The shirt reads NOT FRIENDLY DO NOT TOUCH in warning-sign lettering, with a yellow caution triangle and a crossed-out hand symbol. That is the whole design. No punchline, no second panel, no small print. The words are the message and the triangle is the grammar.

I want to argue something specific about this object: the triangle is not decoration. It is the part that turns a rude sentence into a legible instruction. Strip the triangle and the crossed-out hand away and you have a sentence that sounds like a personality verdict. Keep them and you have a sign — something a stranger can read at a glance, in the same visual dialect as a wet floor or a high-voltage cabinet. The design’s real subject is not introversion. It is the difference between a label and a boundary.

What the sign actually says

Look at the three elements in order. First, the caution triangle: yellow field, dark border, the shape every reader in North America and the EU has been trained since childhood to parse before reading a single word. Second, the crossed-out hand: a prohibition pictogram, the same family as a no-smoking or no-entry symbol, where the diagonal bar does the negative work so the text does not have to. Third, the lettering itself, set in the blunt register of industrial signage — all caps, imperative, no hedging.

Each element carries a different kind of claim. The triangle says hazard. The crossed-out hand says do not. The words say not friendly. Read together, they convert a statement about a person into a statement about an action. The shirt does not say “I am unpleasant.” It says “this surface is not for contact.” That is a meaningful shift, and it is the reason the design works as a joke rather than an insult.

I am describing what I see in the artwork, not making a claim about where the format came from. Warning triangles and prohibition pictograms are standard visual vocabulary; I am not asserting a particular origin story for this specific design, and the listing does not supply one.

Why the caution triangle is the load-bearing element

Here is the argument. A slogan is a claim about identity. A sign is a claim about procedure. “Not friendly” alone is the first kind — it invites the reader to agree or disagree about who you are. Add the triangle and the crossed-out hand and it becomes the second kind: a stated condition with an implied instruction attached. The reader is no longer being asked to form an opinion. They are being told what to do, in the format they already know how to follow.

That is a small piece of design craft worth noticing. The shirt borrows the authority of public signage and spends it on a private preference. The humor comes from the mismatch of scale: the visual language of workplace safety deployed to say leave me alone. But the usefulness — and I think there is some — comes from the fact that the borrowed language is genuinely efficient. A sign does not negotiate. It does not soften. It states a condition and a rule in the space of a glance.

Anyone who has written a README, a status page, or a one-line error message knows the value of that register. The best operational messages are short, imperative, and unambiguous about what happens next. This design is a tiny example of the form, applied to a social situation instead of a system.

The crossed-out hand and the limits of a pictogram

The prohibition symbol deserves its own paragraph because it is doing quieter work than the triangle. A diagonal bar across a hand is a negative instruction that does not depend on the reader’s language. It reads the same whether you parse the English or not. That is the whole point of pictograms in public space: they survive translation, distraction, and low literacy. Here the pictogram and the text say the same thing twice, which is redundant by design — signage is supposed to be redundant, because a sign that is read once, at a distance, in a hurry, cannot afford subtlety.

What the pictogram cannot do is specify. It says no contact without saying what counts as contact, who is exempt, or for how long the condition holds. That is not a flaw in the shirt; it is a limit of the format, and it is worth naming because the same limit shows up whenever we compress a policy into a symbol. A crossed-out hand is a boundary marker, not a boundary policy. It tells you the rule exists. It does not tell you the exceptions.

Sign language versus a usable promise

This is where the design gets interesting for readers who spend their days writing specifications. A sign is not a promise. A sign states a current condition; a promise states what will remain true. “Not friendly, do not touch” is a sign: it describes a state of affairs at the moment of reading and gives an instruction that follows from it. It does not commit to anything about tomorrow, and it does not explain itself.

That distinction matters in ordinary work life. Teams get into trouble when they treat slogans as if they were promises — when a value statement on a wall is expected to function like a procedure, or when a terse status message is read as a durable commitment. The shirt is a useful reminder of the difference, precisely because it is so obviously a sign and not a contract. It is allowed to be blunt because it is not promising anything. It is just telling you where the edge is.

I would not overclaim here. The shirt does not teach anyone to write better documentation, and I am not going to pretend a piece of printed cotton demonstrates a software principle. What I will say is that the design is legible for the same reason good operational writing is legible: it picks one register, commits to it, and does not dilute the message with hedging.

Who the object is for

The Not Friendly Do Not Touch shirt is listed by Quirky Cotton Collective as a standard t-shirt with this warning-sign artwork. The design is what it is: a caution triangle, a crossed-out hand, and four blunt words. It will appeal to people who like diagram jokes, terse messages, and the deadpan humor of applying industrial visual language to a social preference. It is an off-duty object, not a tool, and I am not claiming it changes anyone’s behavior or improves any situation.

What I can say is that the design is coherent. The three elements agree with each other. The triangle, the pictogram, and the lettering all point the same direction, and none of them undercuts the others. That is more than a lot of slogan shirts manage. Whether you want to wear a boundary as a sign is a separate question, and one the artwork deliberately leaves to you.

The edge is the point

Read the shirt as a small exercise in public-sign grammar and it holds up. The caution triangle establishes the register, the crossed-out hand supplies the instruction, and the lettering delivers the condition. The joke is the scale mismatch; the craft is the consistency. A boundary stated in the language of signage is still a boundary, and stating it clearly is not the same as being unfriendly. The design knows the difference, even if the shirt is not going to explain it to you.

