of malicious or policy-violating emails from mailboxes even after sending. Protection level: Advanced, AI-driven detection of sophisticated outbound threats with real-time monitoring and automated remediation. Complements gateway filtering by adding cloud-native visibility and swift post-send action. SPF/DKIM/DMARC impact: Since emails are sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. If you have any questions or need assistance, feel free to reach out to EasyDMARC technical support.

Two satellite heavyweights are about to form a European rival to Starlink. But they’ll face an uphill battle to compete with Elon Musk’s firm. Luxembourg-based SES’ proposed $3.1bn takeover of Intelsat is set to get the green light from EU officials, Reuters reports. A final verdict is expected by June 10.   SES first announced plans to acquire Luxembourgish-American rival Intelsat in April 2024, calling it a “transformational merger” that could reshape the satellite internet market. The merged company would have a fleet of more than 100 geostationary and 26 medium Earth orbit satellites. Intelsat would contribute 75 of those probes, which provide a range of services, including TV, radio, satellite internet, and secure communications for governments and militaries. A SES-Intelsat tie-up would create Europe’s second-largest satellite internet provider, after Franco-British firm Eutelsat. Smaller contenders include the UK’s Inmarsat and Spain’s Hisdesat.  Combined, Europe’s satellite firms could offer the continent much-sought alternatives to Musk’s Starlink or Amazon’s Project Kuiper, at a time when tech sovereignty is high on the political agenda.  European leaders are increasingly concerned about relying on Starlink. Their fears have been stoked by reports that US officials threatened to cut off the system in Ukraine if the country didn’t meet their demands on sharing its mineral wealth.   The situation raised doubts about the security implications of Ukraine — and broader Europe — relying on a single, privately owned network whose boss has direct ties to the Trump administration. Eustalstat, SES, Inmarsat, and Hisdesat reportedly entered talks with EU governments in March about providing back-up connectivity to Ukraine.  Despite the SES–Intelsat merger creating a more formidable European player, the new alliance will still face a daunting challenge against Starlink’s dominance.  Musk’s firm dwarfs its competitors in satellite numbers, with over 7,000 in low-Earth orbit (LEO). Its closest rival, Eutelsat, has around 600. Meanwhile, Amazon’s Project Kuiper is planning to deploy a constellation of 3,236 satellites.   Being part of SpaceX also affords Starlink direct access to satellite manufacturing and launch capacity. In contrast, SES and Intelsat depend on third-party launch providers and currently lack a proprietary low-Earth orbit network. While Intelsat has a $250mn agreement to access Eutelsat’s LEO capacity, this reliance on external constellations puts the merged entity at a disadvantage.  Even when combined with Europe’s other players — including Eutelsat, Inmarsat, and Hisdesat — the proposed merger pales in comparison. As European policymakers push for strategic autonomy in space, the SES–Intelsat merger may be a step in the right direction, but it’s still a far cry from a true Starlink rival.

Two satellite heavyweights are about to form a European rival to Starlink. But they’ll face an uphill battle to compete with Elon Musk’s firm. Luxembourg-based SES’ proposed $3.1bn takeover of Intelsat is set to get the green light from EU officials, Reuters reports. A final verdict is expected by June 10.   SES first announced plans to acquire Luxembourgish-American rival Intelsat in April 2024, calling it a “transformational merger” that could reshape the satellite internet market. The merged company would have a fleet of more than 100 geostationary and 26 medium Earth orbit satellites. Intelsat would contribute 75 of those probes, which provide a range of services, including TV, radio, satellite internet, and secure communications for governments and militaries. A SES-Intelsat tie-up would create Europe’s second-largest satellite internet provider, after Franco-British firm Eutelsat. Smaller contenders include the UK’s Inmarsat and Spain’s Hisdesat.  Combined, Europe’s satellite firms could offer the continent much-sought alternatives to Musk’s Starlink or Amazon’s Project Kuiper, at a time when tech sovereignty is high on the political agenda.  European leaders are increasingly concerned about relying on Starlink. Their fears have been stoked by reports that US officials threatened to cut off the system in Ukraine if the country didn’t meet their demands on sharing its mineral wealth.   The situation raised doubts about the security implications of Ukraine — and broader Europe — relying on a single, privately owned network whose boss has direct ties to the Trump administration. Eustalstat, SES, Inmarsat, and Hisdesat reportedly entered talks with EU governments in March about providing back-up connectivity to Ukraine.  Despite the SES–Intelsat merger creating a more formidable European player, the new alliance will still face a daunting challenge against Starlink’s dominance.  Musk’s firm dwarfs its competitors in satellite numbers, with over 7,000 in low-Earth orbit (LEO). Its closest rival, Eutelsat, has around 600. Meanwhile, Amazon’s Project Kuiper is planning to deploy a constellation of 3,236 satellites.   Being part of SpaceX also affords Starlink direct access to satellite manufacturing and launch capacity. In contrast, SES and Intelsat depend on third-party launch providers and currently lack a proprietary low-Earth orbit network. While Intelsat has a $250mn agreement to access Eutelsat’s LEO capacity, this reliance on external constellations puts the merged entity at a disadvantage.  Even when combined with Europe’s other players — including Eutelsat, Inmarsat, and Hisdesat — the proposed merger pales in comparison. As European policymakers push for strategic autonomy in space, the SES–Intelsat merger may be a step in the right direction, but it’s still a far cry from a true Starlink rival.

