10 ms·

I can no longer recommend MailChimp

224 points by svacko 9y ago

NoPiece 9y ago
They are just changing the setting, and creating a new default. Not sure why a user of MailChimp would feel the need to switch, or complain they "only" have 7 days to switch the setting to what they want. That's not an unreasonable burden.
- caf 9y ago
  This is explained near the end of the article: Changing the settings for my own mailing list (which of course, I did) isn't actually a solution. Sure, it stops toerags using my newsletter as an email bomb but it doesn't stop many more MailChimp-run mailing lists switching to a system that will increase the amount of unwanted emails flying around the internet.
technion 9y ago
There's another thing going on here. Over the last 24 hours I've reported a half dozen accounts that have flooded our domains with fake statements and links to Mailchimp hosted .js malware downloads. This has never been a problem before but right now it's out of control. Noone signed up for, what I'm assuming is, hacked newsletters on hacked mailchimp accounts, and suddenly anyone on any address list is now on the receiving end of this garbage.
dharmon 9y ago
They haven't "gone bananas". Removing double opt-in means more subscribers, which means higher revenue for them. Their revenue is based on subscriber counts, no matter how they were obtained. I hope everyone else does what I do: any bulk emails I did not subscribe to get marked as spam in gmail. Even a company the size of mailchimp can't cycle and "warm" email servers fast enough if a critical mass of people are tagging unsolicited emails.
- detaro 9y ago
  I'm curious to see how many of their German customers don't realize they have to explicitly set this now. Here, your competitors can you sue/"fine" you for having single opt-in only.
- chomp 9y ago
  It doesn't matter if they believe that it's higher revenue, GDPR requires consent from the data subject [1] to process personal data. An email address is personal data under GDPR. You can't guarantee consent with single opt-in. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
  - sgarman 9y ago
    Does this fall under mailchimps responsibility or the company using their services?
    - munchbunny 9y ago
      The short answer is both. There's a somewhat longer answer about how MailChimp would need to make the company agree to a separate contract around liability issues, as per GDPR requirements.
  - revelation 9y ago
    Even without GPDR single opt-in is already insufficient in e.g. Germany. If you send a newsletter to some lawyer and can't prove consent you might just get a C&D with statutory damages back.
- CodeWriter23 9y ago
  In the short term, probably more revenue. But once they race to the bottom of deliverability rates (like SES, for example), MailChimp will forever have lost it’s major defining feature: emails that actually make it to the inbox.
  - stefan69 9y ago
seizeheures 9y ago
What reliable service should one use then? MailChimp is still pretty much the go-to option for me
- deleted 9y ago
  [deleted]
- Theodores 9y ago
  How hard can it be to send an email? Why pay $$$ for it? For deliverability, which is pretty good on Mailchimp. However I think that send emails out using the gmail API or the Amazon SES might be the way to go. Also depends on what you are doing, I think that those that over analyse the mail openings are getting it wrong, focusing on the wrong metrics. You should be focused on the sales metrics not be navel gazing in newsletter software. Content is king, get that right and again, focus on that, not the analytics.
  - pixl97 9y ago
    >How hard can it be to send an email? Are you serious? Sending an email is really easy. Actually having the remote deliver it to the remote mailbox is the problem.
- devdad 9y ago
  Sendgrid is solid.
  - BillinghamJ 9y ago
    I tried using it once. It did not seem solid. It didn’t support 2FA, and required my actual account username and password to send email from the server.
    - sethammons 9y ago
      2FA has been supported for years at this point at SendGrid. Edit: and API Keys are the recommended way to interact with SendGrid APIs
martin_a 9y ago
We use Mailchimp for B2B newsletters and have several thousand subscribers in our lists. This is the first time I hear anything about this. No mails whatsoever although I am a German user.
- jontro 9y ago
  I've received two mails in the past week. http://mailchi.mp/f3bc9acebf61/were-making-important-changes-to-the-signup-process http://mailchi.mp/f3bc9acebf61/were-making-important-changes... http://mailchi.mp/5fbac34cf976/were-making-important-changes-to-the-signup-process-850741 http://mailchi.mp/5fbac34cf976/were-making-important-changes...
  - stefan69 9y ago
    Ditto.
Taniwha 9y ago
Time to shitcan mailchimp in my mail server I guess
Nerada 9y ago
Is this going to affect MailChimp's deliverability? It seems like it would, my understanding is the reason most relays and blacklists are so lenient with MailChimp is exactly because of their double opt-in policy. Looks like they're ultimately throwing their long-term business under the bus for a short burst of extra cash.
- jlgaddis 9y ago