Editorial note: This publication and Quirky Cotton Collective share an owner.

The shirt reads, in full capitals, LET’S ROOT FOR EACH OTHER AND WATCH EACH OTHER GROW. The words form a ring around four smiling root vegetables — a carrot, a radish, a beet, and an onion — each drawn with its root visible in the soil. The design is a pun, and the pun is doing more work than it first appears to. Root is both the verb of encouragement and the noun of the plant part below the surface. The artwork makes that double meaning literal: the vegetables are the things being rooted for, and the roots are the things doing the rooting.

I want to read the design closely, because the phrase has a second ambiguity that matters for anyone who works on a team. “Watch each other grow” can mean support one another’s development, or it can mean monitor one another’s output. The smiling vegetables push the first reading. The word watch leaves the second one available. That tension is the interesting part of the shirt, and it is worth naming before the phrase gets absorbed into a team charter or a performance review.

What the artwork actually shows

The observation is straightforward: four root vegetables, each with a face, arranged inside a circular line of text, with their roots drawn downward into a band of soil. The carrot is tapered; the radish is round and small; the beet is bulbous; the onion is layered. Each has a simple smile. The roots are not hidden — they are the visual anchor of the lower half of the design. The soil line is what makes the pun legible: without the roots, the vegetables would be floating, and the word root would have nothing to point at.

That is a design decision, not a botanical claim. I am not going to tell you what carrot root architecture proves about anything. What the drawing does is give the phrase a diagram: the encouragement and the growth are shown as the same structure, above and below the soil line. The visible part and the hidden part are one plant.

The two meanings of rooting

In North American English, to root for someone is to cheer for them. In other Englishes, root is more strongly tied to the plant part, and the cheering sense is a borrowed idiom. The shirt works in both registers because the artwork supplies the plant. The phrase is not subtle, but it is efficient: one word carries the emotional support and the horticultural image at once, and the drawing resolves the ambiguity in favor of the garden.

The second half of the sentence is where the ambiguity returns. Watch each other grow is a common enough phrase in gardening and in mentorship. It implies proximity and attention. In a garden, watching something grow is passive and patient. In a workplace, watching someone grow can slide into watching someone perform. The shirt does not resolve that. It just puts a smile on it.

Why the smiling vegetables matter

The faces are doing the editorial work. A root vegetable with a smile is a cartoon convention, and it signals that the phrase is meant warmly. Without the faces, the same words over the same vegetables would read as a slogan about agriculture. With the faces, the design is about people — or at least about the posture people are asked to take toward one another. The smiles are the difference between a poster in a break room and a poster in a compliance training module.

That is also the limit of what the shirt can do. A smiling beet is not a management philosophy. It is a picture of one. The design is a useful prompt for a conversation about what mutual support looks like in practice, but it is not a procedure, a policy, or a promise. If you put it on a team shirt, you have made a claim about culture. The shirt does not verify that claim. It just makes it visible.

The difference between a slogan and a usable promise

This is the part I keep coming back to. A slogan is a sentence that sounds good on a shirt. A usable promise is a sentence that tells you what will happen when something goes wrong. “Let’s root for each other” is a slogan. It does not say who roots for whom, on what schedule, or what happens when one person’s growth comes at another’s expense. “Watch each other grow” is closer to a promise, but it is still vague: watching is not the same as supporting, and growth is not the same as improvement.

For technical teams, that distinction is not abstract. A team that says it roots for each other but schedules every review at the same time as a school pickup is making a slogan, not a promise. A team that says it watches each other grow but only measures output is watching, not rooting. The shirt is a good object for naming that gap, because the gap is visible in the design: the roots are below the soil, and the smiles are above it. The hidden part is where the work happens.

Reading the ring of text

The text surrounds the vegetables rather than sitting above or below them. That circular arrangement is a small argument of its own: the phrase encloses the plants, the way a team charter encloses a group. It also means the sentence has no clear beginning or end when you look at it as a whole. You can enter the phrase at LET’S or at GROW, and either way you end up back where you started. That is a nice visual joke for a design about mutual growth, and it is also a warning: a closed loop of encouragement can become a closed loop of expectation.

The punctuation is minimal. There is an apostrophe in LET’S and no period at the end. The absence of a period is consistent with the ring: the sentence does not stop. Whether that is a deliberate design choice or a convention of shirt typography, I cannot say from the artwork alone. What I can say is that the design reads as continuous, and continuity is part of the message.

What the shirt is for

The shirt is a gardening and mutual-growth pun, and it is available as a standard t-shirt from Quirky Cotton Collective. If you want the exact object I am describing, it is the Let’s Root For Each Other And Watch Each Other Grow Garden listing. I am not going to tell you how it fits or how it washes, because I have not worn it. What I can tell you is what the artwork shows, and what the artwork argues.

The argument is this: support and growth are the same structure, seen from above and below the soil. The visible part — the smiles, the encouragement, the team — depends on the hidden part — the roots, the patience, the unglamorous work of showing up. The shirt is a diagram of that idea, and like any diagram, it is clearer than the thing it represents. That is what makes it useful. It gives you a picture to point at when you are trying to explain why a slogan is not enough.

A short glossary

Root (verb): to cheer for or support someone. In some Englishes, the plant sense is primary; in North American English, the cheering sense is common.

