[HN Gopher] Gmail, Yahoo announce new 2024 authentication requir...
___________________________________________________________________
Gmail, Yahoo announce new 2024 authentication requirements for bulk
senders
Author : ilamont
Score : 554 points
Date : 2023-10-30 20:07 UTC (1 days ago)
(HTM) web link (blog.google)
(TXT) w3m dump (blog.google)
| ilamont wrote:
| Yahoo:
| https://blog.postmaster.yahooinc.com/post/730172167494483968...
| teruakohatu wrote:
| Most of the spam I get in gmail apparently comes from other gmail
| accounts. Presumably google already filtered out senders
| pretending to be gmail, so I am not sure what a big improvement
| this will be for the average user.
| chimeracoder wrote:
| > Most of the spam I get in gmail apparently comes from other
| gmail accounts.
|
| Are they actually from Gmail accounts, or are they simply
| spoofing the sender? My bet is on the latter, because Google
| has heavy restrictions on Gmail that make it impractical to use
| for sending bulk spam.
|
| > I am not sure what a big improvement this will be for the
| average user.
|
| It's not going to be particularly noticeable for the average
| user, except for the second part (single-click unsubscribe, as
| opposed to a multi-step flow, is slightly stricter than what's
| required by CAN-SPAM). It will probably make Google's work
| easier, though, by having a publicly-known policy of rejecting
| emails without DKIM, as opposed the the status quo of having
| that be merely an open secret.
| andersa wrote:
| Spoofing the sender to show up as gmail.com on gmail.com is
| not possible.
| ericpauley wrote:
| Gmail also has DMARC quarantine enabled. What's more likely,
| that someone broke DMARC or that they stole someone's
| password? My bet is on the latter.
| maybeben wrote:
| The vast majority of spam we get that isn't trivially
| rejected (DMARC, malformed HELO, etc) is from real, actual
| gmail. But they sure do care about _incoming_ spam.
| asddubs wrote:
| I've gotten a few emails from my own gmail account, spoofed,
| which inexplicably did not land in the spam folder. This
| happened to me on multiple different gmail accounts, too.
| benatkin wrote:
| Perhaps they wanted you to see that someone was trying to
| spoof you. They should have a better way of doing that though
| :/
| partiallypro wrote:
| This happens to me all the time, I honestly am not sure this
| measure is going to solve much.
| NullPrefix wrote:
| Click "Mark as spam" and the all mighty machine learning
| might decide that the sender address (your address) is a spam
| sender
| tornato7 wrote:
| I receive a lot of scam emails from Google Docs - ie random
| users 'sharing' Google Docs with me that are either ads or
| viruses or both.
| foobazgt wrote:
| I got one of these once. Google does run spam classifiers for
| docs and you can report them as spam:
| https://support.google.com/drive/answer/13305033
| Loocid wrote:
| Interesting I received a flood of these maybe 6 months ago.
| It never happened before and it never happened again.
| queuebert wrote:
| The majority of my spam is to firstname.lastname@gmail.com,
| because I have a common name. I assume spammers put together a
| list of common names and infer addresses from them. This would
| probably help me a lot.
| preinheimer wrote:
| Yeah, most outgoing sales people these days reach out using
| gmail. No unsubscribe links in any of them.
| zitterbewegung wrote:
| Oh fun so basically no one will be able to setup their own email
| servers by themselves anymore. Antispam is killing the open
| internet now.
| solardev wrote:
| ...and saving email at the same time. It's totally unusable
| without spam filters, and the open models/blacklists don't come
| anywhere close to Gmail's capabilities.
| candiddevmike wrote:
| Ironically, most of my breakthrough spam seems to come from
| @gmail.com addresses...
| solardev wrote:
| Same, but that's because all the other hundreds of pages of
| spam got filtered away already.
|
| I wouldn't be surprised if Gmail spam is higher-effort
| (like those individual SMS spam apps that politicians use)
| but higher-breakthrough.
| supertrope wrote:
| I read years ago a hijacked Gmail account was worth $10
| on a black market while a Yahoo! Email account was worth
| $0.10.
| rurp wrote:
| Perhaps, but it's hard to say. False positives are much more
| harmful than false negatives. I have peronally had Gmail flag
| a number of legit emails as spam, and those are just the ones
| I know about! It's almost certain that I have lost valuable
| messages because I didn't check the spam folder in time.
| These aren't transactional emails either, I'm talking about
| messages from real people that I know personally.
|
| I would be willing to wade through a number of additional
| spam emails to avoid losing important ones but of course this
| is Google so there is no user facing dial to adjust the
| sensitivity. Users just have to trust that Google's
| generalized approach is well calibrated for them.
| solardev wrote:
| I'd take the false positives, personally. If someone really
| needs to reach me and doesn't get to me on the first try,
| they usually just email or text back and go "Hey, did you
| get my email?". Or, just quickly skim through the spam
| folder once a week.
| jghn wrote:
| Unless they _always_ get filtered. Which has happened to
| me before where people wondered why I was ghosting them.
|
| I now skim my spam filter regularly because of this, but
| not everyone realizes they should do this.
| solardev wrote:
| > Which has happened to me before where people wondered
| why I was ghosting them.
|
| Same, but I feel like it's almost kinda socially
| acceptable now. Happens to everyone and it's not
| something to get upset about... "oh, it wasn't me, it
| just went to spam." Like Gmail managed to alter our
| public norms instead of ensuring a zero false-positive
| rate :)
| rurp wrote:
| Sometimes people will reach out again, but that doesn't
| cover all cases. If an old friend/acquaintance/relative
| who I don't regularly talk to reaches out and I miss the
| email they will probably assume I blew them off.
| Scenarios like they will be in the area and asking if I
| want to meet up, or maybe sharing something notable that
| happened to come up.
|
| It sounds like a lot of people here check their spam
| folder regularly, which is good, but I don't know how
| widespread that is. I remember Gmail early on
| deemphasizing the spam folder since, in their view, the
| filtering was so good people didn't need to check it.
| ahoka wrote:
| Most people I know regularly read their spam folders...
| which kinda defeats the purpose.
| solardev wrote:
| It's still faster than manually marking hundreds of spam
| though.
|
| In the spam folder I just scroll down the list as fast as
| I can skim, and then close the tab if there's nothing.
|
| If they were all just in my inbox I'd have to manually
| mark each one (and risk accidentally doing it to a real
| message while going through hundreds of messages).
|
| There's no perfect solution here. Just personal
| preferences. I think I'd prefer a clean inbox with a 1%
| false positive rate vs having to manually flag a bunch of
| missed spam all the time.
| fiddlerwoaroof wrote:
| My personal mailserver works just fine with some rudimentary
| anti-spam measures (mostly manual filter lists).
| muppetman wrote:
| "open models/blacklists don't come anywhere close to Gmail's
| capabilities"
|
| I disagree with you. I use Postfix with rspamd plugged into
| it for my personal email account. I get way more spam to my
| gmail than I do to my personal account, and I sign up to
| everything with my personal account.
|
| rspam also dkim signs my emails when I send them etc,
| verifies SPF/DKIM/DMARC on recipet etc.
|
| Now to counter that - I am a TINY mail server - Probably 100
| emails a day tops.
| solardev wrote:
| FWIW, this would make a great blog post (or Show HN) with
| details!
|
| "I run my own mail server and get better spam results than
| Gmail"
| martin_a wrote:
| I think that's pretty standard for everybody who runs its
| own mail server (like "shared webhosting"-running even).
| Owning your mail should also be standard for everybody in
| tech, you don't want to rely on Google for something that
| important.
| muppetman wrote:
| Exactly. I rely on Google for a number of things, the
| primary thing being photos. But I've read too many horror
| stories (on here) of people losing their Google account
| and thus their life. So all my photos are also backed up
| locally and then into a BackBlaze bucket.
|
| Using Postfix+Rspamd gave me good insight into SPF, DKIM
| and DMARC and how to use them effectively.
| PeterisP wrote:
| I mean, electricity is also very important, but that
| doesn't imply that everybody in tech should be
| configuring their own wiring. It's fine to do that if you
| want to, but it is completely reasonable to expect that
| most people should be able to rely on someone else to do
| the work of ensuring that the key infrastructure runs
| well, and not think about it so that they can focus on
| the specialization they want to handle.
| martin_a wrote:
| We're not talking about running bare metal in your garage
| but paying Hetzner or alike 2,50 Euro/month so you're
| independent from the shenanigans of the automated,
| AI-"improved" systems of Google. That's a fair price to
| pay if you value your electronic communication abilites.
| muppetman wrote:
| It's really just postfix + rspamd.
|
| rspamd is very, very impressive. I guess most of the hard
| work I've put into it is adding some of the not-turned-
| on-by-default things, like Pyzor and Razor. Also adding
| some other RBLs that weren't included by default (I spent
| a lot of time personally researching them and only
| picking ones that I believed to be of high value) The
| other big thing that I think is important is the RBL
| whitelists - DNSWL.org and HostKarma have a whitelist as
| well.
|
| About one a week I spend 10-15 minutes looking at the
| logs of what it's accepted/rejected during the week to
| see if I can spot any obvious mistakes - it's pretty
| rare. If I do spot something I make config changes to
| address it. That said there's been months before where I
| haven't done this and none of the users of my platform
| have complained about spam (or missing email)
|
| rspamd really is that amazing. I don't understand why
| more people don't scream it's praises from the rooftops.
| Anthony-G wrote:
| I suspect it's not that unusual. In six years of running
| my personal mail server, I've received exactly zero spam
| messages with grey-listing as my sole anti-spam measure.
| The only time I got spam was when I had to move my domain
| to a new server and forgot to enable the postgrey
| service.
| megous wrote:
| Any data? Or just "I say so"...
|
| Before I decided to leave it due to its horrendous false
| positive rate, gmail was driving like half of notification
| emails from my servers and mailing lists to spam, despite me
| never marking them as such. I was regularly missing important
| things.
|
| It's much better with just regular client side bogofilter and
| some training on my personal mail/spam archive. And I do zero
| server side filtering, it's just all content based.
|
| I don't care about capabilities, I just want near 0 false
| positive rate on the kind of email I receive (and not some
| common model), even at cost of some false negatives, and
| Gmail doesn't deliver there at all. And I don't want any
| arbitrary 5xx rejections for my senders, since I know how
| annoying that is on the sender side. Gmail will not guarantee
| that.
| solardev wrote:
| No, sorry, it's purely anecdotal. And also more applicable
| to the last few decades, when other email services were
| still terrible, than nowadays with many adequate options.
|
| I think I have the opposite preference to you: false
| positives are OK to me if that means less spam gets
| through. In fact I've seen many of those notifications in
| my gmail spam and thought to myself, "Huh, you know, maybe
| I don't need those that badly after all... I'll just let
| gmail keep it there."
|
| The overwhelming majority of my human contacts use other
| channels anyway (some chat app, or SMS), not email. I might
| get like ten real emails from humans in a year, and even
| then 90% of them are from people already in my contact list
| (and so bypass spam).
|
| Phone calls are similar these days. Google Fi/Android also
| applies a similarly strict spam filter to incoming calls,
| and marks and blocks a lot of them as spam. I check once in
| a while, but overall I just don't really mind. If someone
| really needs to reach me they'll find a way... if they
| don't try, it's a good filter for how important their
| message really is anyway, lol.
| megous wrote:
| I largely communicate with people who contact me for the
| first time (people who use my FOSS projects). Different
| needs, I guess.
| einpoklum wrote:
| email is perfectly usable without _Google_'s spam filters.
|
| And if you use non-GMail email providers, you would know they
| do fine. Not perfect, and of course it differs among
| providers, countries and accounts, but it's generally fine.
| kiwijamo wrote:
| You mean the same Gmail that is responsible for >50% of all
| spam to other providers? They may be good at filtering mail
| from other providers _to_ Gmail accounts, but they are lousy
| when it comes to the other direction i.e., mail out of Gmail
| to other providers. Unless they 're prepared to block their
| own users from sending spam to other providers (or even other
| Gmail users) this initiative won't be of much use.
| pinkgolem wrote:
| using Rspamd i have 0 spam in my private email adress
| account42 wrote:
| > It's totally unusable without spam filters
|
| No it isn't.
| Kye wrote:
| Did we read a different article? DKIM is a simple DNS entry.
| One-click unsubscribe should be standard.
| amluto wrote:
| Also:
|
| > So today, we're introducing new requirements for bulk
| senders -- those who send more than 5,000 messages to Gmail
| addresses in one day
|
| If you run an email server for personal use, you are quite
| unlikely to send more than 5k messages per day.
| pixl97 wrote:
| Heh, I see someone has never had an automation script go
| bad.
| amluto wrote:
| That one time I spammed myself egregiously, I would have
| appreciated a 5k/day limit.
| superkuh wrote:
| It's also standard practice to use self-signed certs with
| mail DKIM. Mail as a protocol has, for the most part, tried
| to stay true to it's federated roots and most things can be
| implemented without dependencies on third party corporations.
|
| I avoided DKIM till 2018 when google started accepting my
| mail but silently sending it to the spam folder; so I
| wouldn't even get a reject message. I thought it'd be to
| onerous to implement but rspamd's dkim signing feature made
| it easy to use with my locally generated self-signed certs
| (and postfix).
| cookiengineer wrote:
| Most people that want to self host their own email server for
| personal use (e.g. on a VPS on their own domain) don't have
| the infrastructure for reverse DNS zones, so I'd argue that
| DMARC and DKIM are kind of pointless because their email
| lands in spam anyways once the PTR query on the IP fails to
| resolve to the same domain because 99% of the time it will be
| something like ipv4.somehosting-company.com
| account42 wrote:
| What bargain bin VPS provider doesn't let you configure
| reverse DNS for your IP?
| chimeracoder wrote:
| > Oh fun so basically no one will be able to setup their own
| email servers by themselves anymore. Antispam is killing the
| open internet now.
|
| It's been a long time since you've been able to set up your own
| email servers without DKIM and expect that your emails will get
| reliably delivered to Gmail users, especially for bulk mail.
|
| The second requirement is more or less already a legal
| requirement in the US, and the third is literally how anti-spam
| has _always_ worked - the only difference is that Google is now
| saying that they 'll publish the threshold publicly, rather
| than keeping it a secret.
|
| This is technically news, but it's hardly a major shift.
| atomicnumber3 wrote:
| This is my impression too. I briefly used emails from a
| domain I own to my gmail account as a way to send myself
| "notifications". My impression was that absolute table stakes
| to even make e-mail deliver work AT ALL were:
|
| - non residential IP (I had to proxy through my VPS) - SPF -
| DKIM - use TLS with a modern cipher
|
| And even with this, I still had to "favorite" (or whatever)
| AND set up a rule to "never send to spam" for my alerts@
| sender address because I would still get them going to spam
| for no reason that I could find - I'd check the message and
| would see that SPF and DKIM PASSED and yet it was still going
| to spam.
|
| I ended up switching to using webhooks to send alerts to a
| discord channel for a server that only had me in it. It works
| fine. It's a lot more surefire than trying to figure out
| email delivery
| abdullahkhalids wrote:
| I have my personal mail hosted on a hetzner server using
| mailinabox. I didn't do anything fancy except whatever
| mailinabox's default config is.
|
| I have no problem with email deliverability to
| gmail/outlook. I think the difference is that my emails are
| two-way communication. I email someone, they email back or
| vice versa. Not a continuous stream of unreplied emails
| from my personal server to some gmail address (which does
| look like spam).
|
| I imagine if you set up a script to reply to these emails
| from your gmail account with lorem ipsum and then deleted
| those replies after a few days, your problems will
| disappear.
| koito17 wrote:
| I rarely get spam in my inbox, if at all, but I also never sign
| up for newsletters nor give airlines, grocery stores, etc. my
| e-mail address.
