Dead smartphones aren’t so smart. If you travel, stay away from home for extended periods of time or simply forget to charge your phone occasionally, it might be wise to keep a portable charger in your bag. Over the past few years, I’ve tested over f

Email authentication protocols like SPF, DKIM, and DMARC play a critical role in protecting domains from spoofing and phishing. However, when SEGs are introduced into the email path, the interaction with these protocols becomes more complex. Security gateways(SEGs) are a core part of many organizations’ email infrastructure. They act as intermediaries between the public internet and internal mail systems, inspecting, filtering, and routing messages. This blog examines how security gateways handle SPF, DKIM, and DMARC, with real-world examples from popular gateways such as Proofpoint, Mimecast, and Avanan. We’ll also cover best practices for maintaining authentication integrity and avoiding misconfigurations that can compromise email authentication or lead to false DMARC failures. Security gateways often sit at the boundary between your organization and the internet, managing both inbound and outbound email traffic. Their role affects how email authentication protocols behave. An inbound SEG examines emails coming into your organization. It checks SPF, DKIM, and DMARC to determine if the message is authentic and safe before passing it to your internal mail servers. An outbound SEG handles emails sent from your domain. It may modify headers, rewrite envelope addresses, or even apply DKIM signing. All of these can impact SPF,  DKIM, or DMARC validation on the recipient’s side. Understanding how SEGs influence these flows is crucial to maintaining proper authentication and avoiding unexpected DMARC failures. Inbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When an email comes into your organization, your security gateway is the first to inspect it. It checks whether the message is real, trustworthy, and properly authenticated. Let’s look at how different SEGs handle these checks. Avanan (by Check Point) SPF: Avanan verifies whether the sending server is authorized to send emails for the domain by checking the SPF record. DKIM: It verifies if the message was signed by the sending domain and if that signature is valid. DMARC: It uses the results of the SPF and DKIM check to evaluate DMARC. However, final enforcement usually depends on how DMARC is handled by Microsoft 365 or Gmail, as Avanan integrates directly with them. Avanan offers two methods of integration:1. API integration: Avanan connects via APIs, no change in MX, usually Monitor or Detect modes.2. Inline integration: Avanan is placed inline in the mail flow (MX records changed), actively blocking or remediating threats. Proofpoint Email Protection SPF: Proofpoint checks SPF to confirm the sender’s IP is authorized to send on behalf of the domain. You can set custom rules (e.g. treat “softfail” as “fail”). DKIM: It verifies DKIM signatures and shows clear pass/fail results in logs. DMARC: It fully evaluates DMARC by combining SPF and DKIM results with alignment checks. Administrators can configure how to handle messages that fail DMARC, such as rejecting, quarantining, or delivering them. Additionally, Proofpoint allows whitelisting specific senders you trust, even if their emails fail authentication checks. Integration Methods Inline Mode: In this traditional deployment, Proofpoint is positioned directly in the email flow by modifying MX records. Emails are routed through Proofpoint’s infrastructure, allowing it to inspect and filter messages before they reach the recipient’s inbox. This mode provides pre-delivery protection and is commonly used in on-premises or hybrid environments. API-Based (Integrated Cloud Email Security – ICES) Mode: Proofpoint offers API-based integration, particularly with cloud email platforms like Microsoft 365 and Google Workspace. In this mode, Proofpoint connects to the email platform via APIs, enabling it to monitor and remediate threats post-delivery without altering the email flow. This approach allows for rapid deployment and seamless integration with existing cloud email services. Mimecast SPF: Mimecast performs SPF checks to verify whether the sending server is authorized by the domain’s SPF record. Administrators can configure actions for SPF failures, including block, quarantine, permit, or tag with a warning. This gives flexibility in balancing security with business needs. DKIM: It validates DKIM signatures by checking that the message was correctly signed by the sending domain and that the content hasn’t been tampered with. If the signature fails, Mimecast can take actions based on your configured policies. DMARC: It fully evaluates DMARC by combining the results of SPF and DKIM with domain alignment checks. You can choose to honor the sending domain’s DMARC policy (none, quarantine, reject) or apply custom rules, for example, quarantining or tagging messages that fail DMARC regardless of the published policy. This allows more granular control