Text embedding and reranking are foundational to modern information retrieval systems, powering applications such as semantic search, recommendation systems, and retrieval-augmented generation (RAG). However, current approaches often face key challenges—particularly in achieving both high multilingual fidelity and task adaptability without relying on proprietary APIs. Existing models frequently fall short in scenarios requiring nuanced semantic understanding across multiple languages or domain-specific tasks like code retrieval and instruction following. Moreover, most open-source models either lack scale or flexibility, while commercial APIs remain costly and closed. Qwen3-Embedding and Qwen3-Reranker: A New Standard for Open-Source Embedding Alibaba’s Qwen Team has unveiled the Qwen3-Embedding and Qwen3-Reranker Series—models that set a new benchmark in multilingual text embedding and relevance ranking. Built on the Qwen3 foundation models, the series includes variants in 0.6B, 4B, and 8B parameter sizes and supports a wide range of languages (119 in total), making it one of the most versatile and performant open-source offerings to date. These models are now open-sourced under the Apache 2.0 license on Hugging Face, GitHub, and ModelScope, and are also accessible via Alibaba Cloud APIs. These models are optimized for use cases such as semantic retrieval, classification, RAG, sentiment analysis, and code search—providing a strong alternative to existing solutions like Gemini Embedding and OpenAI’s embedding APIs. Technical Architecture Qwen3-Embedding models adopt a dense transformer-based architecture with causal attention, producing embeddings by extracting the hidden state corresponding to the [EOS] token. Instruction-awareness is a key feature: input queries are formatted as {instruction} {query}<|endoftext|>, enabling task-conditioned embeddings. The reranker models are trained with a binary classification format, judging document-query relevance in an instruction-guided manner using a token likelihood-based scoring function. The models are trained using a robust multi-stage training pipeline: Large-scale weak supervision: 150M synthetic training pairs generated using Qwen3-32B, covering retrieval, classification, STS, and bitext mining across languages and tasks. Supervised fine-tuning: 12M high-quality data pairs are selected using cosine similarity (>0.7), fine-tuning performance in downstream applications. Model merging: Spherical linear interpolation (SLERP) of multiple fine-tuned checkpoints ensures robustness and generalization. This synthetic data generation pipeline enables control over data quality, language diversity, task difficulty, and more—resulting in a high degree of coverage and relevance in low-resource settings. Performance Benchmarks and Insights The Qwen3-Embedding and Qwen3-Reranker series demonstrate strong empirical performance across several multilingual benchmarks. On MMTEB (216 tasks across 250+ languages), Qwen3-Embedding-8B achieves a mean task score of 70.58, surpassing Gemini and GTE-Qwen2 series. On MTEB (English v2): Qwen3-Embedding-8B reaches 75.22, outperforming other open models including NV-Embed-v2 and GritLM-7B. On MTEB-Code: Qwen3-Embedding-8B leads with 80.68, excelling in applications like code retrieval and Stack Overflow QA. For reranking: Qwen3-Reranker-0.6B already outperforms Jina and BGE rerankers. Qwen3-Reranker-8B achieves 81.22 on MTEB-Code and 72.94 on MMTEB-R, marking state-of-the-art performance. Ablation studies confirm the necessity of each training stage. Removing synthetic pretraining or model merging led to significant performance drops (up to 6 points on MMTEB), emphasizing their contributions. Conclusion Alibaba’s Qwen3-Embedding and Qwen3-Reranker Series present a robust, open, and scalable solution to multilingual and instruction-aware semantic representation. With strong empirical results across MTEB, MMTEB, and MTEB-Code, these models bridge the gap between proprietary APIs and open-source accessibility. Their thoughtful training design—leveraging high-quality synthetic data, instruction-tuning, and model merging—positions them as ideal candidates for enterprise applications in search, retrieval, and RAG pipelines. By open-sourcing these models, the Qwen team not only pushes the boundaries of language understanding but also empowers the broader community to innovate on top of a solid foundation. Check out the Paper, Technical details, Qwen3-Embedding and Qwen3-Reranker. All credit for this research goes to the researchers of this project. Also, feel free to follow us on Twitter and don’t forget to join our 95k+ ML SubReddit and Subscribe to our Newsletter. Asif RazzaqWebsite |  + postsBioAsif Razzaq is the CEO of Marktechpost Media Inc.. As a visionary entrepreneur and engineer, Asif is committed to harnessing the potential of Artificial Intelligence for social good. His most recent endeavor is the launch of an Artificial Intelligence Media Platform, Marktechpost, which stands out for its in-depth coverage of machine learning and deep learning news that is both technically sound and easily understandable by a wide audience. The platform boasts of over 2 million monthly views, illustrating its popularity among audiences.Asif Razzaqhttps://www.marktechpost.com/author/6flvq/A Step-by-Step Coding Guide to Building an Iterative AI Workflow Agent Using LangGraph and GeminiAsif Razzaqhttps://www.marktechpost.com/author/6flvq/From Clicking to Reasoning: WebChoreArena Benchmark Challenges Agents with Memory-Heavy and Multi-Page TasksAsif Razzaqhttps://www.marktechpost.com/author/6flvq/Mistral AI Introduces Mistral Code: A Customizable AI Coding Assistant for Enterprise WorkflowsAsif Razzaqhttps://www.marktechpost.com/author/6flvq/NVIDIA AI Releases Llama Nemotron Nano VL: A Compact Vision-Language Model Optimized for Document Understanding