|
| I get spam messages once in a blue moon on my iPhone
| (specifically, on iMessage, I get recipients with a string of
| random letters ending in gmail.com). Ironically, it's ALWAYS a
| gmail.com or hotmail.com address. Funny how the overwhelming
| majority of spam I can remember comes from Gmail and Outlook,
| both of which love sending everyone else's messages straight
| into the spam tray, despite having DKIM + DMARC set up, static
| IP not on any Spamhaus blocklist, etc.
| 0xbadcafebee wrote:
| I mean... No? You can set up your own mail server all you want,
| it's just that few people will take your mail. Just make
| friends with other people who hate managed mail companies,
| you'll be able to email them just fine.
| sltkr wrote:
| That's too facile. Email was intended as a federated service
| that allows anyone to send mail to anyone. Privileging large
| companies over small companies and individual users is a
| clear violation of that principle, and a danger to the open
| and impartial internet. I get that spam is annoying (I hate
| it too) but letting giant American tech companies decide who
| is allowed to send email and who isn't is not the solution.
|
| Imagine you live in an apartheid state and the people in
| power say: "White people will now refuse mail coming directly
| from black people. If black people want their mail to be
| received, they are required to send it through a trusted
| white liaison. If you're black and you don't like it, just
| make friends with other blacks and the tiny minority of
| whites who will accept mail from undesirables like you."
|
| The above analogy is exaggerated of course, but I think there
| is a fundamental truth for it: large tech companies like
| Google have cornered the market by offering free solutions,
| and now they are imposing an apartheid system where mail sent
| through big companies is given priority over mail sent by
| real people who run their own email system.
|
| (Personally, I've disabled all spam filters in Gmail since
| I've noticed that Gmail is likely to filter out legitimate
| email while the amount of spam I receive is actually very
| low.)
| delfinom wrote:
| Eh, opposite experience, Gmail filters out almost entirely
| spam email for me and extremely rarely legitimate email.
| The filter learns fast in either direction.
|
| I get daily spam coming from Gmail and Azure tenants
| especially.
| 0xbadcafebee wrote:
| Uh, no. SMTP, IMAP and POP3 only became popular as a sort
| of accident, in the midst of a bunch of warring protocols
| and standards, two of which were expected to be the leading
| messaging system, not the current ones. There was never
| some grand plan for internet hippies to all come together
| around "federated" services.
|
| There is no such thing as the open and impartial internet.
| It's a melange of fiefdoms which only works through loose
| agreements between giant providers that tacitly allow all
| kinds of shit to happen in the hopes that they'll recoup
| the cost through their own business plans. The internet is
| quasi-open; open _enough_ at the level that you interact
| with it that it "feels" open, sometimes. And it most
| certainly is not impartial. Competing interests have been
| warring over pieces of the pie for decades, and use
| whatever control they can grasp to make as much money as
| they can, while they can. Nerds running self-hosted servers
| and railing on about the inequities of corporate control on
| forums have absolutely no say.
|
| > I get that spam is annoying (I hate it too) but letting
| giant American tech companies decide who is allowed to send
| email and who isn't is not the solution.
|
| Again, they aren't. They have their own e-mail system, and
| you can use it or not. They aren't telling you you can't
| send your own e-mails or run your own systems. You are just
| upset that they have their own party and won't let you
| choose the music. You could throw your own party, but you
| don't want to do the work that entails, while you do want
| to force the people who _are_ doing the work to do it
| _your_ way, despite everyone else in the world not giving a
| shit and not wanting to deal with the problems anymore.
|
| E-mail is not state sponsored racism. Again, you can choose
| what e-mail provider you use, and run your own mail system,
| and do whatever other asinine navel-gazing techno bullshit
| you want. Nobody is stopping you. They just aren't going to
| accept what you make. That's not oppression, that's called
| competition and free choice.
|
| I'd be curious what you think of the telephone. Was that
| too intended to be some kumbaya international symbol of
| freedom that anyone could do anything they wanted with? Are
| you looking to run your own switchboard, and upset that
| AT&T won't carry your calls without forcing you to pay to
| hook up to their equipment? How dare they be able to reject
| your homemade lines to connect to their customers?
|
| You want to know what actually not having a choice means?
| It means you can't even run your dinky mail server at home
| because the service is deemed illegal. That has not
| happened, and will not happen, because literally nobody
| cares about you and your e-mail service. You are the only
| person who cares about this. You are obsessed with a
| principle for the principle's sake, and the funny thing is,
| that principle isn't even being violated.
|
| You want an end to the "tyrrany"? Use that engineering
| genius to come up with a solution to spam that doesn't
| revolve around IP reputation. Companies around the world
| will gladly take your mail if you can come up with a
| solution that doesn't require them to spend millions to
| mitigate spam.
| hanniabu wrote:
| Think of the children!
| LeonM wrote:
| Why wouldn't you be able to set up your own email server
| anymore?
|
| Yes, you need to configure authentication (DKIM, rDNS and
| preferably DMARC) but you should be doing that anyway, the hard
| requirement doesn't change that.
|
| One-click unsubscribe is required for bulk email, but you
| probably don't want to be sending bulk mail from your self-
| hosted solution anyway.
|
| Anti-spam isn't killing the internet, spammers did.
| chimeracoder wrote:
| This isn't as big of a change as it sounds.
|
| There are three requirements. The first requirement - DKIM - is
| already a _de facto_ must-have when sending emails to avoid
| getting marked as spam. The second is also a legal requirement in
| the US for all commercial email under the CAN-SPAM act[0]. And
| the third is more or less how email delivery has worked for the
| last 20 years or so anyway.
|
| [0] The "one click" and "within two days" parts are a little
| stricter than the bare minimum CAN-SPAM requirements, but not
| much, and they are not difficult for any legitimate sender to
| implement.
| nerdo wrote:
| The one-click part I believe is referring to the unsubscribe
| smtp header.
|
| CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn
| requires recipients to authenticate in order to unsubscribe and
| openly violates the letter and spirit of the law to the point
| scripts are required: https://github.com/chengyin/linkedin-
| unsubscribed
| pixl97 wrote:
| Unsubscription requirements are a pain in the ass in the
| sense that anyone that steals a large list of emails (from
| any service, not yours in this particular case) could now run
| it against your service and unsubscribe a million users
| before you realize what's going on via a botnet.
| TheCycoONE wrote:
| The opaque id is suppose to not be guessable. I does mean
| you can't batch send emails by calling RCPT TO though which
| will hurt bandwidth.
| chimeracoder wrote:
| > CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn
| requires recipients to authenticate in order to unsubscribe
| and openly violates the letter and intent of the law to the
| point scripts are required:
|
| There are several known-bad actors. LinkedIn isn't even the
| worst offender - Amazon is much more brazen, though they get
| less flak for it because the number of violating non-
| transactional emails they send is lower.
|
| Regardless, I stand by my point that this isn't a big shift.
| Google stating publicly that they will penalize people who
| are violating an law that turns 20 years old this year, and
| which has generally been implemented by almost all legitimate
| bulk email providers[0], is not something I'm particularly
| surprised about or worried by.
|
| Again, the first and third bullet points in this press
| release are already _de facto_ policy at Gmail, and have been
| for over a decade. The news is that Google is stating this
| publicly, not that they 're doing something new.
|
| [0] The notable exceptions notwithstanding, it's quite rare
| to find a bulk email sender who violates this, because very
| few legitimate mail providers will allow it, and it's pretty
| difficult to set up your own mail server with decent inbox
| delivery rates.
| corentin88 wrote:
| Agreed. I shared the same view here:
| https://mailmeteor.com/blog/new-gmail-protections
| tiffanyh wrote:
| > _" Gmail's AI-powered defenses stop more than 99.9% of spam,
| phishing and malware from reaching inboxes and block nearly 15
| billion unwanted emails every day."_
|
| This will be a pain for legit use cases but will net to a better
| place for the ecosystem.
|
| Much like strong KYB/KYC for bulk text messaging.
| joering2 wrote:
| You joking right? The amount of text messages spam I receive
| now on Verizon, and some 8 months ago before on T-mobile is
| staggering.
| tiffanyh wrote:
| Are you suggesting that _because_ of stronger KYB /KYC for
| sending bulk, that _increased_ the amount of spam text you
| get?
| 998244353 wrote:
| I think they are suggesting that the stronger KYB/KYC was
| ineffective at reducing the amount of spam.
| supertrope wrote:
| They're cracking down with "10DLC." Mass SMS senders must
| identify themselves, pay a fee, and register each campaign
| including its content.
| ilyt wrote:
| > To help ensure messages you send to Gmail accounts are
| delivered as expected, you should set up either SPF or DKIM for
| your domain.
|
| But spammers already do that, why would enforcing that even help
| ?
| sltkr wrote:
| I think the explanation is a little incomplete, but it makes
| sense if you expand the explanation a bit.
|
| What really happens is this: when GMail receives a lot of email
| from domain xyzzy.com, and a lot of it seems to spam (either
| it's marked spam explicitly by the recipient, or maybe Google
| uses some weird AI or whatever to identify messages as spam)
| then GMail will start marking email from that domain as spam.
| Obviously if you own xyzzy.com and you're not a spammer you
| want to avoid this. So what can you do?
|
| SPF and DKIM are ways to prevent unauthorized senders from
| delivering mail that appears to come from your domain. SPF is a
| way to list IP addresses authorized to deliver mail on your
| behalf, and DKIM contains cryptographic keys needed to sign
| email coming from your main. That means if you have SPF and
| DKIM enabled, the only people able to send mail that appears to
| come from your domain are people that are authorized to do so
| (there are a few more bears on the road, but broadly this is
| true).
|
| It's true that spammers can register their own domains for the
| sole purpose of sending spam, and they can enable SPF and DKIM
| on those too, but if they use domains exclusively to send spam,
| they will still be marked as spam domains by GMail, at least
| eventually.
|
| But this doesn't explain why GMail should be distrustful of
| domains _without_ SPF and DKIM records. There are literally
| hundred of millions DNS records worldwide, and only the tiniest
| minority (think, 1% or less) of those have SPF /DKIM records,
| and not having those records isn't evidence of being a spammer
| per se. But look from the perspective of spammers. If GMail
| adopts the policy that email from rare domains without SPF/DKIM
| records is accepted so long as they don't send high volumes of
| spam, then it's trivial for spammers to collect 100 million
| domains without SPF/DKIM and send literally 1 message from
| each, which results in a 100 million spam messages being
| accepted by GMail.
|
| That's why GMail wants you to add SPF/DKIM records to your
| domain if you're not a spammer. It allows GMail to block email
| from the >99% of domains that don't have SPF/DKIM enabled. And
| for the remaining 1% of domains, it can either delete email
| outright (if it's forbidden by SPF/DKIM), or else it can
| reliably identify a domain as being spammy.
| overstay8930 wrote:
| Doesn't matter to me, if an email doesn't have a one click
| unsubscribe I just mark it as spam. Messes with their email
| reputation so they hopefully get kicked off of reputable email
| services.
| notwhereyouare wrote:
| biglots is horrible about this. I have unsubscribed MULTIPLE
| times and I keep getting emails. Now marked as spam
| kevincox wrote:
| I do exactly the same. I give them one chance to let me
| unsubscribe. If it is more than 2 or 3 clicks I give up and
| mark as spam. If they keep sending I mark as spam.
| LeifCarrotson wrote:
| I honestly don't care about their reputation, I just mark
| anything I don't want as spam. It's easier than finding the
| tiny 8-point link at the bottom and rolling the dice on whether
| their unsubscribe is one click or not. I don't feel obligated
| to protect their shitty business model.
| eastbound wrote:
| I once went to an Atlassian conf and they resold all our
| emails to dodgy people. Or perhaps leaked them over the black
| markets.
|
| Not only I keep receiving almost the same email suggesting to
| buy 5,000 email addresses of Atlassian customers with always
| the same fields, but it's always from different domains.
|
| I didn't think of submitting an Atlassian ticket for each
| spam I receive. That would teach them.
|
| NEVER give your true email to Atlassian.
| tgsovlerkhgsel wrote:
| Same with Blackhat. You can provide a different e-mail on
| your profile... and then they'll still happily pass both
| that and your original sign-up address to any vendor you
| interacted with, and it will be resold so you end up with
| spam from vendors that weren't even there.
| xnx wrote:
| "!" key shortcut to mark as spam in Gmail web interface. I use
| it all the time. If I didn't expect and don't want the email
| you sent, then it is spam, regardless of what fine print I
| clicked through unknowingly at some point.
|
| Would love for an "Unsubscribe Sunday" unofficial holiday to
| catch on to the same degree as "Cyber Monday".
| eastbound wrote:
| Why would you ever unsubscribe? Unless I remember
| subscribing, then this is spam.
|
| I don't ever remember subscribing to anything. Almost all
| email is undesired, apart from password reset emails.
| legitster wrote:
| Unfortunately for us, the Privacy team at our org has
| determined that a one-click unsubscribe link in the body of the
| email is unacceptable (passing an identifier into the URL of
| the link). So we accept either the client unsubscribe link, or
| users who click the unsubscribe link in the email have to
| provide their email address on the unsubscribe page.
| janosdebugs wrote:
| What was the legal reasoning behind this?
| legitster wrote:
| If someone gets forwarded the email and they take action
| based on another person, or erroneously get unsubscribed by
| an email scanning tool, those are no-no events according to
| our lawyers.
|
| Keep in mind our webforms you can put whatever email you
| want in them. But something to do with the fact that we are
| knowingly storing the information and it crosses to another
| system.
| janosdebugs wrote:
| That shouldn't stop you from including such a link in the
| header and keep the non-oneclick link in the footer.
| Nowadays, emails are forwarded embedded, not as EML
| attachments, so the header link wouldn't be included. You
| have to jump through hoops to forward as EML.
| legitster wrote:
| Yes, that's what we do. We have the one-click through the
| client at the top, and the link at the bottom takes you
| to a more robust "preference center" that combines
| preferences from multiple systems (marketing, sales,
| product, etc).
|
| That doesn't stop people from sending in a spate of
| complaint emails every single day. But this is kind of
| the local minimum we have found and no one really wants
| to mess with it at this point.
| jeroenhd wrote:
| That's rather ridiculous. There's a good reason not to put a
| one-click unsubscribe button in the email (email scanners
| will GET every URL you link to check for malware and you end
| up auto-unsubbing your recipients) but emails already
| inherently contain personal information: the email address
| they're directed to.
| albertgoeswoof wrote:
| This might be good news, but as it comes from Google and involves
| email centralisation, I'm sceptical.
|
| At MailPace we already enforce DKIM, it's pretty basic stuff. But
| list-unsubscribe is optional for our senders.
|
| We can make this a requirement and manage lists for senders who
| don't / can't implement a webhook to handle it (we already
| default to blocking resends to emails that hard bounce).
|
| However I am curious how Google will track this. Just because the
| header is set, it doesn't mean it'll do anything. In fact it can
| be used by spammers to identify legit email addresses and spam
| them separately.
| j45 wrote:
| I'm wondering if they see enough gmail traffic receiving such
| an email that maybe they can infer how much funny business
| might be going on?
| pirsquare wrote:
| Why would you allow users to unsub from transactional emails?
| queuebert wrote:
| Because you're not evil?
| albertgoeswoof wrote:
| Because (according to this announcement) if you don't, Google
| will put you in the spam folder.
|
| Edit: I suppose it does say "unsubscribe from _commercial_
| email in one click ". But it's hard to say exactly what they
| mean. They also don't define Bulk Senders - is that the
| domain or the sending SMTP server?
| evangow wrote:
| They defined bulk senders in the 3rd paragraph: "bulk
| senders -- those who send more than 5,000 messages to Gmail
| addresses in one day"
| albertgoeswoof wrote:
| > is that the domain or the sending SMTP server?
| noAnswer wrote:
| Let's hope from what ever comes first, or people will
| start sending from 1.example.com, 2.example.com ...
| rbut wrote:
| I'm having the same thoughts.
|
| On one of my SaaS apps workers receive details on their
| shifts via email. If I allow them to one-click unsubscribe, I
| know there will be many who do so accidentally, with no idea
| how to resubscribe.