for businesses that want to override external domain policies based on specific contexts. Integration Methods Inline Deployment: Mimecast is typically deployed as a cloud-based secure email gateway. Organizations update their domain’s MX records to point to Mimecast, so all inbound (and optionally outbound) emails pass through it first. This allows Mimecast to inspect, filter, and process emails before delivery, providing robust protection. API Integrations: Mimecast also offers API-based services through its Mimecast API platform, primarily for management, archival, continuity, and threat intelligence purposes. However, API-only email protection is not Mimecast’s core model. Instead, the APIs are used to enhance the inline deployment, not replace it. Barracuda Email Security Gateway SPF: Barracuda checks the sender’s IP against the domain’s published SPF record. If the check fails, you can configure the system to block, quarantine, tag, or allow the message, depending on your policy preferences. DKIM: It validates whether the incoming message includes a valid DKIM signature. The outcome is logged and used to inform further policy decisions or DMARC evaluations. DMARC: It combines SPF and DKIM results, checks for domain alignment, and applies the DMARC policy defined by the sender. Administrators can also choose to override the DMARC policy, allowing messages to pass or be treated differently based on organizational needs (e.g., trusted senders or internal exceptions). Integration Methods Inline mode (more common and straightforward): Barracuda Email Security Gateway is commonly deployed inline by updating your domain’s MX records to point to Barracuda’s cloud or on-premises gateway. This ensures that all inbound emails pass through Barracuda first for filtering and SPF, DKIM, and DMARC validation before being delivered to your mail servers. Deployment Behind the Corporate Firewall: Alternatively, Barracuda can be deployed in transparent or bridge mode without modifying MX records. In this setup, the gateway is placed inline at the network level, such as behind a firewall, and intercepts mail traffic transparently. This method is typically used in complex on-premises environments where changing DNS records is not feasible. Cisco Secure Email (formerly IronPort) Cisco Secure Email acts as an inline gateway for inbound email, usually requiring your domain’s MX records to point to the Cisco Email Security Appliance or cloud service. SPF: Cisco Secure Email verifies whether the sending server is authorized in the sender domain’s SPF record. Administrators can set detailed policies on how to handle SPF failures. DKIM: It validates the DKIM signature on incoming emails and logs whether the signature is valid or has failed. DMARC: It evaluates DMARC by combining SPF and DKIM results along with domain alignment checks. Admins can configure specific actions, such as quarantine, reject, or tag, based on different failure scenarios or trusted sender exceptions. Integration methods On-premises Email Security Appliance (ESA): You deploy Cisco’s hardware or virtual appliance inline, updating MX records to route mail through it for filtering. Cisco Cloud Email Security: Cisco offers a cloud-based email security service where MX records are pointed to Cisco’s cloud infrastructure, which filters and processes inbound mail. Cisco Secure Email also offers advanced, rule-based filtering capabilities and integrates with Cisco’s broader threat protection ecosystem, enabling comprehensive inbound email security. Outbound Handling of SPF, DKIM, and DMARC by Common Security Gateways When your organization sends emails, security gateways can play an active role in processing and authenticating those messages. Depending on the configuration, a gateway might rewrite headers, re-sign messages, or route them through different IPs – all actions that can help or hurt the authentication process. Let’s look at how major SEGs handle outbound email flow. Avanan – Outbound Handling and Integration Methods Outbound Logic Avanan analyzes outbound emails primarily to detect data loss, malware, and policy violations. In API-based integration, emails are sent directly by the original mail server (e.g., Microsoft 365 or Google Workspace), so SPF and DKIM signatures remain intact. Avanan does not alter the message or reroute traffic, which helps maintain full DMARC alignment and domain reputation. Integration Methods 1. API Integration: Connects to Microsoft 365 or Google Workspace via API. No MX changes are needed. Emails are scanned after they are sent, with no modification to SPF, DKIM, or the delivery path.  How it works: Microsoft Graph API or Google Workspace APIs are used to monitor and intervene in outbound emails. Protection level: Despite no MX changes, it can offer inline-like protection, meaning it can block, quarantine, or encrypt emails before they are delivered externally. SPF/DKIM/DMARC impact: Preserves original headers and signatures since mail is sent directly from Microsoft/Google servers. 