  Absolutely it will. If you use MailChimp and care about deliverability, I would recommend you begin looking at alternatives (if you haven't already).
  - andyfleming 9y ago
    Don't most other providers already do single opt-in by default already anyway? Really, MailChimp is just sinking to their level. It's not all of the sudden worse than alternatives, right?
    - jlgaddis 9y ago
      > Don't most other providers already do single opt-in by default already anyway? Yes, most others have already switched to single opt-in. > It's not all of the sudden worse than alternatives, right? No, they aren't all of a sudden worse than the alternatives. They were already worse and they're certainly not going to improve as a result of this change. I manage several e-mail servers and will be watching very closely -- even more so than usual -- the amount of spam coming from MailChimp. I usually start out by blacklisting individual IP addresses but if this becomes a big problem, I will simply blacklist them entirely and be done with it. I've had two "incidents" in the last week or so with MailChimp that they have shown little interest in "fixing" (unrelated to this change) so I'm already inclined to do exactly that.
  - inopinatus 9y ago
    I suggest the same dirt will attach to one's reputation if using Mandrill or Tinyletter, both of which are Mailchimp subsidiaries and share outbound address ranges.
conductr 9y ago
Not a user but does single opt-in "by default" imply there is a setting to flip it back to double opt-in? If so, flip the switch
- stefan69 9y ago
  Correct - they state you can still use double opt-in if you want to.
pavlov 9y ago
This only affects signup forms hosted by MailChimp. If you build your own form and use their API for signups, there has never been a requirement for double opt-in. So I don't know if this is such a dramatic change -- depends on how many people use the default forms instead of an integrated signup experience.
- notahacker 9y ago
  Yeah, don't understand some of the responses which seem to assume this change will make MailChimp any more spammer-friendly. If you want to spam with MailChimp (or for that matter most other list providers) you import the long list of people you want to spam in csv form and disregard warnings about only importing emails from people if they've previously expressed interest in receiving notifications from you. Double opt in for new signups makes no difference. MailChimp's ability to be regarded as a non-spammy mailing list provider depends mainly on them weeding out customers who import lists of people who haven't expressed any interest to indiscriminately blast mailshots, not on requiring an additional step after an individual actually visits a website, types in an email and clicks a button sending a post request to the mailing list.
  - alloyed 9y ago
    The concern here is revenge-spam: someone takes your email and submits it to every mailchimp default form they can find automatically, and then your inbox is flooded with ostensibly legitimate email that you have to manually unsubscribe from, for each individual list.
    - notahacker 9y ago
      I understand the concern on an individual level as expressed in the article, but doubt "revenge spam" even moves the needle with mail providers' decisions on MailChimp mails get through or not, which is the primary concern of people worrying about its deliverability.
jlgaddis 9y ago
For my fellow mail server administrators: * 205.201.128.0/20 * 198.2.128.0/18 * 148.105.0.0/16 Those are the ranges you'll want to add to your blacklists.
- deleted 9y ago
  [deleted]
- DKnoll 9y ago
  Blacklisting would be pretty irresponsible, greylisting maybe.
  - jlgaddis 9y ago
    On my servers, they are already greylisted (almost everyone is, by default). Greylisting works very well against most spammers, hijacked PCs, etc. (I use "spamd" [0] from OpenBSD, which also makes blacklisting very easy, FWIW). In MailChimp's case, the only thing that greylisting would accomplish is delaying the amount of time I wait to get their spam^We-mails. [0]: https://man.openbsd.org/spamd.8 https://man.openbsd.org/spamd.8
    - DKnoll 9y ago
      Wrong terminology, my bad. I meant adding a rule for MailChimp origin emails that increases spam score but doesn't necessarily doom the message alone. Dropping their mail altogether would definitely cause some legitimate messages to be lost.
- dredmorbius 9y ago
  Confirming: https://mailchimp.com/about/ips/ https://mailchimp.com/about/ips/
ungzd 9y ago
That is not problem of Mailchimp, it's problem of culture and "best practices". It's really annoying and it became annoying long before this change. I receive lots of such emails not only from Mailchimp. At least Mailchimp has one-click unsubscribing, most custom-built mailing list systems don't have it, requiring to log in or just not working. The problem with Mailchimp is: - Spam filters work mediocre, despite AI hype. I think they are still based on linear regression on bag of words or something like that. Instead Gmail blocks your server if it sends mail for the first time instead of being large company's server that already sent 1e100 emails. - Mailchimp exploits this. You can't send email on your own and have to buy their service. It also spreads additional FUD that you must use it, otherwise all your mail goes to spam. - Gmail treats Mailchimp as privileged sender so if I mark promotional emails from hottest startups as spam, new similar emails are not sent to spam folder. - Hottest startups know this and subscribe you to all their mailing lists each time they got your email.