|
| Currently they need to sign in and manage their contact
| methods in settings (email, SMS, etc). Thus they know how to
| re-enable it if they disable it.
|
| I can see many support requests from managers saying "X
| worker isn't getting emails". Sigh.
| toomuchtodo wrote:
| I suppose the best you can do is indicate how to re-
| subscribe in the unsubscribe confirmation email and say,
| "you should save this email! Here are alternate channels to
| receive your schedule if needed."
|
| Perhaps you could notify the manager when a user
| unsubscribes? Puts the ball in their court to notify the
| user (their employee) they aren't going to get critical
| emails. Make sure any unsubscribes show up in a log
| available to your customer.
| kvakerok wrote:
| You can simply put two buttons on the email, one for
| unsubscribe, one for re-subscribe. If they unsub by
| accident they can simply pull the last email and re-sub.
| It's not rocket science.
| rbut wrote:
| AFAIK Google shows you an unsubscribe button/link
| separate to the email and performs the POST request to
| your server. There's no option to ask Gmail to show a
| resubscribe button/link.
| wredue wrote:
| Or, send an email saying
|
| "Hey. You unsubscribed. Here's a link to resubscribe if
| you happen to want to!"
|
| Right after someone unsubs.
| albertgoeswoof wrote:
| You could also send them a reminder a few days later,
| just to be sure that they meant it. And then perhaps
| every week or so for good measure.
| reaperman wrote:
| And you could probably take the time to add your weekly
| special deals to that reminder email, in case they might
| see something they like or need.
| janosdebugs wrote:
| That seems to be a bad idea. The new rules state that you
| need to process the unsubscription within 2 days. Sending
| an email a few days later sounds like a good way to make
| it on the naughty list.
| account42 wrote:
| Don't be absurd - those rules are for evil spammers, not
| for your marketing department.
| wredue wrote:
| There's a far cry difference giving someone a
| subscription link at unsub time and spamming resub links.
|
| It's already pretty standard practice to send an email
| notifying that the unsub request was processed.
| TylerE wrote:
| The problem comes, as I know very well, is that when you have
| a common sounding email, all kinds of people use it for all
| kinds of things. I get dozens of transactional emails a week
| from stores multiple states away.
|
| A big part of why I'm stuck on/with gmail is that filtering
| redirects about 90% of those to spam.
| jsnell wrote:
| > A big part of why I'm stuck on/with gmail is that
| filtering redirects about 90% of those to spam.
|
| That doesn't really make sense? If you used an address on
| your own domain, other people would be pretty unlikely to
| enter that email address instead of their own. The problem
| with misaddressed email should be limited to domains with
| really high username density; nobody else than the Gmails
| and Outlooks of the world need to solve the problem because
| nobody else also _has_ the problem.
| TylerE wrote:
| Becaus having used an address personally and
| professionally for close to 20 years, I can't really
| abandon it, and I honestly get way too much important
| stuff to only go I. There once a month or so. If I
| forward all emails to the new address, I get buried under
| the avalanche.
| jsnell wrote:
| Why limit yourself to only either forwarding emails or to
| "check for important emails" once per month?
|
| For example, email clients generally allow you to use
| multiple accounts at the same time. Configure your client
| to read emails from both accounts at the same time, and
| any time an important email arrives at the legacy account
| try to update the sender.
|
| (I mean, I'm sure that xkcd.com/1172 applies, but still
| this seems like an odd thing to be blocked by.)
| TylerE wrote:
| Becaus I don't care enough, really. Email is something I
| use because one is expected to( not because one wants to.
| boneitis wrote:
| IMHO, that sounds like more effort than configuring Emacs
| to map a CPU temperature rise to a Ctrl keypress.
|
| I'd rather begrudgingly keep taking advantage of Google's
| spam filter over adopting the added workflow branch that
| is perceivably likely to trail me for another decade-
| plus.
| avarun wrote:
| Ha, I knew it was gonna be the workflow one!
| taveras wrote:
| Transactional email intended for other people is exactly
| my problem.
|
| My name is common in certain areas, and I consistently
| get transactional email from banks, telecoms, and
| insurance companies around the world.
|
| These businesses do not verify that their customer's
| email is truly their own prior to sending emails.
|
| Framing custom domains as the solution to this problem is
| a bit rash, no?
| jsnell wrote:
| I'm not framing it as a general solution. But _the GP was
| already migrating to a different domain_ and claimed this
| was the main blocker.
| allmadhare wrote:
| Custom domains aren't a panacea, I own my last name as an
| email domain, but my last name is one letter different
| from a building supply company in my country . I
| regularly get purchase orders sent to me instead of them,
| so even in a small country with a custom domain you can't
| escape misaddressed email
| tomjen3 wrote:
| Because its better than me just sending it to the spam box.
| Or worse, not interacting with your service.
|
| At this point something as simple as ordering something
| online means I get 4-7 emails and then some growling "please
| rate us" shit. And if I am stupid enough to do so, but only
| rate it 4 our of 5, another "we are sorry, please tell us
| what we did wrong" email.
| mauriciob wrote:
| Wrong address is one reason. For example, I receive
| transactional emails from a US-based ISP for someone else and
| the only way to unsubscribe is calling their customer service
| line. I'm not even in the same country.
| amalcon wrote:
| I get a number of these for some reason. If they don't let
| me unsubscribe, I just report it as spam. It's not perfect,
| but it's what little I can do.
| whstl wrote:
| I still have a quite short firstname@gmail.com address,
| and those emails were unbearable about 10 years ago.
| Several times, the only alternative was resetting the the
| password and taking over "someone else's" account to then
| change the email to a disposable provider like
| Mailinator.
|
| Hostile? A bit, but after contacting services and
| complaining, nothing would get done anyway.
|
| I ended up changing email providers because of that.
| crazygringo wrote:
| Exactly, seriously -- I get monthly+ e-mails from a gym and
| a car dealership and some golf course because somebody else
| put in my e-mail.
|
| I contacted the customer support for all of them and they
| said they can't do anything about it. To change the
| customer's e-mail address, I need to prove I'm the
| customer, and obviously I have no idea who they are.
|
| So I gave up and implemented a Gmail filter in the end, but
| I definitely wish that parallel with the traditional
| unsubscribe, there was a way to say "this isn't that
| person's e-mail". Where I don't have to prove I'm the
| person, I just have to demonstrate I receive the e-mails.
| ska wrote:
| The best part is when they aren't in a language you
| understand, and the site doesn't have one available.
|
| I have in the past had very good data on how often a
| russian guy got a haircut.
| yard2010 wrote:
| I have that friend that whenever I don't feel like
| putting my own email or phone number I just put his. You
| probably have that friend too, the other way around
| starttoaster wrote:
| Why don't people like you just spend exactly 2 minutes to
| create a bogus gmail (or etc) account for yourself that
| you put down when you don't want to put your own email
| in? I just cannot fathom any reason for you doing this
| that isn't just malice. Surely nobody is just so _lazy_
| that they intend to screw over their friends over a
| minute or two process making an account.
| biggestdummy wrote:
| It's a prank. Meant to be funny. Best when signing up for
| something which might be construed as embarrassing.
|
| I've also done this where I've donated $25 to U of
| California in the name of my friend who went to Stanford
| (rival universities). He's likely still getting calls.
| starttoaster wrote:
| The rival university one seems like a solid prank. The
| user I replied to did not make it sound like the intent
| was to be funny.
|
| > whenever I don't feel like putting my own email or
| phone number I just put his
|
| This sounds more like malice than well thought out humor.
| If I found out someone I knew and respected was using my
| primary contact information for spam emails at <insert
| random pet supply store or random restaurants' rewards
| programs here> I would definitely consider not talking to
| that person much any more. The rival university one
| however I would let slide because the intent from you is
| obviously different.
| thaumasiotes wrote:
| > Why don't people like you just spend exactly 2 minutes
| to create a bogus gmail (or etc) account for yourself
|
| Have you tried doing this recently? Creating an email
| address has become a fairly draconian process.
| starttoaster wrote:
| Yeah, I just made a new google account today. It takes
| about 2 minutes. You need a birth date (easily lied
| about), a phone number (it's google, they have your phone
| number already, no reason to lie) where they will send
| you an 8 digit code for you to confirm, then type in your
| desired email address and your password. Hardly
| draconian. Viola, you have a gmail account. You can do
| more to ensure you're the only one that ever logs into it
| if you like, but chances are if you're setting this
| account up for the purpose we're talking about, you're
| just writing down the email address you set up and then
| forgetting everything else.
|
| I'm not sure, are you implying that it is not worth doing
| this, and you would rather instead just pollute the
| inboxes of people that happen to know you? If so, would
| you like to be friends? I'd be happy to receive your junk
| emails if in exchange I can come by your place and just
| leave my trash in your front yard/driveway.
| gsich wrote:
| Phone number is draconian.
| charcircuit wrote:
| Google doesn't require a phone number if your ip /
| whatever they are doing to profile you has good
| reputation
| starttoaster wrote:
| Not that it's really all that draconian anyway. Tying an
| address to some other piece of verifiable information is
| valuable when they probably have to respond to abuse
| complaints for thousands of gmail addresses every week.
| JoshTriplett wrote:
| If you want an account for legitimate mail, fastmail and
| gandi both make it trivial to add another email alias.
|
| If you want an account for random garbage that demands an
| email address, use mailinator.
| yjftsjthsd-h wrote:
| Why would you do that?
| lobochrome wrote:
| What is wrong with you?
| 3c6bYDXLMj wrote:
| These aren't transactional. An email isn't transactional
| just because the sender has a relationship with the
| recipient.
| crazygringo wrote:
| I think they mostly are -- they're all about reminders
| for upcoming appointments and vehicle checks (the
| dealership), confirmation of bill payment and notices of
| rate rises and holiday hours (the gym), and confirmations
| of tee time reservations or payments or something or
| other with the golf course.
| hunter2_ wrote:
| What definition of transaction relates to a notice about
| holiday hours?
| crazygringo wrote:
| What's your point?
|
| _I 'm_ not sending these.
| csomar wrote:
| This is not a spam problem but a security one. I received
| one guy (from the other side of the world) contracts and
| financial transactions. A mistake in domain name has
| resulted in his ?partner sending this information to me.
| Someone else could have used it. I think the process to
| handle these should a bit more different.
| airstrike wrote:
| Something something the customer is always right?
| tempnow987 wrote:
| So they don't start getting blocked as spam? For
| transactional emails deliverability is often CRITICAL.
|
| Oddly, on the cash app thing, I have a very basic username
| and seem to constantly have folks sending me money, sometimes
| good amounts. I never use the app, and eventually I hope the
| money goes back if I don't collect it.
|
| More annoying on email but much less than it used to be - I
| think more systems require email verification now so a bit
| less common to get the misdirected order emails etc.
|
| But yes, if I can't unsubscribe - then I block and report
| spam - even if it looks like transactional email (some is a
| lead-in to a scam where they will refund you for the "bogus"
| purchase).
| knodi123 wrote:
| I got a really cool vanity email address, back in the early
| days of gmail. But the downside of that is 100s of goofball
| people around the world randomly guessing it when they want
| to put some bullshit value in a field on a web form. The
| worst was when my address got posted to to some indian jobs
| forum, under a title like "test job" - I got dozens of
| applications per hour for a few days. I had to make filters
| to block all email that included the words "bangalore",
| "delhi", or "hyderabad".
|
| Anyway, the job applications have died down, but I still get
| plenty of others for people who are creating accounts. I
| unsubscribe when I can, and "mark spam" when I can't.
| bokkeman wrote:
| This sounds like the Steve Wozniak story from his college
| and early Apple days. He was apparently an inveterate
| prankster, especially phone related. After starting Apple
| and gaining some influence in the tech world, he managed to
| secure a mobile phone with the number (888)888-8888 -
| something he'd desired for years but could only realise
| once the 888 area (mobile) code came into use. Well his
| life became a living hell - he'd receive calls at all
| hours, usually with only rustling or scraping sounds,
| sometimes breathing and the occasional gurgle. The penny
| finally dropped when he heard a stern motherly voice in the
| background of one of these calls shouting: "Put down that
| phone, Jimmy!" He realised that babies all over America
| were picking up push button telephones and hammering the
| most obvious button - the one right in the middle of the
| bottom row... He had to change his number because there was
| no way around this DDOS prank by The Universe.
| iamacyborg wrote:
| You wouldn't, if they're true transactional messages instead
| of poorly veiled marketing ones.
|
| Think of it the same way Canada's anti spam law (CASL) works.
| https://emailkarma.net/2016/09/qa-transactional-emails-
| unsub...
| dmitrygr wrote:
| Perhaps I do not care to receive them? Why does a store allow
| me to say "no receipt please", but you think your
| transactional spam needs to reach me?
| OJFord wrote:
| Because I don't need or want:
|
| - confirmation of my order
|
| - my order has been despatched
|
| - my order is out for delivery
|
| - my order has been delivered to locker
|
| - reminder to collect from locker
|
| - my order has been collected from locker
|
| - feedback on customer support chat experience
|
| - my return label has been generated
|
| - reminder to return my item
|
| - my refund is processing
|
| That's Amazon, in case it's not obvious. I don't need any of
| that by email, I immediately archive it, and if I want to
| know I look in my account, not my email. I even have the app
| installed and notifying me with all of the same and more (I'm
| spared 'x stops away' by email).
| vntok wrote:
| You are evidently in a tiny tiny minority of people with
| very special needs. The vast majority of users want to get
| these notifications, and most want to have them sent by
| email because it is one of the most uniquitous channels
| along with SMS and allows the recipient to "keep living and
| check the message later on when the time is right"
| (contrary to a regular in-app notification).
|
| The vast majority of Amazon customers do not have its app
| installed. And those who do have the app can disable Amazon
| emails or create filters in their own mailbox, it's not
| exactly difficult.
| OJFord wrote:
| > And those who do have the app can disable Amazon emails
|
| No you can't, that is the point that is being discussed.
| michaelmior wrote:
| > Just because the header is set, it doesn't mean it'll do
| anything.
|
| True, but I think when you're processing the volume of email
| that Gmail is, you'll have enough data to be able to infer
| whether the unsubscription was processed.
| rkagerer wrote:
| All it would take is one human to review the email, but sadly
| given Google's aversion to humans in the loop I predict it
| will be inferred by an algorithm and subject to false
| positives with no practical way to escalate for review.
| michaelmior wrote:
| I think it would be pretty challenging to have a human in
| the loop at that scale. Although certainly in would be nice
| if there was a way to escalate.
| WirelessGigabit wrote:
| Side-note: for list-unsubscribe, do you determine the
| subscriber's identity that needs to be unsubscribed based on
| the sender or the receiver (like
| <guid>@unsubscribe.service.com)?
|
| Reason I'm asking is Unsubscribe rarely works for me due to my
| catch-all not SENDING emails from the address it was received
| on. It sends it from my actual address. Very annoying.
| albertgoeswoof wrote:
| The RFC https://www.ietf.org/rfc/rfc2369.txt Section 3.2 is
| not specific on this - but the examples only show the To
| address, and no unique identifier beyond that, so it might
| not work out well for you for mailto list-unsubscribes. It
| also prefers mailto over https.
|
| If we build this as a mandatory feature at MailPace, we'll
| use an HTTPS webhook with a unique identifier for the email,
| so if you unsubscribe from a list sent via us, it will work
| for you.
| WirelessGigabit wrote:
| I believe iOS & Outlook.com only support the mailto:.
| RockRobotRock wrote:
| Addy.io formerly AnonAddy does a good job at that. FastMail
| also.
| CobrastanJorji wrote:
| Why is list-unsubscribe is optional for your senders?
| albertgoeswoof wrote:
| It's transactional email - so generally speaking it's not a
| subscription list that recipients are on per se. This is in
| line with the CAN SPAM guidance (although that is a US law
| it's good guidance to follow globally).
|
| Also it requires senders to actually implement it, which is
| not possible to confirm. Although we could add a catch all
| service that does this automatically, which I think we'll do.