2. Inline Integration: Requires changing MX records to route email through Avanan. In this mode, Avanan can intercept and inspect outbound emails before delivery. Depending on the configuration, this may affect SPF or DKIM if not properly handled. How it works: Requires adding Avanan’s Protection level: Traditional inline security with full visibility and control, including encryption, DLP, policy enforcement, and advanced threat protection. SPF/DKIM/DMARC impact: SPF configuration is needed by adding Avanan’s include mechanism to the sending domain’s SPF record. The DKIM record of the original sending source is preserved. For configurations, you can refer to the steps in this blog. Proofpoint – Outbound Handling and Integration Methods Outbound Logic Proofpoint analyzes outbound emails to detect and prevent data loss (DLP), to identify advanced threats (malware, phishing, BEC) originating from compromised internal accounts, and to ensure compliance. Their API integration provides crucial visibility and powerful remediation capabilities, while their traditional gateway (MX record) deployment delivers true inline, pre-delivery blocking for outbound traffic. Integration methods 1. API Integration: No MX record changes are required for this deployment method. Integration is done with Microsoft 365 or Google Workspace. How it works: Through its API integration, Proofpoint gains deep visibility into outbound emails and provides layered security and response features, including: Detect and alert: Identifies sensitive content (Data Loss Prevention violations), malicious attachments, or suspicious links in outbound emails. Post-delivery remediation (TRAP): A key capability of the API model is Threat Response Auto-Pull (TRAP), which enables Proofpoint to automatically recall, quarantine, or delete emails after delivery. This is particularly useful for internally sent messages or those forwarded to other users. Enhanced visibility: Aggregates message metadata and logs into Proofpoint’s threat intelligence platform, giving security teams a centralized view of outbound risks and user behavior. Protection level: API-based integration provides strong post-delivery detection and response, as well as visibility into DLP incidents and suspicious behavior.  SPF/DKIM/DMARC impact: Proofpoint does not alter SPF, DKIM, or DMARC because emails are sent directly through Microsoft or Google servers. Since Proofpoint’s servers are not involved in the actual sending process, the original authentication headers remain intact. 2. Gateway Integration (MX Record/Smart Host): This method requires updating MX records or routing outbound mail through Proofpoint via a smart host. How it works: Proofpoint acts as an inline gateway, inspecting emails before delivery. Inbound mail is filtered via MX changes; outbound mail is relayed through Proofpoint’s servers. Threat and DLP filtering: Scans outbound messages for sensitive content, malware, and policy violations. Real-time enforcement: Blocks, encrypts, or quarantines emails before they’re delivered. Policy controls: Applies rules based on content, recipient, or behavior. Protection level: Provides strong, real-time protection for outbound traffic with pre-delivery enforcement, DLP, and encryption. SPF/DKIM/DMARC impact: Proofpoint becomes the sending server: SPF: You need to configure ProofPoint’s SPF. DKIM: Can sign messages; requires DKIM setup. DMARC: DMARC passes if SPF and DKIM are set up properly. Please refer to this article to configure SPF and DKIM for ProofPoint. Mimecast – Outbound Handling and Integration Methods Outbound Logic Mimecast inspects outbound emails to prevent data loss (DLP), detect internal threats such as malware and impersonation, and ensure regulatory compliance. It primarily functions as a Secure Email Gateway (SEG), meaning it sits directly in the outbound email flow. While Mimecast offers APIs, its core outbound protection is built around this inline gateway model. Integration Methods 1. Gateway Integration (MX Record change required) This is Mimecast’s primary method for outbound email protection. Organizations route their outbound traffic through Mimecast by configuring their email server (e.g., Microsoft 365, Google Workspace, etc.) to use Mimecast as a smart host. This enables Mimecast to inspect and enforce policies on all outgoing emails in real time. How it works: Updating outbound routing in your email system (smart host settings), or Using Mimecast SMTP relay to direct messages through their infrastructure. Mimecast then scans, filters, and applies policies before the email reaches the final recipient. Protection level: Advanced DLP: Identifies and prevents sensitive data leaks. Impersonation and Threat Protection: Blocks malware, phishing, and abuse from compromised internal accounts. Email Encryption and Secure Messaging: Applies encryption policies or routes messages via secure portals. Regulatory Compliance: Enforces outbound compliance rules based on content, recipient, or metadata. SPF/DKIM/DMARC impact: SPF: Your SPF record must include Mimecast’s SPF mechanism based on your region to avoid SPF failures. DKIM: A new DKIM record should be configured to make sure your emails are DKIM signed when routing through Mimecast. DMARC: With correct SPF and DKIM setup, Mimecast ensures DMARC alignment, maintaining your domain’s sending reputation. Please refer to the steps in this detailed article to set up SPF and DKIM for Mimecast. 