- stefan69 9y ago
  One workaround is to use disposable email addresses when signing up to anything online, like https://forward.cat https://forward.cat
  - xster 9y ago
    Why not spamdecoy.net? It does the same thing and you never give your real email to anyone (though forward cat is open source so it's probably ok), and you don't have to set up anything before you use the temporary email.
    - djrogers 9y ago
      > (though forward cat is open source so it's probably ok) Curious about this - how can you have an 'open-source' service? I'm not compiling or running the software, and I have no idea what their software is actually doing because there's no way to verify that it's the same as what's been open-sourced...
  - JeanMarcS 9y ago
kadfak 9y ago
I recently set up a mail server with DKIM, SPF, DMARC configured correctly. After spending a day fighting with major email services to not mark my emails as spam, I really saw the value of email service providers. But the damn prices... Are there any alternatives to traditional email that could potentially replace it in the near future?
- CaptSpify 9y ago
  I find that odd as after I set up my email server I haven't had any issues. I'm not trying to discredit your experience, but I just never had that issue myself. Is it possible that you've got an IP that was previously used for spam?
- snowwrestler 9y ago
  If you are starting a new bulk mail service, you have to be very careful about the IP address. It can't be from a known suspicious IP range (e.g. any part of Amazon EC2). It can't be an IP that already has a bad reputation from a previous service running on it. It can't be an IP that is currently running a bunch of other services and sites. Even then, you have to "warm up" the IP by slowly increasing the send volume from it, over about a month, while maintaining low spam scores. It's a pain in the ass, which is why email service provider is a business model. There are alternatives to email, like targeting and boosting social media posts. But generally speaking, they are all more expensive than email, even taking into account service provider fees.
stefan69 9y ago
As a marketer, one of the issues I run into is to subscribe someone, who filled a contact form on my website, to an email automation series (usually to nudge them towards taking an extra action while we scramble to get back to them). Problem is, once the user filled up the contact form to make an enquiry, he is unlikely to go to his/her inbox to confirm... a subscription link. I do think double opt-in is the way forward (as outlaid in the article), but having that single opt-in option for some special cases is necessary from a business point-of-view. Overall, pretty good compromise by Mailchimp.
- hobarrera 9y ago
  This doesn't really affect the scenario you mentioned. Previously users entered their email just once, and had to confirm newsletter subscription via email. They didn't need to fill in a second form or anything, just confirm they wanted to sign up by clicking a link on an email they get.
- jlgaddis 9y ago
  > Problem is, once the user filled up the contact form to make an enquiry, he is unlikely to go to his/her inbox to confirm... a subscription link. Or, worded another way: the user really doesn't give a damn about your subscription. If they can't be bothered enough to take a few seconds to open one e-mail message and click on a single link, then whatever you're offering obviously isn't something that they actually want. As a non-marketer, it seems to me that marketers would want something like double opt-in -- just so that you can ensure that those on your list are people actually interested in $product. Or is it more about the quantity of users on your list and not the quality of those users?
  - SomeStupidPoint 9y ago
    My (somewhat glib) opinion: Marketers want quantity; salespeople want quality. It's because that's what each one is paid for -- and so companies end up paying too much for marketers to undercut their salesteams' effectiveness because they misaligned the incentives, pay for marketing they don't need (or even harms them!), and then sit there wondering why it's not translating into sales (or worse, saturates salespeople with duds and costs sales). I used work in marketing and my (slightly exaggerated) opinion is you should fire everyone on your marketing team, hire more salespeople, a socialmedia person, and maybe a single dedicated person to track overall sales performance. But what's the point of marketing? You should be selling from that first contact -- and if you have two teams doing the same job with differing incentive structures, no wonder your organization is inefficient and pulling at different goals.
makeramen 9y ago
Would be nice to have some sort of do-not-call list equivalent for email mailing lists, or at least something that forces double-opt-in on the receiving end. Too bad we're not MailChimp's customers so they could care less really.