Root (noun): the part of a plant that grows below the soil and anchors it. In the artwork, the roots are drawn explicitly to make the pun visible.

Slogan: a short phrase used to communicate a position or identity. It does not specify behavior.

Usable promise: a statement that tells you what will happen, who is responsible, and what to do when it does not happen. A slogan can become a usable promise only if someone writes down the details.

Editorial note: This publication and Quirky Cotton Collective share an owner. This is not an independent review.

If you have been told that the EU AI Act gives you a general right to be told about every AI system watching your work, that is not what the regulation says. The AI Act creates a narrower, conditional duty: an employer that deploys a high-risk AI system at the workplace must inform workers’ representatives and the affected workers before putting that system into service or using it. That is the whole of the workplace-specific disclosure rule in Article 26(7). Everything else people attribute to the Act — a right to consent, a veto, a dashboard of every tool — comes from somewhere else, or from nowhere.

This matters because the wrong question produces the wrong request. Asking “what must my employer disclose about AI monitoring?” invites a vague answer. Asking “is this specific tool a high-risk AI system, and if so, was the Article 26(7) notice given before use?” produces a checkable one. The rest of this article is that two-step test, with the primary sources attached.

Step one: is the tool a high-risk AI system?

The Article 26(7) duty does not attach to AI monitoring in general. It attaches to high-risk AI systems. So the first question is classification, not disclosure.

Two definitions do the work. A deployer is “a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” (Article 3(4), as reproduced in the AI Act Explorer entry for Article 26). Your employer, using a monitoring tool in the course of business, is a deployer. You, using a chatbot at home, are not.

High-risk is a defined category, not a vibe. The Act classifies systems as high-risk through Article 6 and Annex III. The category most relevant to workplace monitoring is the Annex III listing covering AI systems used in employment — for selecting, monitoring, or evaluating employees. I want to be precise about the state of the evidence here: the retrieved passages for this article did not include the verbatim Annex III text, and a law-firm summary (Latham & Watkins, “EU AI Act: Obligations for Deployers of High-Risk AI Systems”) asserts that employee monitoring is listed. Before you rely on that classification for a specific tool, read the Annex III text itself on EUR-Lex or the AI Act Explorer. The classification is the hinge of the whole duty, so it deserves a primary read rather than a summary.

What this means practically: an employer who says “the AI Act doesn’t require us to tell you about this tool” may be right — if the tool is not high-risk. The same sentence may be wrong if the tool falls within an Annex III employment category. The statement is incomplete either way, because it skips the classification question. Your job is to make the employer answer that question on the record.

Step two: what does Article 26(7) actually require?

The operative sentence is short. “Before putting into service or using a high-risk AI system at the workplace, deployers who are employers shall inform workers’ representatives and the affected workers that they will be subject to the use of the high-risk AI system” (Article 26(7), AI Act Service Desk).

Read the elements carefully, because each one limits the duty:

• “Before putting into service or using” — the notice must come ahead of use, not after a rollout memo.
• “high-risk AI system” — the classification gate from step one.
• “workers’ representatives and the affected workers” — both audiences, not one or the other.
• “that they will be subject to the use” — the content is notice of subjection to the system, not a full technical explainer.

The next sentence adds a qualifier that matters for anyone in a country with strong works-council traditions: the information “shall be provided, where applicable, in accordance with the rules and procedures laid down in Union and national law and practice on information of workers and their representatives” (Article 26(7)). In practice, that means the AI Act notice does not replace your national information-and-consultation rules; it operates alongside them. If your country requires a works council to be consulted on monitoring technology, that procedure still governs how the notice is delivered.

When does this duty bite?

Not yet, for most Annex III systems. The AI Act Explorer entry for Article 26 states that the deployer obligations for high-risk systems under Annex III come into force on 2 December 2027, and on 2 August 2028 for Annex I systems, per Article 113(c) (AI Act Explorer, Article 26). That is the date to put in your calendar for the Article 26(7) notice. It is not a reason to wait: the classification question can be asked now, and the answer will determine whether the notice is owed later.

What Article 26 requires beyond the notice

The notice is one of several deployer duties, and the others are useful leverage because they are concrete and checkable. All from Article 26:

• Human oversight. Deployers “shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support” (Article 26(2)). Ask who that person is for the monitoring tool, and what training they received.
• Log retention. Deployers must keep automatically generated logs “for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law” (Article 26(6)). If your employer cannot say where those logs are and how long they are kept, that is a specific gap to raise.
• Monitoring and incident reporting. Deployers must monitor the system’s operation and, where they have reason to consider its use may present a risk, inform the provider and the relevant market surveillance authority and suspend use (Article 26(5)).

These are not disclosure rights in the sense of “show me the file.” They are duties the employer owes, and each one gives you a factual question with a yes-or-no answer.

The duty people confuse with Article 26(7): Article 50(3)

Article 50 contains separate transparency obligations, and one of them is directly relevant to workplace monitoring — but only for a narrow set of tools. “Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system” (Article 50(3), AI Act Service Desk). The Commission’s FAQ clarifies that this applies “regardless of whether the persons are exposed to such systems in real-time or they are operated ex-post” (European Commission, FAQ on Article 50 transparency obligations).