2. API Integration (Complementary to Gateway) Mimecast’s APIs complement the main gateway by providing automation, reporting, and management tools rather than handling live outbound mail flow. They allow you to manage policies, export logs, search archived emails, and sync users. APIs enhance visibility and operational tasks but do not provide real-time filtering or blocking of outbound messages. Since APIs don’t process live mail, they have no direct effect on SPF, DKIM, or DMARC; those depend on your gateway (smart host) setup. Barracuda – Outbound Handling and Integration Methods Outbound Logic Barracuda analyzes outbound emails to prevent data loss (DLP), block malware, stop phishing/impersonation attempts from compromised internal accounts, and ensure compliance. Barracuda offers flexible deployment options, including both traditional gateway (MX record) and API-based integrations. While both contribute to outbound security, their roles are distinct. Integration Methods 1. Gateway Integration (MX Record / Smart Host) — Primary Inline Security How it works: All outbound emails pass through Barracuda’s security stack for real-time inspection, threat blocking, and policy enforcement before delivery. Protection level: Comprehensive DLP (blocking, encrypting, or quarantining sensitive content)  Outbound spam and virus filtering  Enforcement of compliance and content policies This approach offers a high level of control and immediate threat mitigation on outbound mail flow. SPF/DKIM/DMARC impact: SPF: Update SPF records to include Barracuda’s sending IPs or SPF include mechanism. DKIM: Currently, no explicit setup is needed; DKIM of the main sending source is preserved. Refer to this article for more comprehensive guidance on Barracuda SEG configuration. 2. API Integration (Complementary & Advanced Threat Focus) How it works: The API accesses cloud email environments to analyze historical and real-time data, learning normal communication patterns to detect anomalies in outbound emails. It also supports post-delivery remediation, enabling the removal of malicious emails from internal mailboxes after sending. Protection level: Advanced AI-driven detection and near real-time blocking of outbound threats, plus strong post-delivery cleanup capabilities. SPF/DKIM/DMARC impact: Since mail is sent directly by the original mail server (e.g., Microsoft 365), SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. Cisco Secure Email (formerly IronPort) – Outbound Handling and Integration Methods Outbound Logic Cisco Secure Email protects outbound email by preventing data loss (DLP), blocking spam and malware from internal accounts, stopping business email compromise (BEC) and impersonation attacks, and ensuring compliance. Cisco provides both traditional gateway appliances/cloud gateways and modern API-based solutions for layered outbound security. Integration Methods 1. Gateway Integration (MX Record / Smart Host) – Cisco Secure Email Gateway (ESA) How it works: Organizations update MX records to route mail through the Cisco Secure Email Gateway or configure their mail server (e.g., Microsoft 365, Exchange) to smart host outbound email via the gateway. All outbound mail is inspected and policies enforced before delivery. Protection level: Granular DLP (blocking, encrypting, quarantining sensitive content) Outbound spam and malware filtering to protect IP reputation Email encryption for sensitive outbound messages Comprehensive content and attachment policy enforcement SPF: Check this article for comprehensive guidance on Cisco SPF settings. DKIM: Refer to this article for detailed guidance on Cisco DKIM settings. 2. API Integration – Cisco Secure Email Threat Defense How it works: Integrates directly via API with Microsoft 365 (and potentially Google Workspace), continuously monitoring email metadata, content, and user behavior across inbound, outbound, and internal messages. Leverages Cisco’s threat intelligence and AI to detect anomalous outbound activity linked to BEC, account takeover, and phishing. Post-Delivery Remediation: Automates the removal or quarantine of malicious or policy-violating emails from mailboxes even after sending. Protection level: Advanced, AI-driven detection of sophisticated outbound threats with real-time monitoring and automated remediation. Complements gateway filtering by adding cloud-native visibility and swift post-send action. SPF/DKIM/DMARC impact: Since emails are sent directly by the original mail server, SPF and DKIM signatures remain intact, preserving DMARC alignment and domain reputation. If you have any questions or need assistance, feel free to reach out to EasyDMARC technical support.