| wl wrote:
| As someone who gets tons of transactional email I didn't
| sign up for (wrong address), please do implement your
| catch-all service and make unsubscribe mechanisms
| mandatory. If I can't stop it, I mark it as the spam it is,
| which can't be great for deliverability.
| liquidgecka wrote:
| Oh lordy this so much this. As a holder of a beloved 5
| character gmail address that is a common first and last
| name let me tell you that the misdirected email I receive
| is insane and countless. Services with an reputable
| unsubscribe get unsubbed and then I moved on. Services
| with no way to unsubscribe get marked spam each and every
| single time. Services that do that are effectively dead
| to me because if they ever do send a legit email gmail
| will automatically flag and remove them for me and I
| can't help but believe (with some insider knowledge) that
| this also impacts deliverability to other gmail accounts.
| JimDabell wrote:
| There's nothing to unsubscribe from if it's transactional
| email. You aren't on a mailing list. You can't be removed
| from a non-existent list you aren't on.
|
| Are you asking to be blacklisted from all future
| transactional email from a particular service? That's
| something very different to being unsubscribed. You're
| asking to be _added_ to a list, permanently.
| wl wrote:
| Most of these transactional messages are associated with
| customer accounts. They absolutely can remove email
| addresses from those accounts. The problem isn't emailed
| receipts from typing in your email address at a brick and
| mortar checkout or "guest" checkout on an online store.
|
| As I was writing this message, Florida Power and Light
| sent me yet another "transactional" message I can't
| unsubscribe from because they're under the mistaken
| impression I'm their customer.
| oxfordmale wrote:
| "Transaction email" reminding you your subscription is up
| for renewal in 16,356 days (and repeat) including tons of
| ads for other products.
| hunter2_ wrote:
| I get tons of messages from otherwise reputable companies
| (household names) that have no "unsubscribe" options
| because they consider the messages required for active
| account holders (and I'm not ready to close my account) but
| the messages certainly aren't triggered by a transaction
| that I'm party to. For example, banks will periodically
| inform me about how I should stay vigilant to avoid fraud,
| and all sorts of similar concepts. Any thoughts on whether
| this type of stuff violates CAN SPAM?
| withinboredom wrote:
| This is the definition of spam. Unsolicited email with no
| way to revoke consent. Your user's recipients should be
| able to revoke consent whenever they feel like it. If they
| can't reply to the email, or unsubscribe, and the only
| choice to revoke consent is to mark an email as spam ...
| you are sending spam.
| vntok wrote:
| No, it is not. You're missing a few key qualifiers that
| will depend on the country but generally include the
| notion of "bulk" email (thus directly excluding
| transactional emails).
|
| A couple examples of such nuancing qualifiers:
|
| - "unless prior permission has been obtained or unless
| there is a pre-existing commercial relationship between
| the parties" (UK)
|
| - "for the purposes of direct marketing" (EU)
|
| You may read this table to get more examples of local
| definitions and the associated regulations, per country:
| https://en.m.wikipedia.org/wiki/Email_spam_legislation_by
| _co...
| withinboredom wrote:
| "thus directly excluding transactional emails"
|
| I'm not excluding transactional emails because to someone
| who doesn't want your email ... it is not transactional.
|
| You are making a bunch of leaps of logic:
|
| 1. The person you are emailing is the same person using
| your service.
|
| 2. The person you are emailing consents to you emailing
| them about your service.
|
| Consent can be withdrawn at any time, it doesn't matter
| if it is "transactional" or not, "legally spam" or not.
| This is just basic human decency and if you cannot follow
| it ... then this is why we need laws, I guess.
| keyle wrote:
| > but as it comes from Google and involves email centralisation
|
| That's my concern as well. Ah well, we'll just mark them as
| arc=pass and sit back and relax.
| Silhouette wrote:
| I'm cautious as well. We all hate the spam and dark patterns,
| and Google is a relatively responsible citizen of the email
| world in my experience so I _hope_ this will be a positive
| step.
|
| However if email blocking becomes too aggressive then it can
| easily result in mails containing information that senders are
| _literally required by law to provide to the recipient_ being
| silently dropped, which essentially means the mail service has
| caused the sender to unknowingly break the law. The penalties
| for not providing required information under consumer
| protection rules can be extremely serious in jurisdictions like
| the EU.
|
| And Joe Random can be a real customer who you are really
| required to provide with information but can still hit the
| "this is spam" button if they don't particularly care or want
| to see it so reading too much into self-reported spam flags is
| a bit of a slippery slope. Combine that with mandating one-
| click unsubscribe but possibly without recognising types of
| emails that again the subscriber literally can't legally not
| send (at least not without sending the same information to the
| same recipient some other way instead) and there could be some
| real danger here.
| wichert wrote:
| > Just because the header is set, it doesn't mean it'll do
| anything
|
| But they can track proxy metrics for this. For example people
| using GMail's builtin unsubscribe feature more than once with
| the same unsubscribe link for different emails is a pretty good
| indicator the unsubscribe did not work.
| mnd999 wrote:
| Yep, just another step towards "we only accept email from Yahoo
| and Microsoft and they only accept mail from us".
| jedberg wrote:
| It's not clear to me how this is any different than before? Most
| of my spam that I actually see already has all those things
| (valid DKIM, one-click unsubscribe link, and a rate limit per
| sender).
|
| If you really want to fix email spam, create a micro-payments
| system. One cent for every email you send, the user has two
| options after they open the email: mark it as spam and keep the
| penny, mark it as legit and give the penny back. If they don't
| act on it within a week you get your penny back.
|
| Legit senders won't be harmed because they will get their pennies
| back, spammers won't be able to afford sending messages anymore.
| The real interesting part would be stuff like LinkedIn
| notifications -- if people find them useful they'd give the penny
| back, but companies would have to decide how many people might
| actually find it useful for their cost analysis.
| theglenn88_ wrote:
| If I had a penny for every legitimate email I marked as spam,
| I'd be a billionaire.
|
| Jokes aside, why wouldn't you just farm pennies by marking all
| emails as spam?
|
| You could say, "well you could detect people that abuse the
| system" - and now the mouse is chasing the cat.
| jedberg wrote:
| Because people would stop sending you email.
| AnthonyMouse wrote:
| The flaw is in giving the penny to the user instead of the
| email provider. If an email provider is claiming everything
| you send them is spam, you stop sending to them, which for a
| real email provider is a problem _if_ you 're sending non-
| spam email their customers actually want.
| butlike wrote:
| You bring up a vaid case. People farming pennies could be an
| issue, but on the other hand, farming pennies is a more noble
| cause, and one that ostensibly seems far easier to catch. I'd
| rather do a lookup to find the outliers who are harvesting
| pennies than to try and cat-and-mouse spammers who are
| masquerading as legitimate senders.
| ahoka wrote:
| You have invented bitcash, the ancestor of bitcoin.
| jedberg wrote:
| Well not exactly. The currency isn't the hard part, it's the
| payment transfer infrastructure that would be hard. If the
| big players all go on board and agreed to one thing we'd be
| off to the races.
| EvanAnderson wrote:
| Hijacking the thread: I do some "bulk" sending for a 501(c)3 I
| volunteer for. I include unsubscribe links that go to a form with
| a submit button (because I want the unsubscribe to be a POST
| request). Each link has a random opaque identifier in the query
| string. Something like:
|
| hxxp://example.com/unsubscribe?id=abcd1234
|
| A couple years ago I noticed that MSFT IPs hitting my unsubscribe
| links with invalid identifiers on the quest string. Anybody ever
| seen that?
| nwienert wrote:
| I thought it was part of CAN SPAM that you can't require a
| second action and that was why the big email sending providers
| moved to that.
| KeepFlying wrote:
| Probably true but how do you handle autodetonation of email
| links in that case? Too many emails servers will click links
| automatically to check for issues.
|
| That was my understanding at least.
| justinator wrote:
| Unsubscribe link goes to a page that has a form that's
| automatically submitted via JavaScript. Disable that for
| the first 5 minutes of that link's life to get around
| automated things.
| EvanAnderson wrote:
| So many email security systems preemptively access every URL
| in messages. I found that I receive a GET for virtually every
| unsubscribe URL I send out.
|
| I don't read clicking a "confirm" button as a second action.
| The attorney didn't either. He also said CAN SPAN doesn't
| apply to a 501(c)3. I still try to comply to be a good
| citizen.
| jabroni_salad wrote:
| You can require a second action such as clicking a button.
|
| What you can't do is take them to a page that says "to
| unsubscribe, send a certified letter to our headquarters and
| wait 90 business days". The entire transaction must be
| completed at the page you link to.
| hnick wrote:
| Or, as I so often get, ask me to log in to "my account".
| Which is not my account, it's someone else's account but
| they don't know their own email address, so logging in is
| probably technically unauthorised access to computer
| systems and highly illegal.
|
| Bonus points when contacting support requires me to log in
| to "my account" too.
| jcrawfordor wrote:
| It's not really common for clicking a link to immediately
| unsubscribe, almost everyone requires you to click a button
| after navigating to the unsubscribe link. Otherwise you have
| issues with link scanners unsubscribing your recipients
| without their knowledge. There are some more complex ways to
| approach this with JavaScript checks for "real browser" but
| IMO these are more likely to create frustrating friction to
| unsubscribing (by not working if the user has an adblocker
| for example) than having the user click a button.
|
| I've seen this pattern of unsubscribe link, then click button
| approved as CAN-SPAM compliant more than once so I don't
| think there's a legal concern. The CAN-SPAM rule seems more
| targeted at the systems you used to see a lot that required
| the user to log into their account, type in their email
| address, or figure out a complicated "communications
| preferences" list to use the unsubscribe form.
|
| check out https://www.ecfr.gov/current/title-16/chapter-I/sub
| chapter-C...
|
| It's a little fuzzy to me how exactly to interpret this but I
| think you could reasonably read it as allowing even
| unsubscribe pages that require you to type your email address
| in again (even though I detest these and don't think the
| problem they're intended to solve is a meaningful one).
| pests wrote:
| > unsubscribe pages that require you to type your email
| address in again
|
| These are fine for me if the email is prepopulated.
| bruckie wrote:
| Google requires senders to use the `List-Unsubscribe-Post`
| and `List-Unsubscribe` headers, which use a POST request to
| avoid this problem.
|
| Details: https://support.google.com/mail/answer/81126#zippy=%
| 2Crequir...
|
| (I work for Google, but on something totally unrelated, and
| don't speak for them or have any inside knowledge. I was just
| curious and looked it up.)
| ClassyJacket wrote:
| Yes, I know I've seen someone talk about this before, I think
| it's their link safety checking thing:
|
| https://techcommunity.microsoft.com/t5/security-compliance-a...
| EvanAnderson wrote:
| It's odd that they're, essentially, fuzzing my app.
| vaporary wrote:
| Agreed, it's curious! I wonder if they would still fuzz it
| if you changed the URL scheme to include the identifier as
| part of the URL path, rather than as a parameter? e.g.,
| hxxp://example.com/unsubscribe/abcd1234
|
| Please report back if you try it :-)
| procflora wrote:
| I could swear I've had that thing burn a one-time token for a
| password reset email before too, but it's hard to prove as a
| user. Doesn't feel great!
| local_crmdgeon wrote:
| You may not have to comply with CAN SPAM legally, but I
| absolutely hate when orgs do this.
|
| Please try to make the world a better place instead of doing
| the legal minimum.
| EvanAnderson wrote:
| What else should I do? The list is double opt-in, every
| message includes a one-click unsubscribe link, full contact
| info for the organization is included, and I send text-only.
| austhrow743 wrote:
| My reading is that in your comment they replied to, you
| said you require confirmation for unsubscription.
|
| One click unsubscription is presumably what they want.
| EvanAnderson wrote:
| I require a button to be clicked to confirm. No entry, no
| JavaScript, nothing else. Just something to make a POST
| request because I receive GET requests for almost every
| URL I send out.
|
| My experience is that every unsubscribe goes to a form w/
| a submit button. Shitty ones make you type your email
| address. (Mine doesn't.)
| austhrow743 wrote:
| I dont have a problem with that but it's definitely a
| second click.
|
| Just did a bit of unsubscribing and sydneytools.com.au,
| abc.net.au, squabblr.co, bundlehunt.com, and
| healingstreams.tv all one click unsubscribe.
| jacobwg wrote:
| I've seen a hybrid where you have a form with a button to
| confirm, but include JavaScript to auto-submit the form
| on load. For the crowd that has JS disabled, they can
| click the button, but otherwise it's one-click from the
| email.
|
| No idea if this holds if/when the email crawler bots
| start executing JS on crawl.
| tomjen3 wrote:
| If you are sending out HTML emails, cant you just make the
| unsubscribe button a submit button in the form?
| EvanAnderson wrote:
| I am sending text-only messages. (I hate HTML email,
| personally.)
| exabrial wrote:
| In a previous life, we prevented the GET url problem by having
| a javascript POST and forward to a secondary URL.
|
| This allows everything to be "one click" (which honestly is a
| good thing) but prevents crawlers from accidentally triggering
| the unsubscribe.
|
| Not sure this still works today and obviously this is not legal
| advice.
| cxr wrote:
| Not an answer to the question they asked.
|
| ---
|
| Okay, HN. Go ahead and explain what's offensive here.
|
| The question that was asked: "I noticed that MSFT IPs hitting
| my unsubscribe links with invalid identifiers on the [query]
| string. Anybody ever seen that?"
|
| The question the parent commenter seems to have hallucinated:
| "Does anyone know how we can keep mail services from
| unsubscribing folks in error when these mail services scan
| our subscribers' emails, _but_ also still offer our
| subscribers 1-click unsubscribe? "
| Ensorceled wrote:
| You could imagine they started their post with "Yes, it's a
| pretty common problem here's what we did ..." and then it
| makes sense.
| cxr wrote:
| No, it doesn't. The original questioner is already aware
| of the extremely common phenomenon where mail providers
| scan links in emails. That's not what the question is
| about. The first comment contains a very specific
| question about something different. The response is
| derailing the discussion.
| Zambyte wrote:
| It seems like the more ideal solution would be to block the
| malicious IPs instead of lowering the accessibility of your
| site, no?
| hnick wrote:
| I think some crawlers run JS, because a lot of the web simply
| won't work without JS to initialise the page state these
| days.
|
| You can use captcha or similar, one workaround I've seen has
| a submit that is hidden so never clicked by real people then
| a visible submit that sets a hidden input and clicks the
| other one which requires the hidden input... not foolproof
| but avoids some accidents.
| 8organicbits wrote:
| A crawler that follows links found in emails and sends POST
| requests / submits forms will cause so much havoc. It could
| buy things, validate account sign-ups, delete data, etc. I
| have a hard time believing the answer isn't to ask users to
| switch to a normal email provider.
| sbuk wrote:
| It'll likely be the URL rewriting feature in Microsoft 365 and
| Outlook.com. The URL will be scanned before it's rewritten.
| yard2010 wrote:
| I've never understood why some emails are ending with :J? I
| thought it was a meme I didn't understand. It turns out it's
| just Outlook doing its thing
| snthd wrote:
| Some versions of outlook autocorrected a smiley to a J in
| the wingdings font.
| mschuster91 wrote:
| It's not just Outlook. Teams is messing that up just as
| well, and so did RiF on Android.
|
| Turns out, dealing with Unicode beyond 2 bytes (i.e.
| anything above ASCII and the common Latin characters) is
| _still_ a problem in 2023.
| ranting-moth wrote:
| I might click an "unsubscribe" link in an email from an org
| that I know. But I'm not going to interact with the page that
| comes up.
|
| If I get another email from that org, I click "report spam".
| jeroenhd wrote:
| Several antivirus scanners and mail providers open links to
| check for malware. I believe they add some randomness to either
| bust through cache or to detect if the URL is encoded as an
| exact match (some exploit kits will redirect to google.com if
| you alter the URL in any way or after x requests to the same
| URL).