As a Canadian who has spent the last two and a half years working as an intern architect in Helsinki, these questions have been on my mind. In my current role, I have had the opportunity to participate in numerous architectural competitions arranged by Finnish municipalities and public institutions. It has been my observation that the Finnish system of open, anonymous architectural competitions consistently produces elegant and highly functional public buildings at reasonable cost and at great benefit to the lives of the everyday people for whom the projects are intended to serve. Could Canada benefit from the adoption of a similar model? ‘Public project’ has never been a clearly defined term and may bring to mind the image of a bustling library for some while conjuring the image of a municipal power substation for others. In the context of this discussion, I will use the term to refer to projects that are explicitly in-service of the broader public such as community centres, museums, and other cultural venues. Finland’s architectural competition system Frequented by nearly 2 million visitors per year, the Oodi Central Library in Helsinki, Finland, has become a thriving cultural hub and an internationally recognized symbol of Finnish design innovation. Designed by ALA Architects, the project was procured through a 2-stage, open, international architectural competition. Photo by Ninara (flickr, CC BY 2.0) In Finland, most notable public projects begin with an architectural competition. Some are limited to invited participants only, but the majority of these competitions are open to international submissions. Importantly, the authors of any given proposal remain anonymous with regards to the jury. This ensures that all proposals are evaluated purely on quality without bias towards established firms over lesser known competitors. The project budget is known in advance to the competition entrants and cost feasibility is an important factor weighed by the jury. However, the cost for the design services to be procured from the winning entry is fixed ahead of time, preventing companies from lowballing offers in the hopes of securing an interesting commission despite the inevitable compromises in quality that come with under-resourced design work. The result: inspired, functional public spaces are the norm, not the exception. Contrasted against the sea of forgettable public architecture to be found in cities large and small across Canada, the Finnish model paints a utopic picture. Several award-winning projects in my current place of employment in Helsinki have been the result of successes in open architectural competitions. The origin of the firm itself stemmed from a winning competition entry for a church in a small village submitted by the firm’s founder while he was still completing his architectural studies.  At that time, many architecture firms in Finland were founded in this manner with the publicity of a competition win serving as a career launching off point for young architects. While less common today, many students and recent graduates still participate in these design competitions. On the occasion that a young practitioner wins a competition, they are required to assemble a team with the necessary expertise and qualifications to satisfy the requirements of the jury. I believe there is a direct link between the high architectural quality outcomes of these competitions and the fact that they are conducted anonymously. The opening of these competitions to submissions from companies outside of Finland further enhances the diversity of entries and fosters international interest in the goings-on of Finland’s architectural scene. Nonetheless, it is worth acknowledging that exemplary projects have also resulted from invited and privately organized competitions. Ultimately, the mindset of the client, the selection of an appropriate jury, and the existence of sufficient incentives for architects to invest significant time in their proposals play a more critical role in shaping the quality of the final outcome. Tikkurila Church and Housing in Vantaa, Finland, hosts a diverse range of functions including a café, community event spaces and student housing. Designed by OOPEAA in collaboration with a local builder, the project was realized as the result of a competition organized by local Finnish and Swedish parishes. Photo by Marc Goodwin Finland’s competition system, administered by the Finnish Association of Architects (SAFA), is not limited to major public projects such as museums, libraries and city halls. A significant number of idea competitions are organized seeking compelling visions for urban masterplans. The quality of this system has received international recognition. To quote a research paper from a Swedish university on the structure, criteria and judgement process of Finnish architectural competitions, “The Finnish (competition) experience can provide a rich information source for scholars and students studying the structure and process of competition system and architectural judgement, as well as those concerned with commissioning and financing of competitions due to innovative solutions found