As Elon Musk and US president Trump spar on social media, tech investors and executives are being forced to choose whether to support the most powerful man in business—or the White House.

Why building trust matters more than building components.There’s a scene in Field of Dreams that regularly comes to mind. Ray Kinsella (Kevin Costner) is standing at the edge of his cornfield ballpark, full of doubt about his ball field project. And then Terrence Mann (James Earl Jones) delivers this quiet but powerful monologue…James Earl Jones as Terrence Mann gives an inspiring speech“People will come, Ray. They’ll come to Iowa for reasons they can’t even fathom… They’ll arrive at your door as innocent as children, longing for the past… They’ll pass over the money without even thinking about it — for it is money they have and peace they lack.”It’s powerful. And there’s temptation for designers to think this way. That, if we just build it properly, people will come and use it. It’ll be a raving success. But that kind of thinking rests on emotion and hope. “People will come, Ray.”That got me thinking about my work with design systems. Because early on, that’s exactly how I imagined it would work.No…they won’t just come.I thought if you just built a great design system, people would come running from all over to use it. Designers would geek out. Engineers would contribute. PMs would rally around the time savings and consistency. I thought the system would basically sell itself. Job done.Except not. Not at first. In fact, most of those people actively resisted it. And it left me frustrated trying to figure out what was going on.That’s when it hit me: people don’t come just because you built something. They come because you built something that includes them. This isn’t a fictional baseball field built on faith. They don’t come because they don’t know it. It’s foreign. And as humans, we tend to run away from what we don’t understand.That’s why the people who work on design systems are so important. So that you can be known and your systems can be known. So that a relationship can be established. Trust can be created and people can see that this system will work for them. In fact, it’s been purpose-built for them.Design Systems are political (it’s true)I never would have imagined how political design systems would be. They seem logical and straightforward. It’s everything you need to build interfaces and consistent experiences. So, I thought the quality of the work would speak for itself. But once your system meets the real world, things get complicated. Real fast.Everyone already has established working patterns and people aren’t usually inclined to change. Plus, designers have their opinions. Engineers have priorities. Product managers have launch dates. And everyone already has a “good-enough solution”. So, now your carefully crafted design system feels more like a threat or liability than the life-changing birthday present you thought it’d be.You thought you were offering something amazing. They hear restriction. They see more steps. And they’re annoyed — at you — for meddling in their perfectly stable world.Why? Well, people love their tools. And, I mean LOVE them. They deeply cherish them. I think of the carpenter who’s used the same, trusty 20oz wood-handled hammer for 40 years. It’s weathered difficult projects and has dents and stains from 1,000s of projects. How do you convince someone to leave that hammer behind and pick up a new, unproven hammer for their work? It usually happens in community…in relationships.So, it turns out, building the system was the easy part. Getting people to care about it? That’s the real work. And that’s where building relationships comes in.The real work: building relationshipsTrue adoption doesn’t happen through documentation or a flashy campaign.So you can’t rely on a “build it and they will come” mentality. It means you need to make time to understand the people you’re building for and with. Because if it isn’t theirs, it won’t matter how good it is. Every group has different motivations, pain points, and goals. If you want them on board, you have to speak to them, about them, and how your system will help them.Designers need to see how the system supports creativity, not stifles it. Demonstrate how it will help them be more effective in their work.Engineers care about stability, performance, and clean code. Show them the efficiency that it brings to their development pipelines.PMs are focused on delivery. Make the system reduce friction and risk.Executives want the business case to be clear. Show them how your system enables faster velocity, better consistency, and reduced maintenance cost.Establishing how individual goals come together as shared goals is critical.Sounds selfish, right? Not really. They’re paid to do their job, and if you want your design system to be successful, it has to make them successful. So if you can’t answer a need to any of your partners or stakeholders, go back and figure out how to create that kind of value…or start with the people where the value already is.It’s the relationships that shift the dynamic. Suddenly it’s not “my design system vs. their priorities”…it’s shared ownership…our collective win.You can’t enforce your way to powerful adoptionYour first instinct might be to skip the relationships and rely on the “because I said so” method. So you add mandates. Governance councils. Approval