- BillinghamJ 9y ago
  Couldn’t care less?
  - makeramen 9y ago
    Oh ok. Thanks.
hobarrera 9y ago
So, MailChimp will make more money, as users get more unwanted emails, and clients have to pay for it. Wow.
Nition 9y ago
From MailChimp's second post[1]: > More and more business owners are bringing up double opt-in. What they’ve been saying is that double opt-in is not an easy journey for their customers. Some go so far as to say that double opt-in is “broken.” I would go so far as to say if customers cannot be bothered clicking one confirmation link in an email, they didn't really care about your newsletters. [1] https://blog.mailchimp.com/why-single-opt-in-and-an-update-for-our-eu-customers https://blog.mailchimp.com/why-single-opt-in-and-an-update-f...
- danielfoster 9y ago
  I used Mailchimp to collect email addresses for an beta user waitlist in 2015. I eventually used a work-around to disable double opt-in because so many users had signed up, never clicked the confirmation email, and were then confused why they never received access to our product when others had. As a user I also prefer single opt-in. If I sign up for something, I want to be signed up. Clicking confirmation links is an annoying extra step.
  - caf 9y ago
    Here's the thing, though. As a user, if I start getting your mailing list emails because someone else decided to sign me up and there was no confirmation, I'm going to mark it as spam.
    - Gustomaximus 9y ago
      That should be a minimal number of cases, reduced further by having a big clear one click unsubscribe option. It always amazes me the business that make unsubscribing difficult. That is the real way to get placed in spam.
      - caf 9y ago
        Does anyone trust the unsubscribe link in apparent spam, though?
synicalx 9y ago
Honest question here, does anyone actually want to receive newsletters? I don't think I've ever set foot in the 'Promotions' tab in my Gmail account, other than to delete everything in it.
- wishinghand 9y ago
  The ones who sign up for them do. I read Javascript/Node/goweekly.com newsletters in their email format. The Phaser.io newsletter is another. I think you're more the outlier than the norm.
- derefr 9y ago
  Some of my favourite "blogs" are only available in the form of e-mail newsletters. patio11's post-BingoCardCreator blog, for example, only existed as a newsletter (with non-indexed webpage alternates) for the longest time—though I see that there's now an index (http://www.kalzumeus.com/archive/ http://www.kalzumeus.com/archive/), complete with RSS meta-tag. In other cases, newsletters can serve as a sort of low-volume link aggregator. I'm subscribed to the http://elixirdose.com http://elixirdose.com newsletter and end up with a few Elixir-related articles to read each month. In other cases, it's just fun to follow regular company newsletters, because those companies are essentially soap operas in progress. The http://zenmagnets.com http://zenmagnets.com newsletter is 90% about their ongoing legal battle against the Consumer Product Safety Commission. And, every once in a while, I appreciate getting informed that a product/service I've built something on top of—but which I'm not actively building on right now (i.e. I pay them money every month, but I never go to their website)—has new features, which might inspire me to build something else on them. I like getting announcement emails from {AWS, DigitalOcean, Twilio, etc.} for this reason.
  - patio11 9y ago
    My blog and newsletter are ~separate, FWIW. As far as I am aware I do not have an RSS or single page listing the newsletter archive.
- joejev 9y ago
  I get newsletters for a few music labels to see their new releases. I also get announcements for local music shows.
shampster 9y ago
"double opt-in" is a term I'm used to hearing in a pejorative way from the pro-spam side. The anti-spam side calls it "confirmed opt-in" which I think is a more accurate description.
- JohnTHaller 9y ago
  Anyone calling it 'double opt-in' has the whiff of being a spammer even if they aren't one. If you're not checking that the subscriber clicked the "yes I want this" link in the email, anyone can subscribe anyone they want to your mailing list. There are tons of 'email bomb' services that will 'subscribe' a target to 100s or 1000s of newsletters that don't confirm opt-ins.
  - jlgaddis 9y ago
    > Anyone calling it 'double opt-in' has the whiff of being a spammer even if they aren't one. Wow, I'm kinda surprised to hear that because I manage several e-mail servers (for thousands of users) and I am about as anti-spam as one can be. I'm certainly way more aggressive in spam filtering than most others I know. I run my own RBLs (shared across several different systems); I have spamtraps and keep a handful of domains registered solely for that purpose; I do tarpitting; I will blacklist domains and IP addresses -- or ranges of addresses -- at the drop of a hat; and much more. Until reading this thread today, I have never even heard the term "confirmed opt-in". "Double opt-in" is what I've always heard it referred to as and so that's what I've always called it. As I said, I'm about as opposite of a spammer as one can be. You should be careful about making such broad generalizations or accusations.