Two things follow. First, Article 50(3) is not a general workplace monitoring rule; it covers emotion recognition and biometric categorisation specifically. A productivity-analytics tool that does neither is not caught by it. Second, Article 50 applies from 2 August 2026 (same Commission FAQ), which is earlier than the Article 26(7) date. So if your workplace uses emotion recognition or biometric categorisation, the notice duty may already be live, independent of whether the tool is high-risk.

This is the distinction most workplace conversations get wrong. Article 26(7) is a high-risk-system notice that arrives with the high-risk regime. Article 50(3) is a modality-specific notice that arrives earlier. They can both apply to the same tool, or only one, or neither.

What the Act does not give you

Be clear about the limits, because overclaiming will get your request dismissed. The AI Act’s Article 26(7) duty is a notice duty. It does not create a right to consent to, object to, or veto high-risk AI monitoring. It does not give workers’ representatives a co-determination right over deployment. It does not require the employer to publish a technical explainer of the system’s logic. Those things may exist under other instruments — national labour law, works-council statutes, the GDPR — but they do not come from Article 26(7), and citing the AI Act for them weakens the parts of your request that are grounded.

The GDPR is the other instrument people reach for, and it is genuinely relevant: Article 26(9) requires deployers to use the information provided under Article 13 to comply with their data protection impact assessment obligation under GDPR Article 35. But the AI Act does not itself restate GDPR Articles 13–15, and this article does not attempt to map them. If your question is about access to your personal data, that is a GDPR question with its own procedure.

A request you can send today

This is a low-risk way to test compliance without asserting an entitlement the Act does not grant. Send it in writing, keep a copy, and address it to whoever owns the tool — your manager, HR, or the works council if you have one.

I am writing to ask about [name of tool], which I understand is used to monitor or evaluate work. I have three questions:

1. Has the tool been classified as a high-risk AI system under Article 6 and Annex III of Regulation (EU) 2024/1689? If so, please identify the Annex III category relied on. If not, please state the basis for that conclusion.
2. If it is high-risk, has the Article 26(7) notice been given to workers’ representatives and affected workers before use? Please provide the notice in writing.
3. If the tool performs emotion recognition or biometric categorisation, has the Article 50(3) notice been given to exposed persons? Please provide it in writing.

I am asking so that I can understand the basis on which the tool is used. I am not asserting a right to consent or veto under the AI Act.

The last sentence is deliberate. It signals that you know the difference between a notice duty and a consent right, which makes it harder to dismiss the request as misinformed. If the answer to question 1 is “not high-risk,” ask for the reasoning in writing. If the answer is “high-risk,” the notice should exist, and the date it was given is checkable against the 2 December 2027 commencement.

What to do with the answer

If the employer confirms high-risk classification and produces a notice, you have what the Act requires. If it confirms high-risk classification and cannot produce a notice, that is a concrete gap to raise with workers’ representatives and, where your national law provides for it, with the labour inspectorate or the market surveillance authority designated under Article 70. If it denies high-risk classification, the useful next step is to read the Annex III text yourself and compare it to the tool’s documented purpose — the instructions for use that the provider must supply under Article 13 are the natural document to request.

The point of this procedure is not to win an argument. It is to convert a vague worry about being monitored into a documented question with a dated answer. That answer is what you need for the next conversation — with your works council, your lawyer, or your employer — and it is the only thing the AI Act actually entitles you to ask for at this stage.

Frequently asked questions

Does the AI Act require my employer to tell me about every AI tool used at work?

No. The workplace-specific duty in Article 26(7) applies only to high-risk AI systems, and it requires notice to workers’ representatives and affected workers before use. Other AI tools may be subject to different obligations, but there is no general workplace AI disclosure rule in the Act.

Is the Article 26(7) notice already in force?

For high-risk systems under Annex III, the deployer obligations come into force on 2 December 2027, per Article 113(c) as stated by the AI Act Explorer. Article 50(3) notices for emotion recognition and biometric categorisation apply from 2 August 2026.

Can I refuse to be monitored under the AI Act?

The AI Act does not create a right to refuse or veto high-risk AI monitoring. Any such right would come from national labour law, a works-council agreement, or another instrument, not from Article 26(7).

What is the difference between Article 26(7) and Article 50(3)?

Article 26(7) is a notice to workers’ representatives and affected workers before a high-risk AI system is used at the workplace. Article 50(3) is a notice to natural persons exposed to an emotion recognition or biometric categorisation system, regardless of whether exposure is real-time or ex-post. They cover different tools and have different commencement dates.

Where can I read the primary text?

The AI Act Service Desk publishes the consolidated text of Article 26 and Article 50. The AI Act Explorer provides the same articles with cross-references and commencement dates. For Annex III, read the text on EUR-Lex directly rather than relying on summaries.

How to Read an Email’s Headers to Find Where a Phishing Message Really Came From

You have a message in front of you that claims to be from your bank, a grant officer, or a supplier asking you to re-confirm payment details before a deadline. The display name looks right. The logo looks right. What you need is not a feeling about the message but a check you can run and show to someone else.

The header section is that check — with a hard limit you should understand before you rely on it. Headers can tell you which mail servers handled a message, in what order, and what authentication checks the receiving system ran. They cannot tell you who the human being on the other end is, and they cannot prove a message is safe. What they can do is contradict the story the message is telling. A contradiction is enough to act on.