gates. But none of them really work. You’ll have people subvert the system, or hold so fearfully tight to it that it hurts the product experience in the end.People don’t adopt systems because they have to. They adopt them because they believe in them. And belief is earned, not enforced. Your job is to find the intrinsic motivation that will cause them to jump on board and be a raving fan spreading the good news of your system. And that can’t be a marketing slogan or tagline; it has to be built into the design system.The goal isn’t to control usage…it’s to cultivate trust, leading to usage. It’s better to have ten enthusiastic partners than a hundred reluctant rule-followers. Because those ten partners? They’ll advocate for you. They’ll give real feedback. They’ll make the system better.It sounds uncomfortable, but it’s best to trade policing behavior for building partnerships. That’s the moment your system will truly grow. Because trust is a currency that earns interest.Trust is the real foundationDesign systems rely on a strong foundation: principles, guidelines, tokens, styles, components, and more. But that foundation must be built on something critical: trust.Trust is what makes someone choose the system instead of rolling their own. It’s what keeps your system on their radar when everything’s on fire. It’s what makes people reach out to work it out together, instead of working around you and subverting the whole thing.Without trust, your system is just a nice idea. It’s relegated to pixel art. But with relationships that foster trust…they see how the system becomes indispensable. It’s their go-to secret weapon for success.Trust and relationships are the ground that all foundations are built on.I’ve been on both sides. I’ve had teams avoid the system because they didn’t trust it…because they didn’t trust me. Here’s the secret: I know them or how to serve them…no trust. On the flip side, I’ve seen teams move faster, smoother, and more confidently because we’d built a foundation of partnership over time.Trust isn’t a side effect. It’s not a nice-to-have. It’s the ground that holds the whole thing up. Without it, your design system is drifting in the outer cosmos. Relationships are the gravity that keeps your design system grounded in trust.They’ll come… but only if you earn itSo, I hate to break it to you, but the truth is…no one’s coming just because your system is well-made. There’s already a plethora of well-made systems out there ready to leave you disappointed.They’re busy with the newest top priority. They’ve been burned by “that type of system” before. They see you as a risk, not a partner. But…if you spend time knowing them… if you listen… if you build trust… if you make it feel like it’s theirs… well then… “…they will come…”They’ll message you before they start a new feature. They’ll advocate for tokens during sprint planning. They’ll tell others it saved them time. They’ll ask how they can help improve it.They won’t come for the components. They’ll come for what the system gives them: clarity. Consistency. Relief.And if you’ve done the hard, human work behind the system? Well then, you might just look up one day and realize that there’s a whole bunch of people in your Iowa ball field.The politics of Design Systems was originally published in UX Collective on Medium, where people are continuing the conversation by highlighting and responding to this story.

Depending on the account you choose, you could net thousands of dollars in interest.

Customers who pre-order can choose two out of three accessories to go along with their flagship tablet.

Outsourcing definition Outsourcing is defined as a business practice in which services or job functions are hired out to a third-party on a contract or ongoing basis. In IT, an outsourcing initiative with a technology provid

The Pixel 10 series could be sold in Limoncello, Ultra Blue, and numerous other shades, but their modems might not be upgraded.

If the (hang on, let me count) 16 different Lego sets in my office alone are any indication, then PC gamers and Lego fans have a big overlap in the middle of their Venn diagram. Alienware knows this, and has released an official, adorable set that lets you recreate an Area 51 gaming desktop in miniature. According to the promotional page, the set is made of authentic Lego bricks. I assume the company is sourcing them wholesale, since the packaging doesn’t have any Lego logos on the box. It’s 5.3 inches (13.2 centimeters) long and contains 318 bricks. But it’s a pretty cool little kit, replicating the exterior features of the case and a nicely detailed rear panel, with a transparent window showing off the motherboard, CPU, GPU, and even some tiny round pieces that stand in for cooling fans. There are even some piping elements that show off liquid cooler lines going to the “radiator.” Dell If you want one, you’ll need to engage in a little band loyalty. The Dell subsidiary isn’t selling the kit on its own, instead exchanging it for 3500 Alienware Reward Points (ARP). You can earn ARP by installing the Alienware Arena app and competing in various challenges and community activities. It doesn’t look fun, frankly, and I’d rather just send Dell $30 for a teeny-tiny gaming desktop kit. Alternately, if you’ve got a shoebox full of spare Lego parts like I do, you could just throw together your own. There are plenty of examples to choose from out there.