    - JohnTHaller 9y ago
      Years ago, email marketing companies schemed to use the phrase 'double opt-in' to make the process seem more onerous ('ugh, double the work is so unnecessary, right?') even though the original term was 'confirmed opt in' or 'verified opt in'. That original terminology was specifically chosen because without it, there's no way to know if the email address typed into that online form was someone legitimately signing up or not. Especially when email bombing was much more popular 15 years ago. Sadly, many folks only know the 'double' term these days. 'Double' is more commonly used today since email marketing firms do most of the talking about it. For instance, "confirmed opt in" has 92k results in Google while "double opt in" has 438k. It's much the same as the way the gambling industry rebranded themselves as the 'gaming' industry. Although in the case of 'double opt in' it's been more successful.
ynniv 9y ago
Come on, this should be really easy to fix. If MailChimp is really sending you so many emails that you are upset with their service, you should be able to make your own MailChimp account and tell them that your email address requires double opt in. Or you can make a rule for their MX to end up in a special folder. Or they can detect a well above average number of lists for a single email address and trigger double opt-in for that address. This is a problem for a vast minority of users.
tomc1985 9y ago
I wish there was a non-consentual way to force businesses to continue needed products and services. The narrative lately (especially here on HN) has been seemingly nothing but firms watering down --if not sunsetting-- valued products and services for their own seemingly selfish ends. "Business isn't charity" -- maybe it should be. At the least we'd get more service-oriented folks in charge, instead of the current crop of profiteering assholes that infest these lands.
mintplant 9y ago
> And a small number of these people might think it's worth their effort to sign up my publicly-available email addresses to hundreds, no... thousands of legitimate newsletters and mailing lists that I have no interest in. People do that to my email, too, but they call themselves "growth hackers".
xster 9y ago
I imagine it can't be the most profitable market to write spams in Cantonese. [subtitle: it's like sending spam in Glaswegian]
BillinghamJ 9y ago
You can actually get your entire domain blacklisted on Mailchimp if you want. Absolutely nothing will be sent to any email on the domain. https://mailchimp.com/contact/ https://mailchimp.com/contact/ Click “legal & privacy questions”, then “access our contact form”
xster 9y ago
Not a flippant response: Curious why this isn't the default mode of operation: - Business sends spam - Gmail users mark spam as spam - Gmail starts putting all emails from business as spam for all Gmail users - Business fails - New businesses don't send spam I can't imagine Gmail being in bed with spammers since Gmail gets paid when spammers pay Gmail to put spam on top of all your emails, not when spam is in your emails.
- tyingq 9y ago
  New domains are cheap. You don't spam from mybiz.com You spam from mybizmail.com, mybizmarketing.com, mybizoffers.com, etc.
  - xster 9y ago
    Is that really the problem though? Most of the junk that makes it into my mailbox are from real businesses that probably stands to go bankrupt if they had to change their domain name. But they all have to spam because that's what the market does now to win.
    - tyingq 9y ago
      Facebook notifications come from facebookmail.com, CarMax spams from email-carmax.com. AT&T uses att-mail.com. And so on. They don't all do it, but many do. And if they burn their main domain, it's an easy option.
pedalpete 9y ago
I believe this benefits MailChimp's business model. They charge based on how many subscribers are in your lists, so a single opt-in increases how many people sign up and therefore how many people they charge for. I'll be leaving MailChimp because the cost outstrips the value as our list has grown.
wdr1 9y ago
I wish MailChimp (and others) would stick with double opt-in. However, if we've lost that battle, it would be nice if they gave a user the option to require double opt-in on their email before being added to a new MailChimp list.
andrewdubinsky 9y ago
Lots of competitors only use single opt-in & have more favorable policies for list owners. I'm not sure they have a choice.
proactivesvcs 9y ago
I had no idea MailChimp ever used any sort of opt-in. More than half the MailChimp-delivered email I get is spam.
InternetOfStuff 9y ago
Form a German perspective, that was a pretty close call. As the article states, in places like Germany, double opt-in (or an equivalent) is mandated by the application of German (or even EU?) law. If they had really gone through, they would have put their German users into a legally vulnerable position. The rudeness of meddling with customers' settings notwithstanding, this kind of lapse is inexcusable from a company specialising in mailinglist delivery.