in the realms of urban revitalization, poverty elimination, environmental pollution, cultural and socio-spatial renewals, and democratization of design and planning process.” This has not gone entirely under the radar in Canada. According to the website of the Royal Architectural Institute of Canada (RAIC), “Competitions are common in countries such as Finland, Ireland, the United Kingdom, Australia, and New Zealand. These competitions have resulted in a high quality of design as well as creating public interest in the role of architecture in national and community life.” Canada’s architectural competition system In Canada, the RAIC sets general competition guidelines while provincial and territorial architect associations are typically responsible for the oversight of any endorsed architectural competition. Although the idea of implementing European architectural competition models has been gaining traction in recent years, competitions remain relatively rare even for significant public projects. While Canada is yet to fully embrace competition systems as a powerful tool for ensuring higher quality public spaces, success stories from various corners of the country have opened up constructive conversations. In Edmonton, unconventional, competitive procurement efforts spearheaded by city architect Carol Belanger have produced some remarkable public buildings. This has not gone unnoticed in other parts of the country where consistent banality is the norm for public projects. Jasper Place Branch Library designed by HCMA and Dub Architects is one of several striking projects in Edmonton built under reimagined commissioning processes which broaden the pool of design practices eligible to participate and give greater weight to design quality as an evaluation criterion. Photo by Hubert Kang The wider applicability of competition systems as a positive mechanism for securing better public architecture has also started to receive broader discussion. In my hometown of Ottawa, this system has been used to procure several powerful monuments and, more recently, to select a design for the redevelopment of a key city block across from Parliament Hill. The volume and quality of entries, including from internationally renowned architectural practices, attests to the strengths of the open competition format. Render of the winning entry for the Block 2 Redevelopment in Ottawa. This 2-stage competition was overseen directly by the RAIC. Design and render by Zeidler Architecture Inc. in cooperation with David Chipperfield Architects. Despite these successes, there is significant room for improvement. A key barrier to wider adoption of competition practices according to the RAIC is “…that potential sponsors are not familiar with competitions or may consider the competition process to be complicated, expensive, and time consuming.” This is understandable for private actors, but an unsatisfactory answer in the case of public, tax-payer funded projects. Finland’s success has come through the normalization of competitions for public project procurement. We should endeavour to do the same. Maintaining design contribution anonymity prior to jury decision has thus far been the exception, not the norm in Canada. This reduces the credibility of the jury without improving the result. Additionally, the financing of such competitions has been piece-meal and inconsistent. For example, several world-class schools have been realized in Quebec as the result of competitions funded by a provincial investment.  With the depletion of that fund, it is no longer clear if any further schools will be commissioned in Quebec under a similar model. While high quality documentation has been produced, there is a risk that developed expertise will be lost if the team of professionals responsible for overseeing the process is not retained. École du Zénith in Shefford, Quebec, designed by Pelletier de Fontenay + Leclerc Architectes is one of six elegant and functional schools commission by the province through an anonymous competition process. Photo by James Brittain A path forward Now more than ever, it is essential that our public projects instill in us a sense of pride and reflect our uniquely Canadian values. This will continue to be a rare occurrence until more ambitious measures are taken to ensure the consistent realization of beautiful, innovative and functional public spaces that connect us with one another. In service of this objective, Canada should incentivize architectural competitions by normalizing their use for major public projects such as national museums, libraries and cultural centres. A dedicated Competitions Fund could be established to support provinces, territories and cities who demonstrate initiative in the pursuit of more ambitious, inspiring and equitable public projects. A National Competitions Expert could be appointed to ensure retention and dissemination of expertise. Maintaining the anonymity of competition entrants should be established as the norm. At a moment when talk of removing inter-provincial trade barriers has re-entered public discourse, why not consider striking down red tape that prevents out-of-province firms from participating in architectural competitions? Alas, one can dream. Competitions are no silver bullet. However, recent trials within our borders should give us confidence that architectural competitions are a relatively low-risk, high-reward proposition. To this end, Finland’s open, anonymous competition system offers a compelling case study from which we would be well served to take inspiration. Isaac Edmonds is a Canadian working for OOPEAA – Office for Peripheral Architecture in Helsinki, Finland. My observations of the Finnish competition system’s ability to consistently produce functional, beautiful buildings inform my interest in procurement methods that elevate the quality of our shared public realm. The post Op-Ed: Could Canada benefit from adopting Finland’s architectural competition system? appeared first on Canadian Architect.