| MisterBastahrd wrote:
| Some companies attempt to hit every link in order to cache the
| link and then embed their own link so that they can track those
| links, and also to examine for malware. I work for a marketing
| SaaS and what made us break away from the monolith structure
| was that our server was getting blasted to hell and back by the
| sheer volumes of tracking links that were automatically
| followed by email providers.
| rbut wrote:
| Yes have seen this is in a couple of my SaaS applications.
|
| If it's in the querystring then they essentially fuzz it by
| changing some part(s) of the value. I noticed this because I
| use signed tokens and it raised an exception in Sentry when the
| signed token was invalid.
|
| I ended up moving the signed token into the URL itself and the
| problem went away. eg. /unsubscribe/abcd1234/
| Synchro wrote:
| This is exactly what the list-unsubscribe-post header from
| RFC8058 provides: https://www.rfc-editor.org/rfc/rfc8058. The
| unsubscribe button that gmail, Apple Mail and others displays
| is driven by that; it's not a gmail feature.
|
| Weirdly, if google thinks you're a dodgy sender they won't
| display the button, which seems counterproductive to me.
| pirsquare wrote:
| This is the direct link to the guidelines.
| https://support.google.com/mail/answer/81126
|
| Strange there's no mentioned about transactional emails. Since we
| wouldn't include unsubscribe link for transactional emails.
| cuu508 wrote:
| Depends. I suppose it would not make sense to have
| "unsubscribe" for "reset password" notifications, but for
| "there's a new event in your account, come log in to see it"
| type notifications it would.
| justinator wrote:
| I'm a little unclear how these requirements differ from just
| setting up correct DKIM/SPF records, and having a one-click unsub
| link - or is this all they're saying?
|
| If so, sounds good to me.
| donmcronald wrote:
| That's what it sounds like to me.
|
| The cynic in me thinks it's a prelude to stuff like BIMI
| because that lets them add a large annual cost for anyone that
| wants decent deliverability. It's a way for large senders to
| use their market position to invent a new industry with a
| service we all have to pay for. Free money!
| jeroenhd wrote:
| Does Google even sell BIMI compatible certificates? I don't
| think they're making any money with that protocol.
|
| BIMI does solve some issues with DKIM, so I can see why
| Google prefers it. Requiring what should be a minor fee for
| any company to do bulk email will also make it difficult to
| set up a thousand different spam domains.
| johnklos wrote:
| You mean Yahoo isn't the rotting carcass of the company it once
| was? I see nothing but decay: their abuse addresses don't work,
| nor do any of the addresses they have in WHOIS, either for their
| domains or their networks, that haven't been switched to
| oath.com. Their SOA isn't real. They've basically stopped
| accepting abuse complaints.
|
| Is Marcel Becker, supposedly the "Sr. Dir. Product at Yahoo",
| according to this article, the only person working at Yahoo
| handling email these days? I'm only half joking - Yahoo is
| incredibly unresponsive when it comes to abuse.
| exabrial wrote:
| > Enable easy unsubscription
|
| Does that include the spam I get from Google? Because you guys
| have been sending non CANSPAM compliant emails lately with
| "Account Updates" which are thinly veiled marketting emails.
| Semaphor wrote:
| The only spam I get on my old Gmail account, is some democratic
| party people who think opt in is for chumps. So whenever I check
| that account, I click report spam for all their spam mails. Maybe
| their successor won't be such an ass. One of them recently lost
| his election and I was very happy about that.
|
| Edit: no idea why I only get democratic spam, maybe people with
| my name in the USA too dumb to enter their actual email don't
| like republicans. But I have no acceptance for spammers, no
| matter their politics.
| jabart wrote:
| Right now google allows the SPF domain, and/or the DKIM signing
| domain to be different than the From domain, not just a subdomain
| but an entire different domain. From an ESP perspective, will
| this drop shared SPF(Return-Path) domains? I'm assuming DKIM has
| to match, just not sure about the return-path side. It's a bit
| vague in the support article.
| tempnow987 wrote:
| Does anyone know if this will stop NGP Van emails (seems to be
| dem party platform). I cannot get off their mailing lists - they
| seem to resell the email constantly. I've probably unsubscribed
| from NGP emails 50+ times. It's crazy. How are they not entirely
| blocked?
| joering2 wrote:
| if you mean the email marketing software for political
| campaigns, then yeah sorry you are toasted (your email is) -
| they resell lists and spam everyone into oblivion. Apparently
| (as per Can-SPAM Act) politicians are (obviously) exempt from
| spam practices, so if you are mailing on behalf of politician
| or his campaign, its all wild west no limits and no rules
| apply.
| thiht wrote:
| > It's clear that email has become an essential part of daily
| communication.
|
| Wow, I almost missed that!
|
| Apparently even Google has to start their blog articles with SEO
| crap like this
| killthebuddha wrote:
| If I wanted to learn everything there is to know about email and
| SMS spam/abuse policies, technical best practices, important
| standards, etc, what would be a good strategy? It feels like a
| super important but ridiculously intractable subject.
| adrr wrote:
| Can we add a TTL to marketing emails? Max length is two weeks
| before the email is automatically deleted.
| LinuxBender wrote:
| Some mail providers somewhat support this. Fastmail for example
| allows setting retention limits on each folder including the
| trash and spam folders. One could make a folder for marketing
| and make rules for some of the bulk senders and then just
| keeping adding them as one finds them. Perhaps if enough people
| asked their mail provider they could add a global check-box for
| all the common email campaign providers.
| lostapathy wrote:
| I put together some time-based filtering I use on my own inbox,
| it's awesome.
|
| I like letting most of my email land in my inbox, because I
| don't want to need to check (and purge a bunch of folders). But
| email of declining value will automatically get moved to
| folders after a certain amount of time. for example:
|
| * Monitoring alerts go to trash after 4 hours (if it's still
| broken, I'll get more emails, after all).
|
| * shipping notices from amazon etc go to trash after 3 days
| (long enough for the item to arrive on time)
|
| * Notices from ups/fedex about "your item is arriving today" go
| away after 24 hours
|
| * Marketing I don't mind seeing but has a shelf life - I have 2
| or 3 time intervals setup for those
|
| * Mailing lists I'd like to read (but often don't get back to)
| delete after 2 weeks
|
| * Utility bills move to a folder for utility bills after 24
| hours
|
| etc. It's awesome - but oddly enough, nobody I ever tell about
| it gets that excited.
| einpoklum wrote:
| Regardless of this specific policy change/tweak:
|
| We should all stop using email providers who are known to
| massively compromise our privacy, build profiles of our online
| activities, manipulate us through ads, pass lots (or all)
| information to the government, and consolidate ownership of too
| much of Internet communications and activity.
|
| Specifically, we should stop using GMail (and Yahoo), and
| encourage our friends to leave that email service as well. There
| are plenty of fine alternatives.
| Sytten wrote:
| Does this apply to all emails including transactional? What I am
| supposed to do if a user requests a password reset but
| unsubscribed from our emails? Most of the spam I received these
| days is from gmail addresses these days.
| evangow wrote:
| This is a great question. I would love to see more
| documentation on what this means for transactional emails.
|
| Adding systems in place to handle unsubscribing from
| transactional emails will mean quite a bit of engineering
| time/effort for many companies.
| tgsovlerkhgsel wrote:
| > we'll enforce a clear spam rate threshold that senders must
| stay under
|
| I hope they make it really strict. I'm sick of companies that
| send you spam ("newsletters") just because you interacted with
| them once, then when you unsubscribe, you get unsubscribed from
| that one list, so they keep spamming you just with a slightly
| different newsletter type. (Edit: Also, everything requiring a
| notification - by e-mail if they couldn't get me to install their
| app - just to get me to engage with their site.)
|
| Once such behavior has the potential of landing your entire
| domain in the spam folder, maybe they'll be more careful.
|
| Edit: For example, I can't imagine LinkedIn being able to pull of
| their "phish people, steal their address book, spam each contact
| _three times_ with no opt-out " bullshit for so long if strict
| spam thresholds were in place.
| 3c6bYDXLMj wrote:
| What do you mean? There's a huge difference between "Product
| Spotlight" and "Best Deals" /s
| sleepyhead wrote:
| This is exactly why GDPR exists. What you are describing is
| illegal in the EU. Sending marketing communication requires
| clear opt in consent.
| SOLAR_FIELDS wrote:
| I just had this experience today. The problem is that at
| least in the States the regulation is ambiguous enough to be
| abused to hell and back. Unsubscribe in the States could mean
| "Unsubscribe from all" or "Unsubscribe from 1 of 20" or it
| could mean "unsubscribe from all now, but we will arbitrarily
| resign you up for some new newsletter whenever we feel like
| it". I got a spam email today from some no name dropshipper I
| bought contacts from probably a decade ago, I got LASIK 3
| years ago and haven't needed contacts since.
|
| Some large companies even flagrantly violate the extremely
| lax rules that exist in the States. Guitar Center has
| infamously been sending me emails that are in direct
| violation of the one click unsubscribe regulations for almost
| a decade now. I can't even sign in to the account to cancel
| the emails (which is in direct violation of the regulation-
| it is ambiguous on a lot of things but the one thing that it
| isn't is that you aren't supposed to be required to log in to
| opt out of email communications) because it was made with my
| dad's email from 20 years ago yet I'm the recipient of the
| spam.
|
| I did report them; but of course nothing must have happened
| because they are still doing it.
| vintermann wrote:
| > unsubscribe from all now, but we will arbitrarily resign
| you up for some new newsletter whenever we feel like it
|
| The LinkedIn way.
| jupp0r wrote:
| Are you sure? I don't have more than anecdotal data, but I
| remember unsubscribing from EU newsletters to be much more
| cumbersome than from US ones.
| OJFord wrote:
| If it's at all difficult just reply saying something with
| the 'GDPR' keyword and they'll hop on it.
|
| A few times I've had unsubscribe links absent or not
| working for whatever reason and done that and a human's
| replied and sorted it out.
| carstenhag wrote:
| I was recently subscribed to ~500 newsletters within 10
| minutes, and the most annoying ones to unsubscribe where
| from Brasil, US, India, etc.
|
| (An attacker used the paypal guest account feature and used
| my IBAN [european bank account number] and tried to hide
| the mail within those hundreds of mails. They were
| successful for some days, until the purchase showed up on
| my bank account)
| sleepyhead wrote:
| What do you mean, how is there a difference between
| unsubscribing a newsletter from a EU company than a US
| company?
| queuebert wrote:
| This is my experience as well. US emails are one-click
| unsubscribe almost without fail, while EU and AU especially
| require multiple clicks and often entering my email address
| to unsub. Extremely annoying.
| squeaky-clean wrote:
| I don't know the legality of this in the EU but often it is
| required that you opt-in to these marketing emails to create
| an account or do other basic things on a website.
|
| And then there's those online stores that cover the entire
| page in a popup that you can get a 20% discount code if you
| give your email. Technically I've opted into their marketing.
| But I always just use the coupon and then report the email as
| spam without bothering to unsubscribe.
| sleepyhead wrote:
| If you need to opt-in to create an account then it is
| illegal. Yes the discount code for newsletter signup is a
| result of GDPR consent requirement along with growth
| hacking technique popularity that is incredibly annoying.
| EGreg wrote:
| Referring people by email to the site!
| oefrha wrote:
| > There is simply no easy way for your users to legally
| invite their own friends to your site, so it can never
| reach critical mass.
|
| Referring friends and family by sending emails on your own?
| Who the fuck does that since ~2010? Ever heard of social
| media and instant messengers?
|
| Edit: Parent was a wall of text when I responded. Stealth
| editing it to something completely different is not cool.
| EGreg wrote:
| It covers instant messengers too. You need to obtain the
| consent of the person receiving the message, before
| prefilling the message with the URL and text for their
| FRIEND to send them. Sorry buddy. That road is closed for
| you too!
|
| Social media MAY be an exception, but that's because
| people are already used to receiving a ton of spam on it,
| so your "viral post" will be ineffective to begin with,
| and probably filtered by Facebook and not shown to most
| people at all. Enjoy.
|
| All the original social platforms such as Facebook and
| Twitter used ways to invite others by email (famously in
| Harvard etc.) So now they are burning the bridges behind
| them and no one can do it anymore.
| lopis wrote:
| Even European Websites do this. I know that in principle I
| never check the "I want to receive spam" but I still do and
| still have to unsubscribe later.
| sleepyhead wrote:
| Report them to your local DPA. I do not see this so often
| with big companies but every growth hacking startup send
| newsletters without consent.
| switch007 wrote:
| And regularly occurs
|
| Also there are separate email marketing laws.
| sph wrote:
| If I'm certain I don't know the company, or I know the company
| but there is no unsubscribe button, it goes straight to Spam,
| no questions asked.
|
| A decade ago I went to my country's embassy to renew my
| passport, and they now use my email to subscribe me to the
| newsletters of any new political party. All unsubscribe links
| just 404s. Shameful behaviour.
|
| Anything I receive from any of their political candidates goes
| straight to spam now. The hope is that I am training the spam
| filter so it marks those as spam for all other users as well.
|
| It's simple really: have clearly visible, working unsubscribe
| link _in the body of the email_ that doesn 't require jumping
| through hoops, and be from a company I know and use. Otherwise
| the spam filter learns about it.
| figassis wrote:
| There's worse. An unsubscribe link that asks you to submit
| your email. Few things anger me more, because they went
| through the trouble of pretending to comply, and a decision
| was made to make my day more difficult.
| kijin wrote:
| That exists for a reason, and it's not nefarious at all.
|
| Lot of people, especially of the older generation, forward
| all sorts of emails to their friends and family every day.
| If one person who received a forwarded email doesn't like
| it and clicks the unsubscribe link, the original recipient
| (who clearly likes the email enough to forward it around)
| gets unsubscribed. That's a bug. If you don't like the
| unfunny newsletter your uncle keeps forwarding you, that's
| a problem between you and your uncle, not between your
| uncle and his newsletter!
|
| The email submission form exists to ensure that the person
| unsubscribing is the person who is actually on the mailing
| list. It will not prevent an annoyed nephew from
| deliberately unsubscribing the original recipient, but it
| will prevent most cases of mistake by third parties.
|
| Similarly, many unsubscribe links require two clicks
| instead of one, because some email services used to
| automatically check out every link they found in the body
| of an email. A one-click link would unsubscribe everyone
| before they even saw the email. Nowadays we have better
| protocols and better email scanners, but old industry
| habits die hard.
| jack1243star wrote:
| There is no "mistake" in wanting to unsubscribe from a
| mail list. This is just dark pattern to increase
| friction, whatever scenario they try to come up to
| justify.
| mlyle wrote:
| I share your frustration, but there is no evidence that
| you read the comment you're replying to.
|
| That comment explains that there's a scenario where
| people can be accidentally unsubscribed in the presence
| of mail forwarding, and the requirement to enter an email
| address can patch over this.
| eru wrote:
| Well, you could still pre-fill that field.
| jack1243star wrote:
| Upon re-reading the comment, I understand the scenario
| now. Thanks for clarifying.
|
| Thankfully I don't have people forwarding emails to me
| outside of work...
| robocat wrote:
| I think you are mostly wrong. OP is complaining they
| sometimes have to enter their email address - that is
| absolutely unnecessary make-work.
|
| The page can prompt the email address, and have a simple
| unsubscribe button. Not perfect, but okay.
|
| Even better, one-click unsubscribe features (e.g. Gmail's
| App) are presumably set up to work for the current
| recipient (not the original sender) so the problem is
| resolved for anyone using an email client with inbuilt
| unsubscribe.
|
| The forwarding problem is only for html link unsubscribe.
| Personally I hate trying to play find-the-ubsubscribe-
| link, so I use the email client feature where possible
| (which also helps Gmail rate/flag spam).
|
| Mostly I haven't had problems with repeat spammers,
| except a republican politician (I'm not in the USA so
| doubly annoying).