224 points by svacko 9y ago

They are just changing the setting, and creating a new default. Not sure why a user of MailChimp would feel the need to switch, or complain they "only" have 7 days to switch the setting to what they want. That's not an unreasonable burden.

caf 9y ago
This is explained near the end of the article: Changing the settings for my own mailing list (which of course, I did) isn't actually a solution. Sure, it stops toerags using my newsletter as an email bomb but it doesn't stop many more MailChimp-run mailing lists switching to a system that will increase the amount of unwanted emails flying around the internet.

technion 9y ago

There's another thing going on here. Over the last 24 hours I've reported a half dozen accounts that have flooded our domains with fake statements and links to Mailchimp hosted .js malware downloads. This has never been a problem before but right now it's out of control. Noone signed up for, what I'm assuming is, hacked newsletters on hacked mailchimp accounts, and suddenly anyone on any address list is now on the receiving end of this garbage.

dharmon 9y ago

They haven't "gone bananas". Removing double opt-in means more subscribers, which means higher revenue for them. Their revenue is based on subscriber counts, no matter how they were obtained. I hope everyone else does what I do: any bulk emails I did not subscribe to get marked as spam in gmail. Even a company the size of mailchimp can't cycle and "warm" email servers fast enough if a critical mass of people are tagging unsolicited emails.

detaro 9y ago
I'm curious to see how many of their German customers don't realize they have to explicitly set this now. Here, your competitors can you sue/"fine" you for having single opt-in only.
chomp 9y ago
It doesn't matter if they believe that it's higher revenue, GDPR requires consent from the data subject [1] to process personal data. An email address is personal data under GDPR. You can't guarantee consent with single opt-in. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
- sgarman 9y ago
  Does this fall under mailchimps responsibility or the company using their services?
  - munchbunny 9y ago
    The short answer is both. There's a somewhat longer answer about how MailChimp would need to make the company agree to a separate contract around liability issues, as per GDPR requirements.
- revelation 9y ago
  Even without GPDR single opt-in is already insufficient in e.g. Germany. If you send a newsletter to some lawyer and can't prove consent you might just get a C&D with statutory damages back.
CodeWriter23 9y ago
In the short term, probably more revenue. But once they race to the bottom of deliverability rates (like SES, for example), MailChimp will forever have lost it’s major defining feature: emails that actually make it to the inbox.
- stefan69 9y ago

seizeheures 9y ago

What reliable service should one use then? MailChimp is still pretty much the go-to option for me

deleted 9y ago
[deleted]
Theodores 9y ago
How hard can it be to send an email? Why pay $$$ for it? For deliverability, which is pretty good on Mailchimp. However I think that send emails out using the gmail API or the Amazon SES might be the way to go. Also depends on what you are doing, I think that those that over analyse the mail openings are getting it wrong, focusing on the wrong metrics. You should be focused on the sales metrics not be navel gazing in newsletter software. Content is king, get that right and again, focus on that, not the analytics.
- pixl97 9y ago
  >How hard can it be to send an email? Are you serious? Sending an email is really easy. Actually having the remote deliver it to the remote mailbox is the problem.
devdad 9y ago
Sendgrid is solid.
- BillinghamJ 9y ago
  I tried using it once. It did not seem solid. It didn’t support 2FA, and required my actual account username and password to send email from the server.
  - sethammons 9y ago
    2FA has been supported for years at this point at SendGrid. Edit: and API Keys are the recommended way to interact with SendGrid APIs

martin_a 9y ago

We use Mailchimp for B2B newsletters and have several thousand subscribers in our lists. This is the first time I hear anything about this. No mails whatsoever although I am a German user.