While Donald Trump's wide-ranging taxes on imports face scrutiny in court, rates on steel and aluminum have been doubled. Here's what it'll all mean for you.

We are facing a cultural shift within a category still buzzing with untapped potential. To get a real pulse on what's next, it's not enough to track product launches; it's imagining what the NA space could become in the next 10 years.  The post How P

In January, Google made Gemini — previously an add-on — a standard feature for business users in Google Workspace. That move made a point: generative AI (genAI) isn’t an add-on, it’s a fundamental capability that should fit nat

Pentagram's latest project introduces a striking new identity for TwelveLabs, an AI company redefining how machines comprehend video. At its heart, the rebrand marks a conceptual shift, positioning video not as a linear sequence of frames but as a volume. For TwelveLabs, this reframing is more than a technological advancement, as it's setting them apart in the fast-moving AI landscape. For Jody Hudson-Powell and the Pentagram team, it became the foundation for the entire creative direction. "The 'video as volume' idea became our way of visualising their technology," Jody explains. "Traditionally, AI sees video as separate frames – individual moments, isolated. But TwelveLabs understands everything at once, an interconnected whole. This shift in perspective became the core idea guiding all our design choices." Turning such an abstract and dynamic concept into a tangible brand identity was no small feat. In a sector often awash with dense data visualisations and corporate clichés, Pentagram's work for TwelveLabs stands out for its clarity and restraint. Described by the team as "smart, elegant, alive", the identity not only enhances the product's appearance but also helps explain it. "Abstract concepts can easily get complicated, but by staying closely focused on 'video as volume,' every decision felt purposeful and naturally clear," says Jody. A key part of this clarity is the system's use of diagrams and modular layouts. These elements do the heavy lifting when it comes to representing TwelveLabs' complex technology in a way that's accessible to a wide range of audiences, from engineers and developers to enterprise clients and creatives. "Complexity becomes understandable when you strip things back to what's truly important," Jody says. "We spent time refining the diagrams to say just enough – clear for everyone but authentic to those who really know the tech. When engineers see their work clearly represented, and others intuitively understand it, you've found some interesting ground." What's striking is how the identity balances the technical with the emotive. It's a visual language that feels structured but not cold, intelligent but not aloof. According to Jody, this tension was carefully calibrated. "Technology can feel distant, cold, but it's built around human experiences: images, memories, moments," he explains. "Our system provided clarity and structure, creating natural space for these human elements to emerge, balancing intelligence and warmth." Motion, too, plays a critical role in bringing the brand to life. Given that TwelveLabs' platform revolves around continuous, connected reasoning, it made sense for motion to echo that logic, being subtle but purposeful. "Motion always means something, even subtly," says Jody. "Every bit of movement mirrored the continuous reasoning of the platform. Allowing room for gentle expressiveness and even playfulness didn't take away from clarity – it enhanced it." One of the most distinctive elements of the new identity is the horse symbol. On the surface, it's a nod to Eadweard Muybridge's pioneering photographic studies of motion and an iconic reference for any visual technology. But there's a deeper connection, as TwelveLabs already named its AI models after horses. The Pentagram team simply brought that story to the forefront. "Often, the best ideas are already there, just waiting to be noticed," says Jody. "We simply amplified that story, connecting it back to Muybridge's historical images, allowing it to clearly communicate motion and intelligence in a fresh yet familiar way." Throughout the project, the team had to consider the diversity of TwelveLabs' audience, from developers and researchers to large-scale enterprise clients and the broader creative community. The result is an identity system that feels accessible without being simplistic and capable of meeting users at every level of expertise. "We aimed for a universal tone – clear, direct, and welcoming for everyone, regardless of their expertise," Jody says. "Precision doesn't have to be complicated, and clarity invites everyone in. Finding a voice that felt calm, clear, and honest meant meeting each person exactly where they are." The outcome is an identity that doesn't just repackage complex AI technology. It embodies the very qualities that make TwelveLabs' approach revolutionary: interconnected, intelligent, and distinctly human.