| kijin wrote:
| Not everyone uses Gmail or a modern email client that
| understands the one-click List-Unsubscribe protocol, so
| senders must include an HTML unsubscribe link in the body
| of the email in order to comply with relevant rules in
| all jurisdictions. That link, unfortunately, can fall
| prey to the shenanigans I mentioned above.
|
| I understand the parent's sentiment because we all want
| to unsubscribe from unwanted emails. But technical
| standards can't distinguish unwanted emails from
| business-critical emails. You could legitimately cause
| someone damages by silently unsubscribing them from an
| important news feed. (Imagine that you silently
| unsubscribed an open-source maintainer from all github
| notifications!) Even worse, this kind of vulnerability
| disproportionately affects senders who try to follow the
| rules and make it easier for people to unsubscribe.
| Spammers don't care and keep spammin'.
|
| Ideally, an email would have _both_ a one-click List-
| Unsubscribe header _and_ an HTML unsubscribe link in the
| body. The latter need not be one-click, and in fact, if
| it 's anything remotely important, should not be.
| cuu508 wrote:
| > Imagine that you silently unsubscribed an open-source
| maintainer from all github notifications!)
|
| Do open-source maintainers forward around their
| unsubscribe links in practice?
|
| The other problem with email scanners clicking links
| automatically can be solved without prompting for the
| email address. One simple solution is: if the link is
| clicked within a minute or so after sending the email
| there's a chance the clicker is an automated system.
| Instead of unsubscribing right away, serve a HTTP POST
| form with a single "Confirm Unsubscribe" button. Normal
| users will rarely see the form, automated systems will
| hesitate to fire off HTTP POST requests.
| account42 wrote:
| > The latter need not be one-click, and in fact, if it's
| anything remotely important, should not be.
|
| It absolutely should be one-click.
| gumby wrote:
| > Mostly I haven't had problems with repeat spammers,
| except a republican politician (I'm not in the USA so
| doubly annoying).
|
| I'm a republican (also not in the US sense -- I want to
| get rid of the tie to the monarchy) but I also find that
| republican politicians seem to be really annoying!
| tempestn wrote:
| They could perhaps pre-fill the email as a middle ground.
| kijin wrote:
| Many websites actually do this. It significantly weakens
| the defense against the forwarding problem because people
| will blindly click submit. But IMO it's an acceptable
| compromise for anything not business-critical.
|
| Some people have come up with a trick to hide the
| unsubscribe link with CSS when it is inside a
| <blockquote> tag, as in a forwarded email. It doesn't
| work reliably, though. HTML email is still stuck in the
| 90s, it's impossible to do anything fancy inside of it.
| Much easier to send the user to a real web page for an
| actual transaction.
| tppiotrowski wrote:
| Also needing to log in before you can unsubscribe.
| incompatible wrote:
| Especially if your account is no longer accessible; a
| problem I had with Uber after changing my phone number.
| Bombarded with "Uber Eats" spam and no way to unsubscribe
| without going through some kind of ridiculous process to
| reactivate the account.
| kevin_thibedeau wrote:
| I have that problem with a former utility company that
| keeps sending updates about the business that I've
| unsubscribed from multiple times. The one that irks me
| the most is TP-Link Kasa who has a marketing opt-out in
| the account creation flow and they _still_ send
| repetitive spam without honoring the unsubscribe link.
| mbesto wrote:
| IIRC, CAN-SPAM explicitly says the unsubscribe button
| needs to be available without logging in. So this would
| be a violation.
| RF_Savage wrote:
| So, who do you contact about that violation?
| autoexec wrote:
| Here you go: https://www.justice.gov/action-
| center/report-spam
|
| You can probably guess how effective that is. In
| practice, unless you can get the FTC or a state attorney
| general to sue an actual company for you, nothing will
| ever come of it.
| mrWiz wrote:
| I report spam that I'm unable to unsubscribe from to the
| FTC via their online page[0]. I've never gotten any
| response but it does _seem_ to work. I 've been dropped
| from several marketing lists after reporting them to the
| FTC, and it's unlikely that these marketers decided on
| their own to remove me from their lists.
|
| [0] https://reportfraud.ftc.gov/#/
| account42 wrote:
| Or needing to enable javascript to unsubscribe.
| nirvdrum wrote:
| Hulu did (does?) this and the form rejected my email
| address as invalid because the domain portion had three
| parts to it. Of course, they were able to continue sending
| me emails so some system knew it was valid. It was likely a
| bad assumption an engineer made somewhere, but all the more
| reason to use unsubscribe links that are already tied to
| the email address.
| ACow_Adonis wrote:
| i can't be the only oldskool person on hacker news who knows
| not to click on unsubscribe buttons because it just identifies
| you as a legitimate email/mark...
|
| these are spammers, not cases where you ever actually signed up
| to some kind of legitimate newsletter or discussion group. to
| pretend good faith is your first mistake...
| somehnguy wrote:
| That's the case for spam sent by illegitimate parties (actual
| spammers), but any real company (what OP is referring to)
| will respect the unsubscribe button because they're at risk
| of being sued otherwise. Clicking unsubscribe in those cases
| actually does work & doesn't put you at risk of anything.
| kevin_thibedeau wrote:
| I get spam from legitimate companies who don't honor the
| unsubscribe links. The problem is that many of them use
| third-party services to handle the unsubscription server so
| you're feeding the data broker ecosystem with confirmation
| that you're an active address.
| withinboredom wrote:
| This is an irrational reason. When you click "mark as
| spam" the sender can configure the email so your email
| provider notifies them that you marked it as spam. (See
| email feedback loop).
|
| https://en.m.wikipedia.org/wiki/Feedback_loop_(email)
|
| Further, pixels can be embedded in the email so they can
| see when you open the email and how many times.
|
| The sender has every incentive to properly handle
| unsubscribe to avoid spam traps. If you get big enough,
| users WILL come sign up for your service with a known
| spam trap email. If your operations are as sloppy as
| you're suggesting, your email sending capabilities go
| poof.
| greyface- wrote:
| > they're at risk of being sued
|
| I think this risk is overstated. Individual spam recipients
| in the United States have no standing to sue under CAN-
| SPAM; only the FTC does, and there's a high bar to get
| their attention.
| ACow_Adonis wrote:
| I find the venn diagram of spammers and "legitimate"
| companies increasingly overlaps and it's impossible to
| cleanly differentiate the two.
|
| my university spams me. i bought a torch from olight. they
| spam me. i get food deliveries. they spam me. i bought some
| tech. they spam me. i look for real estate they spam me. i
| get a delivery. they spam me.
|
| it's differentiating between the two that's unrealistic.
| glenngillen wrote:
| I don't think this is a legitimate concern any more. There's
| basically zero value in "confirming" an email address is
| legitimate. Between all of the data breaches and various
| other ways to get actual email addresses this isn't a
| problem. It's also so cheap to send email there isn't an
| operational cost where you need to optimise for sending only
| to know addresses.
|
| There is definitely a punitive cost for sending emails that
| are repeatedly marked as spam though. You also can't just
| cycle IPs because a brand new IP with zero sender reputation
| is treated with almost as much suspicion by the big player as
| one that is known to be a spammer.
|
| It's much better to give people an option to opt out, and to
| honour it. Most of the email sending providers (e.g.,
| SendGrid, mailchimp, etc) force you to include the link and
| automatically block future sending to that address. Some will
| even provide you the option to provide a reason, where you
| can specify "I did not sign up for this" which in sufficient
| number will flag the sender account. I suspect the vast
| majority of cases where people unsubscribe but continue to
| get email is actually some incompetence from not having
| multiple disparate email systems sync back to a shared do not
| contact list (rather each system is maintaining its own).
|
| Click the unsubscribe button.
| ACow_Adonis wrote:
| there's a line in the movie the incredibles where robert
| (the hero) is meeting with the designer (edna) of super
| suits to design him a new suit even though such activities
| are technically illegal.
|
| The dialogue goes something like this:
|
| robert: you know I'm retired from hero work.
|
| Edna:As am I, Robert, yet here we are.
|
| so now it's 2023. you're telling me it's now safe to click
| on unsubscribe to the spam emails.
|
| yet here we are.
|
| no, the strait forward response is to ignore and mark as
| spam any unsolicited emails you did not explicitly sign up
| for. don't try to interact through the desired or expected
| channels of any entity that spams you.
| withinboredom wrote:
| When you mark an email as spam, the mailing service
| emails the sender along with all the original headers.
| See https://en.m.wikipedia.org/wiki/Feedback_loop_(email)
|
| Your reasons are not actually rational.
| ACow_Adonis wrote:
| surely this depends on the actual mail provider you use.
|
| i appreciate its impossible to prove a negative (everyone
| could be doing something they have no evidence or
| documentation of doing), but given my mail provider both
| says that you have to mark a selection before they'll
| share such information with partners and that marking
| emails as spam still trains your own user specific spam
| filter, i don't think (and an really hoping) this is not
| a universal thing.
| withinboredom wrote:
| It's universal as far as I know.
|
| I worked on an email system that sent billions of emails
| a month. We used these messages from providers to ensure
| we never sent them an email again to prevent hurting our
| reputation. (Marking an email as spam, is by itself, a
| very low signal on reputation, unless some massive % of
| recipients mark it as spam. Sending an email to someone
| who has already indicated you are sending them spam is a
| high signal that you're sending spam, however).
|
| It doesn't even matter when you do it. We had people
| (outliers) who would go back and hit every single email
| we sent them for the last 6 years as spam, after a bad
| customer service interaction, not getting a refund, or
| whatever pissed them off. We actually investigated all
| outliers. Most people didn't report spam on anything
| older than 6 months.
| queuebert wrote:
| PINE used to have a Bounce command that was great for faking
| an invalid email address.
| cryptoegorophy wrote:
| I wish Apple Hide My Email features existed 20 years ago. Any
| new signup now is I use hide my email.
| nvr219 wrote:
| I use fastmail masked email (which is basically the same
| thing) with the firefox plugin. I love it.
| kevin_thibedeau wrote:
| It gets better when you have your own domain and you can
| register with throwaways using spamco@mydomain.
| aqfamnzc wrote:
| I've started doing this about a year ago, but I haven't
| nailed down an easy way to blacklist addresses from my
| catch-all. Do you know of a painless way to do that?
| JoshTriplett wrote:
| Don't use a catch-all. List specific allowed addresses,
| and remove them (after reporting) if they become spam
| sources.
| jackson1442 wrote:
| In fastmail, rules for specific addresses take priority
| over catchalls. So if I have a catchall and tell it to
| bounce emails to spamco@, the bounce rule applies
| properly.
| Phelinofist wrote:
| I share my domain with my parents, so I use
| my_name@XXX.my_domain.tld instead, whereas XXX is
| replaced by the service I sub to. That gets routed to my
| inbox and I have some server rules that sort them in sub-
| dirs.
|
| For more shady stuff I have some throwaway mail at some
| free mail provider.
| jimbobimbo wrote:
| What is the add on name?
| dclowd9901 wrote:
| What do you do about accounts where you need to log in on
| different devices? This is where I end up leaving it at the
| door.
| pests wrote:
| NextDoor is the absolute fucking worst with this. They sign you
| up to 10+ lists each in over 9+ categories that results in what
| feels like 100 different "notification types".
|
| Unsubscribing from an email just unsubscribes from that one
| list. They don't show any other lists or categories (or imply
| there are more) during this process.
|
| Once you login you are greeted with a multi-page disaster to
| manually untoggle each of the near 100 list types.
|
| Then when they add new notifications it is auto-on for
| everyone.
| appplication wrote:
| Yes I ran into this the other day when I tried Nextdoor out
| for the first time. I was actually so in awe of the insane
| and sociopathic dark pattern that is their email/notification
| subscription system that I immediately deleted the app. I
| don't want to be a user on a platform that treats its users
| with so little respect.
| a_wild_dandan wrote:
| I did the exact same thing a few days ago. I thought
| NextDoor would be social media that connects me with my
| local community. Nope. It's overwhelmingly "recommend me
| someone for <service>", camera footage of shady people or
| crime reports, and complaints about neighbors. The
| excessive emails were the final straw that took me from
| indifference to actively excising NextDoor from my phone.
|
| So if anyone has ideas for connecting with your local
| community, I'm still looking...
| 4ndrewl wrote:
| We just have a WhatsApp group...
| pests wrote:
| > camera footage of shady people or crime reports
|
| Which are usually just black people existing or generic
| "people walking by my house" reports.
| gumby wrote:
| > I was actually so in awe of the insane and sociopathic
| dark pattern that is their email/notification subscription
| system...
|
| At least it's on brand. Once you start reading you will be
| so in awe of the insane and sociopathic people who do the
| bulk of the posting.
| vintermann wrote:
| Another for the hall of shame: MyHeritage. They will never,
| ever stop spamming you if they get your email. Set your
| language to Chinese and delete your account, now they will
| spam you in Chinese.
|
| The special award though, must go to Wal-mart. That company
| doesn't exist in my country. I obviously never interacted
| with them in any way. I still get their "newsletter", and
| sure enough, it's authenticated to come from their domain.
| josephg wrote:
| Why do you bother fighting to unsubscribe properly with a
| company like that? I have a rule: I will try 1 time to
| legitimately unsubscribe, using the normal flow. If you keep
| sending me email after that, I will mark every email you send
| as spam and my email provider will stop delivering your mail.
|
| I started doing this years ago after watching a talk by some
| Gmail devs on how they think of spam. They said they
| internally - controversially - redefined spam to be any email
| the user doesn't want to receive. Well guess what? I don't
| want to receive shitty marketing emails after I unsubscribe.
| If you send them to me, I'll get you listed as a spammer.
|
| I encourage everyone else to do the same thing. Life is too
| short to put up with this crap.
| pests wrote:
| I was taking a low-effort apporch of just unsubscribing
| from emails and newsletters as they came in. I saw a huge
| decrease in unwanted emails at first but NextDoor kept
| coming _no matter what_. Finnally in frustration I logged
| in, did half the above unsubscribing, then just deleted my
| account instead. I agree.
| babypuncher wrote:
| This should be illegal
| bruckie wrote:
| > I hope they make it really strict.
|
| The threshold is "spam rates reported in Postmaster Tools below
| 0.3%".
|
| That sounds pretty low to me, but I'm not in the bulk email
| business. I guess maybe a very small number of users actually
| report spam? Or maybe Google is being strict.
|
| Source:
| https://support.google.com/mail/answer/81126#zippy=%2Crequir...
|
| (I work for Google, but on something totally unrelated, and
| don't speak for them or have any inside knowledge.)
| Synchro wrote:
| One of the key problems is that both gmail and Yahoo UIs
| actively encourage users to report messages as spam rather
| than unsubscribing. Yahoo is particularly bad at this; it's
| common for me to receive spam reports from yahoo on an
| entirely double-opt-in social site I run. My reaction there
| is to remove the reporter from all lists because the amount
| of damage a single spam report can do is immense; a single
| spam report can block delivery for weeks at a time to the 10k
| others that legitimately requested messages.
| Hotmail/outlook/live is much the same in encouraging spam
| reporting over unsubscribe, however, their penalties are not
| as excessive as Yahoo's.
| everforward wrote:
| > One of the key problems is that both gmail and Yahoo UIs
| actively encourage users to report messages as spam rather
| than unsubscribing.
|
| I think this is, generally, the correct approach. There
| isn't really a salient reason to discriminate between
| "email I don't want from someone I don't know" ("true
| spam", if you will), and "email I don't want from someone I
| do know" (aggressive newsletter campaigns et al). Spam is
| the button to send a signal that you got an email you
| didn't want.
|
| > My reaction there is to remove the reporter from all
| lists because the amount of damage a single spam report can
| do is immense; a single spam report can block delivery for
| weeks at a time to the 10k others that legitimately
| requested messages.
|
| This is the system working as intended to me, as the
| customer of the email service. I like that my email
| provider is throwing their weight around to put the fear of
| God into bulk senders and forcing them to think about how
| this campaign will impact their sendability. I would much
| rather annoy the hell out of bulk senders than cede emails
| to spammers like we have with phones.