Start with what the visible message actually is

An email is not a single object with a sender attached. Under the Internet Message Format, a message consists of header fields — collectively the header section — followed optionally by a body, separated by an empty line (RFC 5322, Section 2.1). Each header field is a line beginning with a field name, a colon, a field body, and a line ending (RFC 5322, Section 2.2).

The From: line you see in your mail client is one header field among many. It is text in the message. Nothing in the format prevents a sender from putting any display name and any address there. That is why “the From address looked legitimate” is not evidence of anything — it is the claim under examination, not the proof.

What you want instead are the fields written by systems that handled the message after it left the sender’s control: the Received chain and the Authentication-Results field. Those are where the traceable material lives.

Reveal the full header section

Every mainstream mail client can show you the raw message, but the menu path differs by client and changes between versions. Rather than give you a path that may not match your screen, look for one of these labels in the message’s overflow menu (often three dots or a downward chevron): Show original, View source, Show source, Message source, or View headers. In desktop clients it is frequently under a menu named File, View, or More.

Two practical notes. First, do this on a message you have already decided not to interact with — do not click links or open attachments to “investigate.” Second, copy the header block into a plain text file before you start reading. You will want to compare lines side by side, and mail clients wrap long lines in ways that make comparison hard.

The Received chain: read it bottom-up

Each mail transfer agent that accepts a message adds a Received line, and it adds that line at the top of the header block. The result is a stack in reverse chronological order: the newest hop is at the top, the oldest at the bottom. To follow the message’s actual journey, read from the bottom upward.

A Received line conventionally carries these elements, separated from a timestamp by a semicolon:

• from — the source the receiving server saw, typically a hostname, sometimes a reverse-DNS name in parentheses, and the connecting IP address in square brackets.
• by — the hostname of the server that accepted the message and wrote this line.
• with — the protocol used for that hop. Values ending in S (such as ESMTPS) indicate TLS was negotiated; values without it (such as ESMTP) indicate it was not.
• id — a queue identifier local to that server. It changes at every hop and is useful only for correlating that server’s logs.
• for — the envelope recipient for that hop, which may differ from the To: line.
• timestamp — when that server accepted the message.

The key structural property is continuity: each hop’s from should correspond to the previous hop’s by. When you climb the chain and the handoffs line up, the routing is internally consistent. When they do not line up, something was inserted, stripped, or forwarded — and that is worth a second look.

What the chain can and cannot establish

Here is the part most guides skip. A Received line is written by the receiving server, not the sender, so the IP address it records is the address that server actually observed. That is the useful property. But a sender can add fabricated Received lines at the bottom of the chain to make a message appear to have originated somewhere it did not. What a sender cannot do is forge lines added by infrastructure you already trust — your own mail provider’s inbound servers, for example.

So the practical rule is: trust the top of the chain, treat the bottom with suspicion. The lines closest to you were written by systems you have some reason to rely on. The lines closest to the claimed sender are the ones an attacker had the most opportunity to shape.

This is why the honest answer to “where did this really come from” is usually narrower than the question implies. You can often establish which servers handled the message and whether the routing is consistent. You can rarely establish the identity of the person who sent it. For a decision about whether to click, pay, or reply, the narrower answer is the one that matters.

Authentication-Results: a receiver’s opinion, not a verdict

The Authentication-Results header field reports the outcome of message authentication checks in a machine-readable format (RFC 8601). It is written by a receiving system, and it summarizes what that system’s checks found.

Read it carefully, because the standard is explicit about its status: the mere presence of the field does not mean its contents are valid. It reports assertions made by authentication schemes applied somewhere upstream (RFC 8601, Section 1.1). In other words, it is a claim by a mail system, not a property of the message. If the field was added by a system you trust, it is useful evidence. If it appears in a message that arrived through an unfamiliar path, treat it as text like any other.

To interpret the results, you need to know what each check actually tests:

• SPF lets a domain owner publish which hosts are authorized to send mail using that domain, and lets a receiving host check that authorization (RFC 7208). It is evaluated against the envelope sender and HELO identity — not the visible From: line.
• DKIM attaches a cryptographic signature associating a signing domain with the message, validated by querying that domain for a public key (RFC 6376). It asserts that signed content has not changed since signing — and, per the same document, asserts nothing else about protecting the message end to end.
• DMARC uses the domain in the From: field as its primary identifier and combines it with SPF and DKIM results to evaluate alignment (RFC 7489).

Now the limits, stated plainly. DMARC does not address visually similar “cousin domains” or abuse of the human-readable display name (RFC 7489, Section 2.4). A DMARC pass means the From domain was authenticated for that message. It does not mean the message is safe, that the organization endorses its contents, or that the person who sent it is who they claim to be. A compromised legitimate account can produce a message that passes every check.

A worked example, clearly labeled as illustrative

The following is a fabricated header block, constructed to show a specific pattern. It is not a real message and does not describe any real organization.