European tech leaders are pushing back against high-profile VCs urging founders to work seven days a week — slamming the grindset mentality as everything from “toxic” to “childish.”  “Calling on founders to work insane hours nonstop is just bad advice,” Suranga Chandratillake, general partner at Balderton Capital and former CEO of video search engine Blinkx, told TNW. “Even sprinters don’t sprint all the time — rest and reflection is just as important as putting in the work.” His comments follow a LinkedIn post on Saturday by Harry Stebbings, podcast host and 28-year-old founder of London-based venture firm 20VC. “What European founders need to realise [is that] 7 days a week is the required velocity to win right now,” he wrote, implying that they need to match the infamous grind culture of Silicon Valley.       Martin Mignot, a partner at New York-based Index Ventures, rallied behind Stebbings. In a LinkedIn post of his own, he applauded the 9am-9pm, six days a week (illegal) work culture adopted by some tech firms in China. “Forget 9 to 5, 996 is the new startup standard,” he said.  The 💜 of EU techThe latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!While some echoed their views, many European tech founders and investors weren’t happy with the rhetoric. Amelia Miller, co-founder of return-to-work platform Ivee, called Stebbings’ post “unbelievably toxic.” “Only bad founders work 7 days non-stop,” she wrote. “It’s poor time management and a fast track to burnout.” Miller also said she thinks that working such long hours unfairly discriminates against parents and those with responsibilities outside the office.   Chandratillake also warned against taking advice from VCs without experience of starting and running a company. “If you’re a CEO, don’t listen to a jumped-up finance bro in a hoodie who has never done your job telling you how to do it!” he said.  The lively debate comes amid a broader conversation in European tech over whether workplace culture is holding the region back compared to the US or China.  In a podcast interview in March, Revolut boss Nik Storonsky criticised European startup entrepreneurs, saying they weren’t working hard enough and valued work-life balance too highly. Those comments followed another lively social media debate earlier this year about whether French founders lacked the “grindset” to succeed.   However, a recent survey of 128 European founders by early-stage VC firm Antler found that three-quarters of them work more than 60 hours weekly. Almost 20% of them exceeded 80 hours, challenging the notion that European founders don’t hustle.  Chandratillake said he believes that scrutinising work hours overlooks some of the real challenges founders face in Europe, such as access to late-stage financing. That said, the investor thinks there is a time and a place for the grind. “Sometimes founders have to work extremely hard and long hours, but that’s not sustainable all the time,” he said. “Building a successful company is a marathon, it takes endurance.”  European startup founders are the lifeblood of TNW Conference — and we want you there too. The tech festival takes place on June 19-20 in Amsterdam. Use the code TNWXMEDIA2025 at the ticket checkout to get 30% off. Story by Siôn Geschwindt Siôn is a freelance science and technology reporter, specialising in climate and energy. From nuclear fusion breakthroughs to electric vehic (show all) Siôn is a freelance science and technology reporter, specialising in climate and energy. From nuclear fusion breakthroughs to electric vehicles, he's happiest sourcing a scoop, investigating the impact of emerging technologies, and even putting them to the test. He has five years of journalism experience and holds a dual degree in media and environmental science from the University of Cape Town, South Africa. When he's not writing, you can probably find Siôn out hiking, surfing, playing the drums or catering to his moderate caffeine addiction. You can contact him at: sion.geschwindt [at] protonmail [dot] com Get the TNW newsletter Get the most important tech news in your inbox each week. Also tagged with