| tgsovlerkhgsel wrote:
| There is one case where differentiating makes sense:
| Sometimes users sign up for newsletters, want the
| newsletters, would re-confirm if asked... and later
| change their mind and no longer want those newsletters.
| Here, marking as spam is unreasonable.
|
| In most other cases (e.g. newsletters sent based on a
| tiny pre-checked checkbox or without asking for consent),
| the spam button is of course the right tool.
| tgsovlerkhgsel wrote:
| > My reaction there is to remove the reporter from all
| lists because the amount of damage a single spam report can
| do is immense
|
| Sounds like it's working as intended.
| ihaveajob wrote:
| The worst offenders are those without a link to unsubscribe,
| and who instead ask you to "reply unsubscribe", which happily
| for them is also a signal to the email provider that you've
| interacted with them and therefore are not spam.
| geek_at wrote:
| Just a perspective from the other side of the coin: I host
| various services for schools like online registration for
| parent - teacher conferences. When the platform is live
| hundreds of parents are logging in, choosing their appointments
| and have to confirm them via email (only one email per person
| not per appointment)
|
| And Yahoo is the Single worst email service to send to. I have
| correctly configured sfp, dmarc, dkim, reverse dns for the
| Mailserver and have tested the wording with multiple mail
| testing services to make sure it doesn't have keywords that get
| automatically flagged.
|
| And yet after like 50 emails to parents with yahoo email
| addresses they are giving me errors because of "unusual volume
| of emails from your domain"
|
| There is no form, no human to talk to and they just block you.
|
| Angry parents come to me or course because they never redeived
| the activation link so I had to put up a disclaimer stating
| that if they should not use a yahoo email address if they have
| a different one
| Phelinofist wrote:
| Why confirm via mail at all?
| justoreply wrote:
| maybe to confirm that the email is valid?
| geek_at wrote:
| Correct! With schools and students there is always
| incentive for shenanigans. If I didn't test for emails
| they could just book-block all teachers.
|
| There would be other ways to clog the system using
| trashmail providers but thankfully no student cared
| enough for that yet
| carstenhag wrote:
| This is a requirement in some jurisdictions (double opt in)
| for some cases. Not sure about "User has a confirmed email
| + account at our service, he wants to sign up for a
| reminder" use case though.
| denton-scratch wrote:
| "Double opt-in"is a spammer term for what normal folk
| refer to as "confirmed opt-in".
| zo1 wrote:
| I seriously don't get why we can't have some sort of
| licensing authority for this type of thing. Maybe they issue
| you a secret key to include in email headers, or put your
| entire domain on some sort of whitelist. And complaints get
| handled by a human to confirm that it's not a "oh I don't
| like this, or I don't remember signing up for this" non-sense
| complaint that would get you blocked or have your license
| revoked with a normal provider.
|
| Am I crazy or just missing some super obvious gap with this
| path?
| newshackr wrote:
| SMS has something similar to this. You have to honor
| requests to stop sending or are banned.
| autoexec wrote:
| You should try starting one. You'd just need to work with
| every email provider on the planet (including people
| running personal email servers) and convince them to let
| you decide for them what is spam or not, get them to
| implement a massive list of IPs/domains to whitelist on
| their servers, get them to let you edit that list whenever
| new mass mailers sign up for your "We're totally not spam"
| service, and then get them to provide some way for
| complaints to come back to you so that you can enforce your
| rules. It'd be a hard sell for mail providers, and it
| wouldn't solve the spam problem for any messages that
| aren't sanctioned by your service.
|
| You'd also have to do a lot of work to validate new senders
| long before they send their first message and you start
| getting complaints or else you're just letting spammers pay
| you to completely bypass every mail provider's spam filters
| until they finally get blocked and have to create a new
| account with you under a different company name.
|
| If you can convince everyone to trust you, and your
| service, and that it'd be worth it for mail providers to do
| all that work on their end on top of everything they're
| doing currently to prevent spam, it really could improve
| deliverability.
| aembleton wrote:
| > You'd just need to work with every email provider
|
| Why would you need to do that? Just work with those
| that'll pay you for it. The others won't care as they'll
| just ignore the header.
| autoexec wrote:
| Would email providers pay for it at all? I suspect it'd
| be easier to take money from the would-be spammers than
| to get mail providers to do a bunch of extra work and
| then pay you for the privilege just so that your clients
| can send messages that look like spam a little easier.
|
| I suppose that really you'd be able to get a lot of
| utility by convincing just a handful of very popular
| email providers (gmail) to trust that your service will
| never be used to send spam (or that they should let
| spammers who slip by you right past all of their spam
| filters). The more email providers you can get to use
| your service though the more you could charge the mass
| mailers for guaranteed message delivery.
|
| Such a service could lead to two very bad outcomes
| though. Parents being told that if they want to get email
| from the school they'd better sign up for an email
| account at one of the few supported email providers
| (gmail) and/or (if it becomes successful) any sender who
| isn't paying for the privilege of sending email being
| treated like a spammer.
| account42 wrote:
| > I don't remember signing up for this
|
| This is often not a non-sense complaint. A lot of
| newsletter signups are still via pre-selected checkboxes
| that are easy to miss.
| tzs wrote:
| I have no idea if this still works, and it probably wouldn't
| work for a school, but 15-20 years ago the way to get Yahoo
| to stop blocking your emails was to call up your ad rep and
| say something like "Why the heck should we keep spending
| $10000/month buying ads on Yahoo when any new customers we
| get from those ads that use Yahoo email end up pissed off at
| us and maybe even charge back because it looks like we are
| completely ignoring them because they don't see our
| emails????".
|
| That would get you added to a "never block mail from this
| domain" whitelist that had higher precedence than everything
| else.
| IMTDb wrote:
| Aka: extortion
| throwuxiytayq wrote:
| What does outward rotation about an axis or fixed point
| have to do with politely asking corporate overlords to
| get their shit together?
| U8dcN7vx wrote:
| There is a form and people you can talk to if the form
| doesn't work. The form should have been mentioned in the
| reject message but is at
| <https://senders.yahooinc.com/contact#sender-support-request>
| though you should first review their information, rules, etc,
| starting at <https://senders.yahooinc.com/>, and the mailop
| mailing list at <https://list.mailop.org/listinfo/mailop> is
| where you can ask for help if the former doesn't suffice that
| will often result in direct contact with someone at Yahoo!
| that can get things done or at least give knowledgeable
| advice.
| defulmere wrote:
| > And yet after like 50 emails to parents with yahoo email
| addresses they are giving me errors because of "unusual
| volume of emails from your domain"
|
| Scandalous, it's almost as if the established major providers
| have a financial interest in making it difficult for smaller
| providers and individuals to send mail using their own
| domains!
| citrin_ru wrote:
| > I hope they make it really strict.
|
| I hope they not. Gmail spam filter is far from being perfect
| and classifies many non spam messages/senders as spam. May be
| because they heavily rely on user reports (to train AI?) and
| email users tend to report all kind of emails as spam including
| clearly ham messages like bank statements, appointment
| notifications, password reset emails e.t.c.
| Synchro wrote:
| Even gmail's own marketing messages (that I never asked for!)
| end up in my spam folder. If google can't even reliably send
| emails to themselves I don't know how they expect anyone else
| to succeed.
| autoexec wrote:
| > I hope they make it really strict. I'm sick of companies that
| send you spam ("newsletters") just because you interacted with
| them once, then when you unsubscribe, you get unsubscribed from
| that one list, so they keep spamming you just with a slightly
| different newsletter type.
|
| Never interact with spam. Unsubscribing just tells spammers
| that your email address is actively being checked, and that
| you're the kind of person who clicks on links found in
| unsolicited messages. It can even end up getting you _more_
| spam (as you 've noticed), and what looks like an innocent
| unsubscribe link can actually take you to a malicious website
| instead. You've really got nothing to gain by touching spam at
| all.
|
| The best way to deal with the spam that makes it into your
| inbox, especially spam that comes from specific senders with
| predictable subject lines/body content like newsletters, is
| filtering. For example, just auto-delete anything from a domain
| you never want to hear from again. You never see it, and you
| leave them spending at least a little time/effort shouting
| uselessly into the void.
|
| I tend not to auto-delete directly, but have things filtered
| into specific folders just in case. It takes almost no time to
| clear out when they get very full. Most filters are set once
| and forget.
| shiroiuma wrote:
| >Never interact with spam. Unsubscribing just tells spammers
| that your email address is actively being checked, and that
| you're the kind of person who clicks on links found in
| unsolicited messages. It can even end up getting you more
| spam (as you've noticed), and what looks like an innocent
| unsubscribe link can actually take you to a malicious website
| instead.
|
| Yet there are people here on HN telling us that we have some
| kind of responsibility to watch ads, not block them, and
| support the kind of people who do this slimy, evil, unethical
| bullshit.
| Pikamander2 wrote:
| >Never interact with spam. Unsubscribing just tells spammers
| that your email address is actively being checked, and that
| you're the kind of person who clicks on links found in
| unsolicited messages.
|
| This only applies to scam emails like newsletters from
| sketchy domains that you never signed up for, which are sent
| out specifically to find active email addresses. For those,
| clicking the "unsubscribe" link is indeed counterproductive.
|
| For actual businesses like Linkedin though, it makes more
| sense than not to unsubscribe from unwanted emails anytime
| they're sent. On occasion you'll find yourself back on a
| different newsletter list, but it's relatively rare and more
| often than not just incompetence rather than malice;
| legitimate companies want to send their emails out to people
| who buy stuff, not people who mark them as spam and lower
| their reputation.
| autoexec wrote:
| > For actual businesses like Linkedin though, it makes more
| sense than not to unsubscribe from unwanted emails anytime
| they're sent.
|
| Why? What's in it for you?
|
| You filter them = never see the spam they send you again
|
| You unsubscribe = pray that it's not a phishing email
| disguised as linkedin spam, hope that if it's real they
| don't just start sending you different spam, and that maybe
| they haven't agreed to sell your (now confirmed as more
| valuable) email address to 3rd parties (aka, their
| "partners") now that you've made that email address
| worthless to them otherwise.
|
| The absolute most you can ever hope for in the
| "unsubscribe" case has the exact same outcome as the
| "filter" case, while the filter case has less risk and as a
| bonus lets the spammers waste their time.
| gregorvand wrote:
| At mailpass.io we tried to embed some of these ideas straight
| away. Easy to ignore certain domains. Easy to delete all
| messages from a specific domain without sending any kind of
| tracking this was done
| tgsovlerkhgsel wrote:
| Interacted _with the company_ , as in filed a support
| request, bought something from them, etc.
|
| They already have my e-mail address, likely even verified.
| They're also somewhat normal companies, i.e. they have an
| address where the local DPA can send a friendly reminder, and
| while they will happily pass your (likely hashed) e-mail
| address to Facebook for ad targeting, actual selling to
| spammers is incredibly rare.
|
| I often can't just filter the domain because I might actually
| need to deal with the company again (if I boycotted everyone
| who acts like a dick I'd be living in a cave).
|
| Also, for many, unsubscribe actually works.
| gregorvand wrote:
| It's fair to say any traditional email provider will still
| struggle to prevent this 'legit spam'. We took a different
| approach at mailpass.io where we assume most of the messages
| are not important for the majority of inbound email. We suggest
| giving it a go for then forgetting / not caring about whether
| unsubscribe actually works
| Wojtkie wrote:
| Nextdoor is the absolute worst about this. Selecting
| unsubscribe only lets you unsubscribe from the "type" of email
| they're sending you. After unsubscribing 7 or 8 times I just
| reported the whole domain as spam and blocked it.
| hyeonwho22 wrote:
| You have much more patience than I. After the second email
| type I deleted my account.
| m-p-3 wrote:
| Honestly I prefer to subscribe to those kind of newsletter in
| the form of a RSS feed. They just publish passively, and I
| choose when to subscribe and unsubscribe on my own term, and it
| doesn't clutter my mailbox.
| disgruntledphd2 wrote:
| The Information are so incredibly bad for this. I've requested
| unsubscriptions multiple times from them and they just can't
| seem to manage it. Like, presumably their audience won't use
| them but still it rankles.
| nickdothutton wrote:
| So spamming is fine, so long as you stay under some threshold.
| Thanks a lot.
| vore wrote:
| 5000 emails a day is an extremely low limit for spammers,
| though.
| jmduke wrote:
| Good.
|
| I'm someone who a) uses Google Suite (or Workplace, or whatever
| it's called) b) runs a newsletter service [buttondown.email] that
| sends millions of emails every day, most of them to Gmail.
|
| The amount of cold email I get from prospecting/outreach tools
| that is nigh-impossible to unsubscribe from is _infuriating_. Any
| legitimate bulk sender is already conforming to DKIM + one-click
| unsubscription, and anything we can do to cut down on obvious
| spam is a win in my book.
|
| There's a lot of things Gmail does as de facto tsar of email that
| I don't love -- initiatives like AMP for email come to mind --
| but this is an unalloyed positive in my mind.
| delfinom wrote:
| Now if Google/Gmail could do something about all the email spam
| between Gmail accounts.
| pembrook wrote:
| The authentication stuff is all standard practice so no big
| change IMO. However the hard spam limit with Gmail in particular
| will get interesting. I predict this is going to create some
| insane headaches for indie Saas startups.
|
| Gmail is the only inbox provider that doesn't offer a real
| feedback loop (you don't actually know if a given email address
| marked you as spam when sending to gmail users). The FBL in
| Google postmaster tools is anonymized and unreliable at best.
|
| So essentially, you never know if a Gmail user marked you as spam
| so you can stop sending to them. Gmail will just by default mark
| your emails as spam for that user going forward, without telling
| you. This means your spam complaint level will inevitably rise
| over time without you knowing why and what email addresses are
| causing the issue.
|
| Unless Gmail actually starts providing a real FBL like other
| inbox providers, the hard spam limit is going to snowball into a
| nightmare for even the most conservative and legitimate senders.
| Macha wrote:
| Honestly sounds like I'm on the side of Gmail here.
|
| Think about this from the perspective of an actual spammer. You
| get a notification that address XYZ is marked as spam by user
| ABC. Well, now you just email user ABC from a different
| address.
| pembrook wrote:
| Not even spammers want to waste time & money emailing people
| who have already marked their emails as spam (that's as clear
| a signal as any to move onto the next victim).
|
| The real problem is, for legitimate senders, the people who
| send less emails actually get higher levels of spam
| complaints! This is because humans are human and they forget
| who you are. I would argue this actually incentivizes sending
| _more emails._ This is why marketers all recommend sending
| garbage emails daily /weekly/monthly.
|
| The truth is, the companies with full-time spam (marketing)
| departments will do just fine with these changes. It's the
| little guy who is going to have to navigate these
| complexities (likely unsuccessfully), and get shut out from
| yet another technology that used to be open.
|
| On top of that, Google has started to offer perks for senders
| within Gmail for a $1,500 per year fee (VMC). They're
| basically one step away from collecting rents on all of email
| by way of their monopoly.
| pests wrote:
| Right - spammers (and legit marketers) do not want an old
| or out of date email lists to work with. Wastes time and
| reduces the lists ROI.
| max51 wrote:
| I disagree with your analysis. I think they will limit the
| amount emails with garbage that people don't want to see if
| they risk getting their entire domain blocked over it.
|
| I also don't think it's complicated for the "little guys".
| The solution to avoid getting banned is simply to not send
| mass spam. It's not rocket science, don't mass email people
| knowing that they get mad at you when see your emails in
| their inbox.
| dizzydes wrote:
| For the next two months our inboxes will be wild with opt-in
| pitches...
| lnxg33k1 wrote:
| To be honest I had to block mails from @gmail.com as its the only
| place i get spam from, so if they try to make their service less
| of a wasteland thatd be really appreciated
| georgyo wrote:
| Reading all the comments makes me think I'm an outlier.
|
| I very aggressively unsubscribe from everything so I get very
| little mailing list spam. Maybe a few messages a month.