jontro 9y ago
I've received two mails in the past week. http://mailchi.mp/f3bc9acebf61/were-making-important-changes-to-the-signup-process http://mailchi.mp/f3bc9acebf61/were-making-important-changes... http://mailchi.mp/5fbac34cf976/were-making-important-changes-to-the-signup-process-850741 http://mailchi.mp/5fbac34cf976/were-making-important-changes...
- stefan69 9y ago
  Ditto.

Taniwha 9y ago

Time to shitcan mailchimp in my mail server I guess

Nerada 9y ago

Is this going to affect MailChimp's deliverability? It seems like it would, my understanding is the reason most relays and blacklists are so lenient with MailChimp is exactly because of their double opt-in policy. Looks like they're ultimately throwing their long-term business under the bus for a short burst of extra cash.

jlgaddis 9y ago
Absolutely it will. If you use MailChimp and care about deliverability, I would recommend you begin looking at alternatives (if you haven't already).
- andyfleming 9y ago
  Don't most other providers already do single opt-in by default already anyway? Really, MailChimp is just sinking to their level. It's not all of the sudden worse than alternatives, right?
  - jlgaddis 9y ago
    > Don't most other providers already do single opt-in by default already anyway? Yes, most others have already switched to single opt-in. > It's not all of the sudden worse than alternatives, right? No, they aren't all of a sudden worse than the alternatives. They were already worse and they're certainly not going to improve as a result of this change. I manage several e-mail servers and will be watching very closely -- even more so than usual -- the amount of spam coming from MailChimp. I usually start out by blacklisting individual IP addresses but if this becomes a big problem, I will simply blacklist them entirely and be done with it. I've had two "incidents" in the last week or so with MailChimp that they have shown little interest in "fixing" (unrelated to this change) so I'm already inclined to do exactly that.
- inopinatus 9y ago
  I suggest the same dirt will attach to one's reputation if using Mandrill or Tinyletter, both of which are Mailchimp subsidiaries and share outbound address ranges.

conductr 9y ago

Not a user but does single opt-in "by default" imply there is a setting to flip it back to double opt-in? If so, flip the switch

stefan69 9y ago
Correct - they state you can still use double opt-in if you want to.

pavlov 9y ago

This only affects signup forms hosted by MailChimp. If you build your own form and use their API for signups, there has never been a requirement for double opt-in. So I don't know if this is such a dramatic change -- depends on how many people use the default forms instead of an integrated signup experience.

notahacker 9y ago
Yeah, don't understand some of the responses which seem to assume this change will make MailChimp any more spammer-friendly. If you want to spam with MailChimp (or for that matter most other list providers) you import the long list of people you want to spam in csv form and disregard warnings about only importing emails from people if they've previously expressed interest in receiving notifications from you. Double opt in for new signups makes no difference. MailChimp's ability to be regarded as a non-spammy mailing list provider depends mainly on them weeding out customers who import lists of people who haven't expressed any interest to indiscriminately blast mailshots, not on requiring an additional step after an individual actually visits a website, types in an email and clicks a button sending a post request to the mailing list.
- alloyed 9y ago
  The concern here is revenge-spam: someone takes your email and submits it to every mailchimp default form they can find automatically, and then your inbox is flooded with ostensibly legitimate email that you have to manually unsubscribe from, for each individual list.
  - notahacker 9y ago
    I understand the concern on an individual level as expressed in the article, but doubt "revenge spam" even moves the needle with mail providers' decisions on MailChimp mails get through or not, which is the primary concern of people worrying about its deliverability.

jlgaddis 9y ago

For my fellow mail server administrators: * 205.201.128.0/20 * 198.2.128.0/18 * 148.105.0.0/16 Those are the ranges you'll want to add to your blacklists.