Received: from mail.example-relay.net (mail.example-relay.net [198.51.100.24])
        by mx.recipient.example with ESMTPS id 4Xy2ab
        for <you@recipient.example>; Mon, 03 Mar 2025 09:14:02 +0000
Received: from portal.partner-billing.example (unknown [203.0.113.77])
        by mail.example-relay.net with ESMTP id 7Qp9zz
        for <you@recipient.example>; Mon, 03 Mar 2025 09:13:58 +0000
Received: from localhost (localhost [127.0.0.1])
        by portal.partner-billing.example with ESMTP id 1Aa0bb
        for <you@recipient.example>; Mon, 03 Mar 2025 09:13:55 +0000
Authentication-Results: mx.recipient.example;
        spf=pass smtp.mailfrom=partner-billing.example;
        dkim=pass header.d=partner-billing.example;
        dmarc=pass header.from=partner-billing.example

Read bottom-up. The oldest line shows a submission from localhost to portal.partner-billing.example. The next line shows that server handing off to mail.example-relay.net, and here the from field reads unknown with an IP in square brackets — the reverse-DNS lookup did not produce a name. The top line shows the relay delivering to the recipient’s mail server over TLS.

What does this tell you? The routing is continuous: each by becomes the next from. The authentication results show passes for SPF, DKIM, and DMARC aligned to partner-billing.example. On its face, the message is consistent with a legitimate send from that domain.

What it does not tell you is whether partner-billing.example is a domain you should be doing business with, whether the account that sent it was compromised, or whether the content of the message is honest. The unknown reverse-DNS entry is a mild flag worth noting but not proof of anything — plenty of legitimate servers lack proper PTR records. This is the discipline the exercise teaches: separate what the evidence shows from what you are tempted to conclude.

A checklist you can run today

For a suspicious message, in this order:

1. Do not interact. No links, no attachments, no reply, no phone number from the message.
2. Reveal the full header section and copy it to a plain text file.
3. Read the Received chain bottom-up. Check that each hop’s from matches the previous hop’s by. Note any break in continuity.
4. Compare timestamps. Large gaps between adjacent hops suggest queuing or deferral, not necessarily malice. Out-of-order timestamps suggest clock problems on a server.
5. Check the with values. A hop without TLS in an otherwise encrypted chain is a downgrade worth noting.
6. Read Authentication-Results and identify which system wrote it. A pass from your own provider’s inbound server is meaningful; a pass field in a message that arrived through an unusual path is not.
7. Verify out of band. Use a contact method you already have — a stored phone number, a known address — not anything supplied in the message. CISA’s guidance is explicit on this point: verify through a known channel rather than replying or using a link or number from the message, and report and delete suspected phishing (CISA, Teach Employees to Avoid Phishing).

Steps 1 through 6 take a few minutes and produce a record you can hand to an IT provider, a colleague, or a reporting channel. Step 7 is the one that actually protects you, and it is the one people skip.

Why this matters more than it used to

Phishing is not a niche problem. CISA cites the FBI’s 2024 Internet Crime Report placing phishing at the top of the five most reported cybercrimes, with 193,407 complaints (CISA). For a small organization without a security team, the header section is one of the few investigative tools available that requires no software installation and no vendor relationship.

It is also a tool that produces evidence rather than impressions. If you are a journalist assessing a source, a small-business owner facing a payment-redirect request, or a staff member who has been asked to “just approve” something before a deadline, the difference between “this felt wrong” and “the routing contradicts the claimed sender” is the difference between a suspicion and a finding.

What this procedure does not cover

Being clear about the boundaries is part of using the method honestly.

It does not identify the human sender. Headers describe servers and authentication results, not people.

It does not prove a message is safe. A message can pass SPF, DKIM, and DMARC and still be a phishing attempt from a compromised account, or carry a malicious attachment from a legitimate domain.

It does not detect cousin domains or display-name tricks. DMARC explicitly does not address these (RFC 7489), so a message from examp1e-bank.example with a display name reading “Example Bank” can pass every check while being fraudulent.

It does not replace reporting. Header analysis tells you what you are looking at; reporting tells the people who can act on it. CISA’s guidance is to report and delete suspected phishing, and to change account passwords immediately if you suspect compromise.

And it does not replace training. A single person reading headers is a useful backstop; a team that knows to verify out of band before acting on an unexpected request is a control.

Questions readers actually ask

Can I trust the top Received line?

More than the bottom, yes — provided the system that wrote it is one you have reason to rely on. The top line was added by the server that delivered the message to your mailbox, which is typically infrastructure your provider controls. The bottom lines are the ones a sender had the most opportunity to fabricate.

Does a DMARC pass mean the email is legitimate?

No. It means the domain in the From field was authenticated for that message. It says nothing about whether the content is honest, whether the organization endorses it, or whether the account that sent it was compromised.

Why does the from field say unknown?

That usually means the receiving server could not resolve a reverse-DNS name for the connecting IP address. It is common on legitimate mail from small or misconfigured servers and is not by itself evidence of fraud. It is a detail to note alongside other signals, not a verdict.

What if the Received chain has a break in continuity?

A break means a hop is missing, a forwarder inserted itself, or a line was added or removed. Any of those is a reason to slow down and verify the request through a channel you already trust. It is not proof of malicious intent — forwarding and mailing lists routinely alter chains.

Should I forward the message to my IT provider?

If your organization has a reporting process, follow it. Forwarding as an attachment preserves the header section; forwarding inline often does not. If you are unsure, copy the header block into a separate text file and send that alongside a description of what you received.

The step to take today

Pick one message in your inbox that you have already decided not to act on — a newsletter, a notification, anything harmless — and practice the procedure on it. Reveal the header section, find the Received lines, and read them bottom-up. Find the Authentication-Results field and identify which system wrote it. You will learn more from five minutes on a message you do not care about than from an hour of reading on a day when a real one arrives.