|
| What I do get _constantly_ is spam email messages to my inbox
| from Gmail and Outlook domains. At least one a day for many
| years. Because it from Gmail, they have very little spam
| filtering done, yet if any other provider sent these messages
| then Google would block the entire domain.
|
| These particular spam messages get on my nerves, and these are
| the only ones making it through to me.
| stevage wrote:
| Yep, I'm the opposite of you. I get almost zero true "spam" to
| my Gmail account. Maybe 1-2 messages a month.
|
| Whereas quite a few of these quasi-spam marketing emails from a
| company that I once had some interaction with. The worst is
| hotels - you stay at 10 hotels during the course of a trip,
| then you get added to 10 email lists for the rest of your life.
| kiwijamo wrote:
| I have a Gmail account I opened in the early days of Gmail
| and stopped using on a regular basis when I got my own domain
| around mid-2000's. Whenever I occasionally check in, I always
| find heaps of spam. Many I've tried unsubscribing for and
| still get the mail--obviously Gmail's filter doesn't take
| into account senders I've flagged time and time again as
| spam.
| oynqr wrote:
| You might not get much spam delivered to your Gmail inbox,
| but that doesn't stop Gmail from being the largest _source_
| of actually delivered spam.
| drdaeman wrote:
| > I very aggressively unsubscribe from everything
|
| Never unsubscribe from anything you haven't subscribed for (or
| at least where you haven't gave your email address to the
| sending party), because I believe any interaction with
| unsolicited emails provide spammers with a clear signal that
| their spam is not just delivered but also read and interacted
| with, so they get more agressive.
| georgyo wrote:
| I've heard this advice before, but in my experience you can
| tell the difference between something malicious or not.
|
| But more importantly even if I provide some signal that my
| email is active it's not going to change that much. They can
| send more, but that just helps train filters.
|
| Lastly default Gmail settings loads remote images. Just
| opening the email is enough to create some signal. Having
| remote images turned off is enough to stop most engagement
| pings.
| franga2000 wrote:
| AFAIK Gmail downloads and caches all images server-side the
| moment it receives the email, then replaces them with
| cached versions when viewing. The only thing this tells you
| is that the address exists, not that anyone opened your
| email, which you already know since the email wasn't
| rejected.
| justinbaker84 wrote:
| Usually when I get the spam you are describing sent to my gmail
| account it looks like some spammer managed to send obvious spam
| messages from a server on an authoritative domain like a
| university.
| kiwijamo wrote:
| In the days I ran my own main server for my domain I was
| surprised to find that well over 50% of spam originated from
| Google (both emails with @gmail.com domains but also emails
| from other domains being processed via their servers). And I
| wasn't even a Gmail customer, so it looks like they don't
| really filter outgoing mail to other providers. It made my
| inbound filtering quite tricky as I couldn't block Google as
| quite lot of legitimate traffic comes from friends using Gmail
| so the other Spamassassin rules (e.g. content analysis) had to
| do much of the heaving lifting. A couple of years back I gave
| up and outsourced the MX for my domain to Fastmail.
| Interestingly they also struggle to filter Gmail messages
| (which isn't too surprising as they also use Spamassassin) but
| thankfully there are only a few a week that get past and I
| always make sure these are flagged as spam to train the filter.
| Over time they end up going into my Spam folder and eventually
| they just don't arrive at all due to my spam settings blocking
| high spam scores.
| narag wrote:
| _...yet if any other provider sent these messages then Google
| would block the entire domain._
|
| I doubt Google would do that to other big companies.
|
| Some accept user-provided email addresses at face value,
| without any confirmation, and then refuse to stop spamming you.
|
| Would Google block Paypal?
| citrin_ru wrote:
| It is my experience too - about 50% of spam I see on my
| personal email are dmarc passing messages from gmail and
| hotmail.
| Alifatisk wrote:
| Well, If you see pattern in the spam mail then you can setup a
| rule that filters the spam.
|
| That's what I have done on my outlook.
| crawdog wrote:
| Curious if this applies to political ad senders.
| drdaeman wrote:
| What exactly are the news here? I see three points but fail to
| comprehend them, because I thought all those things were a norm
| for a long while:
|
| 1. Is it the news that Google still accepted bulk volumes of
| unauthenticated mails in 2023? If that's true - finally, good
| riddance. Although I believe most spam those days comes from
| legit hacked domains.
|
| 2. Am I reading this right that List-Unsubscribe and/or
| unsubscription link is going to be required for high-volume
| senders, marketing and transactional? That's good to hear,
| although - again - it's hard to believe this is a requirement
| only now. I thought everyone with at least a sliver of honesty
| already had those for a long while.
|
| 3. Enforce low spam report ratio? It's news to me that the
| "report spam" buttons didn't behave that way already, I assumed
| that if users actively report then domain gets blocked (unless
| it's whitelisted, e.g. to defend from a false reporting DoS
| attack).
| DistractionRect wrote:
| > Is it the news that Google still accepted bulk volumes of
| unauthenticated mails in 2023
|
| Apparently so. I just read through this earlier today, and it's
| kinda insane how broken email is. Kinda remains me of the "You
| go to jail" meme, believe it or not, straight to inbox.
|
| [0] https://news.ycombinator.com/item?id=37628337
| RIMR wrote:
| This will be interesting to see how this plays out
| internationally, since some countries don't have the same anti-
| spam laws we do. Will I stop getting notifications from some of
| the non-EU, non-US services that I am a member of just because
| they don't have in-email unsubscribe links (I can still unsub on
| their website)? These are not companies under sanction, so I have
| every right to communicate with them freely, even if they don't
| obey the same laws as where I live. Should I end up suffering
| damages because Google blocks legitimate communications, will
| they be taking liability for their interference?
|
| For clarity, I am not against anti-spam measures, but I do worry
| about centralized services being overly strict and doing damage
| to their customers, especially if it is so draconian that it
| prevents delivery of important communications as retaliation.
| happytiger wrote:
| Bulk sending breaks the utility of email. I wish there was a way
| to say, "Don't allow my email to receive bulk sent emails."
|
| I can't imagine how much that would improve my life. I just don't
| want to see it. It breaks my attention far too frequently for far
| too little utility, and I would love it if entire emails I own
| could be bulk spam free.
|
| I don't really want a better version of our shitty current
| system.
| linsomniac wrote:
| The issue is: How does a server determine that a message is
| bulk sent?
| happytiger wrote:
| That's what BCL scoring and the like are for.
| pembrook wrote:
| On the contrary, I only care about receiving email from bulk
| senders. I pretty much exclusively use email to read
| newsletters and handle communication with companies/accounts.
|
| Any 1:1 communication with real people pretty much exclusively
| happens elsewhere for me.
| happytiger wrote:
| That's cool. What I am saying is that you should be able to
| decide what works for you.
|
| I don't want any. You do. Why not give users the ability to
| control what they want? It's not a technical challenge.
| beretguy wrote:
| I'm surprise nobody mentioned SimpleLogin yet to counter spam.
| schappim wrote:
| The title could be rewritten as: "Advertising Companies Take
| Additional Measures to Diminish the Effectiveness of Email
| Marketing."
| berniedurfee wrote:
| What's in it for Google?
| pembrook wrote:
| The truth is, most small businesses cannot figure out how to
| add DNS records to their domain. So they will no longer be able
| to inbox.
|
| And the more complicated and difficult Gmail makes it for
| companies to access your inbox via open tech like email, the
| more likely it is you'll be forced to pay for Gmail Ads.
|
| The bonus is Google gets to couch this as being "for the
| users." Gmail already has fantastic spam filtering and it's
| highly likely they use all this stuff as spam signals already.
| I would be very very careful of any claims from a giant
| advertising monopoly that this is "for the good of all."
| coding123 wrote:
| Now spam comes from calendar invites, DRIVE shares, and who knows
| what is coming in the future.
| pjd7 wrote:
| Overall the changes seem sensible. For those wanting to self host
| there are plenty of guides out there on how to configure various
| MTAs with all of the required bits.
|
| BUT, Why does IP reputation matter so much these days when you
| have DKIM, MTA-STS, DANE and other mechanisms that provide
| verification of the sender?
|
| Say I want to startup a Email Service Provider, I need to go and
| source a bunch of IPv4 typically to have a premium upsell for end
| users to really ensure cross sender reputation does not impact
| other tenants. Crazy.
|
| IPv6 historically at least was anecdotally punished by the likes
| of GMAIL, Yahoo, Hotmail, Office365 etc. Does anyone know if IPv6
| hosted email severs still suffer additional spam scoring?
| U8dcN7vx wrote:
| Delivery via IPv6 still seems more stringent. IPv4 now requires
| "authentication" as well where previously only IPv6 did. Last I
| checked Google didn't use DANE, preferring instead MTA-STS --
| perhaps understandable for a giant web property.
| maxo133 wrote:
| This is step closer, after few more steps they'll make sure only
| those "approved" companies can operate email server... leading to
| more internet centralization.
| r053bud wrote:
| Yeah, at this point, I've completely lost my main email address
| to spam and mailing lists; half of which seem to have broken
| unsubscribe pages. I've abandoned this email completely for
| personal communications and have a new email for that now. I
| continue to use my old email for any service or website, since I
| know they will likely sell my email in addition to spamming me to
| death.
|
| This has all gotten completely out of control. Yet again,
| regulation seems to be about a decade behind.
| billy99k wrote:
| While this sounds great on the surface, it's used to control
| things like our elections. Politicians that Google likes can send
| as much mail as they want. Ones they don't mysteriously gets all
| of their email marked as spam.
|
| Normies don't understand that big tech will basically control our
| elections from now on (and they won't understand how) unless we
| get the government involved.
| joeross wrote:
| I haven't trusted the spam button or unsubscribe functions for a
| long time. It never felt like it worked. I've been making filters
| to auto delete stuff instead and it just works.
| cookiengineer wrote:
| If you are running your own postfix MTA and those mass email
| providers keep spamming you even when you write their abuse@
| teams: I created a simple anti spam tool/blocklist generator that
| can be integrated with postfix's postmap format, because spamhaus
| was totally useless for those providers. [1]
|
| It's trying to be dead-simple, and also blocks the alternative
| ASNs these spam providers have in reserve. Haven't found a fully
| automated way yet because whois protocol is kinda broken, but I'm
| working on it.
|
| [1] https://github.com/cookiengineer/postfix-spamdb
| CrzyLngPwd wrote:
| Yes another nail in the coffin for email.
|
| We have toi jump through hoops to send email to the big email
| providers already, and some (outlook, hotmail, yahoo) take months
| before allowing any volume of email to be sent to our own
| customers!
| account42 wrote:
| > Gmail's AI-powered defenses stop more than 99.9% of spam,
| phishing and malware from reaching inboxes
|
| And what percentage of legitimate mail?
|
| > and that they process unsubscription requests within two days
|
| This is a laughably lax requirement.
|
| Also for fucks sake, stop auto-localizing your documentation
| based on IP geolocation.
| throwaway290 wrote:
| Probably half of legit mail from self-hosted servers... Anyone
| using them at all?
| account42 wrote:
| YMMV but Gmail hasn't been that bad for me. The only problem
| I (knowingly) had was with a newly registered domain and
| mails still at least went to the spam folder there. Microsoft
| has been much more annoying, punishing you for bad IP
| "neighbors" that you have no relation with. Of course I don't
| know if all my mails get delivered since I don't do any
| tracking, just relying of voluntary in-band or out of band
| replies / receipt confirmations. And being based on black box
| heuristics (and "AI" lol) there is no guarantee that my
| experience with Gmails spam filters is the norm - but Gmail
| rejecting half of self-hosted mail seems a very pessimistic
| estimate.
|
| Still, just citing numbers for how much spam they blocked is
| (deliberately?) only showing half of the picture.
| Synchro wrote:
| None of that seems new. What would be new is if both gmail and
| Yahoo provided _any_ means of allowing legit bulk senders to
| actually send properly.
|
| The one-click unsubscribe is from 2017's RFC8058. Everyone that's
| sending in volume is already doing all the usual stuff - DKIM,
| SPF, DMARC, matching reverse IPs, etc.
|
| The privacy-first email marketing service I wrote
| (https://info.smartmessages.net) implements account-wide
| unsubscribe by default (unsubscribing you from one list
| unsubscribes you from all). It requires double opt-in, and asks
| for explicit consent before doing any tracking whatsoever (so no
| Google Analytics, no cookies, no trackers), which of course is
| what the (at least EU and UK) law requires. You're not going to
| see shitty exploiters like MailChimp doing anything like this;
| abusing your data is just too lucrative.
|
| It's still ridiculously hard to deliver messages at any volume,
| and there is zero recourse when you are penalised incorrectly.
| Gmail's spam filtering is just dire - if I send myself an email
| from gmail, it goes into spam. A large proportion of the spam I
| receive is sent from gmail.
|
| Google's postmaster tools are a joke. It's entirely normal for
| them to give you a "bad" spam rating when you have 0 spam
| reports, 0 auth failures, strict DKIM and DMARC, and every single
| message has double-opt-in audit trails. This useless feedback
| makes it very difficult for senders to actually comply with their
| ever stricter, but ever more opaque requirements.
|
| Proving that subscribers actually want to receive messages from
| you its difficult. So back in 2017 I wrote an outline proposal
| https://github.com/Smartmessages/subscriptionproofrfc to create a
| standard, possibly built on top of DKIM keys, to provide provable
| subscriptions. This would pretty much solve the entire thing for
| legit senders, but of course the industry is not really
| interested in cooperation or complying with any law that might
| reduce the number of people they send to by even the tiniest
| amount.
|
| /cynicalrant
| account42 wrote:
| > legit bulk senders
|
| Now who could you mean by those.
|
| > The privacy-first email marketing service I wrote
|
| Oh right, spammers.
| Synchro wrote:
| Get a grip. So you would consider twitter and Facebook
| notifications you have explicitly requested as spam? I also
| run a social network with 20k users that is equally
| accessible over web and email, and we have had peaks up to
| about 4 million messages/month containing nothing but
| conversations between users, and we run into all these bulk
| sending issues all the time. Please explain, oh wise one, how
| is emailing people messages they have explicitly asked for
| spam?
| denton-scratch wrote:
| I couldn't figure out from the announcement whether these
| controls are to be applied to people sending bulk _to_ gmail
| addresses, or _from_ them.
|
| Nearly all the spam I see is from a gmail address. I suspect this
| new measure is to protect gmail recipients.
| hunter-2 wrote:
| Wait, how does one send 5000 messages in one day? I thought Gmail
| had an upper limit of 500/day?
| josephd79 wrote:
| This is nothing new for Google, they already do this.
| janandonly wrote:
| During the pandemic era, I would use my Gmail account to send
| emails to people who signed up for an on-line museum tour that I
| held over Zoom.
|
| I was shocked to find out that maybe 1/3 of all recipients had to
| find my emails in their SPAM box. Eventually, I paid for a
| service that allows to send SMS in bulk so that I could inform
| people to check their e-mail and spam box for the login details.
|
| I hope these new measurers will mean that less email is earmark
| as spam. The fact that is sent out 300 mails with identical text
| and multiple links in it, is in no way a sign that it is spam.
|
| It got so bad in facts that some people reported not even seeing
| my mails in their spam box (or, many older folks don't know how
| to find/open their spam folders). So eventually, I asked them to
| send a mail to me first, to which I would simply reply.
| pcdoodle wrote:
| It got to the point for us when a customer with gmail would ask
| for an update about their order with us, we couldn't get an
| email back in front of them.
| kposehn wrote:
| While I'm all for doing a better job at reducing spam, this also
| will effectively drive a lot of those advertising dollars that go
| into bulk email straight into sponsored email products from
| Google and Yahoo.
|
| The main webmail platforms do not benefit economically from spam.
| They have every incentive to turn it to their advantage by
| diverting ad dollars from bulk email and forcing it into their
| own ad platforms.
___________________________________________________________________
(page generated 2023-10-31 23:02 UTC)