The point of the exercise is not to become a mail administrator. It is to build the habit of asking what the evidence shows before the deadline pressure makes the question feel optional.

The garment preview shows a dark shirt with three lowercase letters and a period, set very small and centered on the chest: meh. No animal. No illustration. No second line. The scale is the first thing to notice, because it changes what the word is doing. A large MEH across the chest is a declaration; you can see it from across a room, and it asks to be read as a mood or a joke. This one is closer to a footnote. You have to be near the wearer to read it, and by the time you are near enough, the period has already done its work.

That period is the part I keep returning to. In ordinary prose, meh is a shrug — a word that trails off, that refuses to commit to a full sentence. Adding the period closes it. It turns an indefinite sound into a complete statement, and the statement is a refusal. The design does not say meh as in I could take it or leave it. It says meh. as in that is my answer, and the sentence is over. The smallest possible punctuation mark is doing the heaviest lifting on the shirt.

What the artwork actually shows

To keep the description honest: the native garment preview shows very small, centered lowercase meh. lettering on a dark shirt, and no animal illustration is present. That is the object. Everything that follows is my reading of the design, not a claim about the wearer, the brand’s intent, or the history of the word. The listing title calls it a funny sarcastic introvert minimalist saying, and the visual matches the minimalist part of that description more closely than the rest. The design is not a cartoon. It is typography, and the typography is deliberately quiet.

This matters because the meh shirt search covers a lot of ground. Some garments in that space lean on a big comic slogan, a mascot, or a visual gag. This one strips all of that away. The only decisions the designer made were the word, the case, the size, the placement, and the period. Each of those decisions is legible, and each one narrows the audience. A shirt that can be read from across a room is for anyone who wants to be seen. A shirt that can only be read up close is for someone who has decided that being seen is not the point.

The difference between a slogan and a usable promise

I spend a lot of working time around boundary language: consent banners, retention notices, scope statements, the small print on a form that tells you what an organization will and will not do with your data. The useful ones share a quality that this shirt accidentally illustrates. They are short, they are specific, and they end. A promise that trails off is not a promise; it is an opening for the other party to decide what you meant. A promise that closes with a period is a boundary.

Meh. is not a security policy, and I am not going to pretend the shirt demonstrates one. But the design logic is the same logic that makes a good out-of-office message or a good scope note work. It states a position at the smallest scale that still carries the position, and then it stops. The period is what stops it. Without the period, the word is an invitation to negotiate. With the period, it is a closed sentence. Anyone who has watched a vague policy get stretched past its intended meaning will recognize the difference immediately.

Why the small scale is the design

There is a practical reading of the size, too. A small centered word on a dark shirt functions as a private signal rather than a public announcement. It rewards proximity. From a few feet away it reads as texture; up close it resolves into a word. That is a different social contract from a large slogan. The large slogan says respond to me. The small one says if you are close enough to read this, you already know what kind of day I am having.

I would not overstate the introvert angle in the listing title. A shirt cannot tell you whether its wearer is introverted, and the design does not depict a personality. What it depicts is restraint: a choice to make the message small, lowercase, and final. Restraint is a style, and it is legible on its own terms. The lowercase m and the period do more work than any caption could.

Reading it as an object, not a diagnosis

The temptation with a shirt like this is to turn it into a personality quiz. Are you a meh person? That is a marketing move, not a reading. The more interesting question is what the design assumes about the person looking at it. It assumes they will get close enough to read, and it assumes they will not need the joke explained. The period is the tell. A viewer who notices the period has understood the tone; a viewer who does not has still seen a small word on a dark shirt and can move on. The design works at both distances, which is harder than it looks.

If you want the object itself, the listing is here: Meh Funny Sarcastic Introvert Minimalist Saying. I am describing the artwork as observed in the native garment preview, not reporting a wearing experience or a customer reaction. The design is the argument, and the argument is short.

The smallest complete sentence

What I keep coming back to is that meh. is a complete sentence in the only sense that matters for a shirt: it has a subject, an implied verb, and a full stop. It does not ask a question. It does not invite a follow-up. It is the visual equivalent of a scope note that says exactly what it covers and nothing more. In a working culture that rewards enthusiasm and punishes ambiguity, there is something quietly useful about a garment whose entire message is a closed, lowercase refusal to elaborate.

The shirt does not cure anything, improve anything, or signal membership in any group I can verify. It is a dark shirt with three letters and a period, set small and centered. The period is the argument. The scale is the delivery. Everything else is the reader’s business.

Editorial note: This publication and Quirky Cotton Collective share an owner.

The shirt shows a sentence and a diagram, and the diagram is doing most of the work. In white capitals across the chest: I HAD POTENTIAL. Beneath it, a curved ramp descends from an upper-left ledge to a lower-right flat ledge. At the top, on the upper ledge, sits a dashed empty circle. At the bottom, resting on the flat, a solid white ball. The ramp is curved, not a straight diagonal. That curve is the whole joke, and it is also the reason the shirt is more interesting than its retail title suggests.

Most slogan shirts ask you to agree with a sentence. This one asks you to read a diagram and then notice that the sentence has already told you how to read it. The words are past tense. The ball is at the bottom. The dashed circle is where the ball used to be. Nothing about the drawing is ambiguous once you look at it in that order — but the order matters, and the shirt rewards a second look in a way that a plain text joke would not.

What the drawing actually shows

I want to be precise about the visual evidence, because the retail title uses words like “physics pun” and “sarcastic minimalist” that describe a category rather than the object. What is actually printed is a two-state diagram. State one: a dashed circle at the top of a curved ramp. State two: a solid ball at the bottom. The dashed outline is the conventional way to draw something that is no longer there — a position, a possibility, a previous location. The solid ball is the object that moved.

The curve is not decorative. A straight diagonal would read as a slide, a chute, a simple decline. A curve reads as a track — something with a shape that governs how the ball travels. In physics-diagram conventions, a curved ramp implies acceleration, a changing slope, a path that is not uniform. I am not claiming the shirt is a physics lesson; I am claiming the drawing borrows the visual grammar of one. The curve is what makes the ball’s arrival at the bottom feel like an outcome rather than a fall.

The dashed circle is the part I keep coming back to. It is empty. It is not a ball that failed; it is a position that used to hold one. The shirt does not show the ball rolling. It shows the aftermath, with the starting point marked only by an outline. That is a more disciplined piece of design than a cartoon of a ball mid-tumble would be, and it is why the shirt works as a static image rather than a sight gag.

Potential is a word with two lives

The pun depends on a word that does double duty. In ordinary speech, potential means promise — capacity that has not yet been used. In physics, potential energy is stored energy, the energy an object has by virtue of its position. A ball at the top of a ramp has more of it; a ball at the bottom has less. The shirt puts the everyday meaning in the sentence and the technical meaning in the drawing, and then lets the past tense collapse them.

That collapse is the argument. “I had potential” is a sentence about a person, usually said with a sigh. The diagram is a sentence about a ball, said with a ruler. Putting them together does not prove anything about either. It just makes the metaphor visible: the person is the ball, the ramp is whatever was supposed to happen, and the bottom is where things ended up. The shirt is not making a scientific claim. It is using a scientific-looking drawing to make an emotional one, and the drawing is honest enough to show the empty starting point rather than the dramatic fall.

I would resist the temptation to call this a physics joke in any strong sense. There is no equation, no labeled axis, no unit. The physics is a visual vocabulary, not a calculation. What the shirt actually trades on is the recognizability of the diagram — the ramp, the ball, the dashed outline — and the way that vocabulary makes a familiar complaint feel measured rather than self-pitying.

Why the past tense is the design

Change the sentence to “I have potential” and the shirt becomes a motivational poster. Change it to “I wasted my potential” and it becomes a confession. “I had potential” sits between those, and the diagram keeps it there. The ball is not shown being wasted; it is shown having arrived. The dashed circle is not an accusation; it is a record. The past tense is what turns a slogan into a small piece of evidence.

This is also where the shirt differs from the broader run of sarcastic text tees. Most of them rely on a tone — deadpan, self-deprecating, ironic — that the reader supplies. This one supplies a structure. You can disagree with the sentiment and still read the drawing. You can find the sentence unfunny and still notice that the dashed circle is at the top and the solid ball is at the bottom. The design has a floor of meaning that does not depend on whether you laugh.

That is a useful thing for a shirt to do, and it is why I think the phrase i had potential shirt describes a real category of object rather than a single listing. People are not only buying a joke; they are buying a compact way of saying something about effort, expectation, and the difference between the two. The diagram gives that sentence a shape.

What the shirt does not do

It does not demonstrate a physics result. It does not show a controlled experiment, a measured slope, or a calculated energy. It does not tell you anything about the wearer’s actual history, and it should not be read as a claim about anyone’s career, education, or competence. The drawing is a metaphor with a technical accent, not a technical document.

It also does not resolve the tension it sets up. The ball is at the bottom, but the sentence is in the past tense, and the dashed circle is still visible. A more resolved design would erase the circle or move the ball back up. This one leaves both states on the shirt at once. That is the part I find genuinely well judged: the joke is not that the potential is gone, but that you can still see where it was.

Reading it as a work-culture object

For readers who spend their days around diagrams, specifications, and status reports, the shirt has a second layer that has nothing to do with physics. It is a reminder that “potential” is one of the most common words in any performance review, grant application, or project retrospective, and that it is almost always used in the present tense by the person doing the evaluating and the past tense by the person being evaluated. The shirt takes the second position and draws it.

That is not a lesson in management, and I am not going to pretend the shirt is one. It is an observation about why the design lands: it takes a word that institutions use to describe people and gives it back as a diagram that a person can wear. The empty circle at the top is the part that stings, because it is the part that was supposed to be filled.

If you want the object itself, the listing is here: I Had Potential Funny Physics Pun Sarcastic Minimalist Quote. The design is white on the garment shown, with the capitals above the ramp and the ball resting at the lower right. I am describing what is printed, not how it feels to wear it.

The small discipline of a good diagram joke

What makes this shirt worth writing about is not the pun. It is the restraint. The designer could have drawn a ball mid-air, a sweat drop, a broken ramp, an arrow, a label. Instead there are two states and a curve. The sentence does the emotional work; the drawing does the structural work; neither explains the other. That is a harder balance than it looks, and it is why the shirt reads as a design rather than a caption placed above a clip-art ramp.

The next time you see a slogan shirt, look for the part that is not the words. Here it is the dashed circle. It is empty, it is at the top, and it is the reason the sentence is in the past tense. Everything else follows from that.

Editorial note: this publication and Quirky Cotton Collective share an owner. This column is not an independent review.