deleted 9y ago
[deleted]
DKnoll 9y ago
Blacklisting would be pretty irresponsible, greylisting maybe.
- jlgaddis 9y ago
  On my servers, they are already greylisted (almost everyone is, by default). Greylisting works very well against most spammers, hijacked PCs, etc. (I use "spamd" [0] from OpenBSD, which also makes blacklisting very easy, FWIW). In MailChimp's case, the only thing that greylisting would accomplish is delaying the amount of time I wait to get their spam^We-mails. [0]: https://man.openbsd.org/spamd.8 https://man.openbsd.org/spamd.8
  - DKnoll 9y ago
    Wrong terminology, my bad. I meant adding a rule for MailChimp origin emails that increases spam score but doesn't necessarily doom the message alone. Dropping their mail altogether would definitely cause some legitimate messages to be lost.
dredmorbius 9y ago
Confirming: https://mailchimp.com/about/ips/ https://mailchimp.com/about/ips/

ungzd 9y ago

That is not problem of Mailchimp, it's problem of culture and "best practices". It's really annoying and it became annoying long before this change. I receive lots of such emails not only from Mailchimp. At least Mailchimp has one-click unsubscribing, most custom-built mailing list systems don't have it, requiring to log in or just not working. The problem with Mailchimp is: - Spam filters work mediocre, despite AI hype. I think they are still based on linear regression on bag of words or something like that. Instead Gmail blocks your server if it sends mail for the first time instead of being large company's server that already sent 1e100 emails. - Mailchimp exploits this. You can't send email on your own and have to buy their service. It also spreads additional FUD that you must use it, otherwise all your mail goes to spam. - Gmail treats Mailchimp as privileged sender so if I mark promotional emails from hottest startups as spam, new similar emails are not sent to spam folder. - Hottest startups know this and subscribe you to all their mailing lists each time they got your email.

stefan69 9y ago
One workaround is to use disposable email addresses when signing up to anything online, like https://forward.cat https://forward.cat
- xster 9y ago
  Why not spamdecoy.net? It does the same thing and you never give your real email to anyone (though forward cat is open source so it's probably ok), and you don't have to set up anything before you use the temporary email.
  - djrogers 9y ago
    > (though forward cat is open source so it's probably ok) Curious about this - how can you have an 'open-source' service? I'm not compiling or running the software, and I have no idea what their software is actually doing because there's no way to verify that it's the same as what's been open-sourced...
- JeanMarcS 9y ago

kadfak 9y ago

I recently set up a mail server with DKIM, SPF, DMARC configured correctly. After spending a day fighting with major email services to not mark my emails as spam, I really saw the value of email service providers. But the damn prices... Are there any alternatives to traditional email that could potentially replace it in the near future?

CaptSpify 9y ago
I find that odd as after I set up my email server I haven't had any issues. I'm not trying to discredit your experience, but I just never had that issue myself. Is it possible that you've got an IP that was previously used for spam?
snowwrestler 9y ago
If you are starting a new bulk mail service, you have to be very careful about the IP address. It can't be from a known suspicious IP range (e.g. any part of Amazon EC2). It can't be an IP that already has a bad reputation from a previous service running on it. It can't be an IP that is currently running a bunch of other services and sites. Even then, you have to "warm up" the IP by slowly increasing the send volume from it, over about a month, while maintaining low spam scores. It's a pain in the ass, which is why email service provider is a business model. There are alternatives to email, like targeting and boosting social media posts. But generally speaking, they are all more expensive than email, even taking into account service provider fees.

stefan69 9y ago

As a marketer, one of the issues I run into is to subscribe someone, who filled a contact form on my website, to an email automation series (usually to nudge them towards taking an extra action while we scramble to get back to them). Problem is, once the user filled up the contact form to make an enquiry, he is unlikely to go to his/her inbox to confirm... a subscription link. I do think double opt-in is the way forward (as outlaid in the article), but having that single opt-in option for some special cases is necessary from a business point-of-view. Overall, pretty good compromise by Mailchimp.

hobarrera 9y ago
This doesn't really affect the scenario you mentioned. Previously users entered their email just once, and had to confirm newsletter subscription via email. They didn't need to fill in a second form or anything, just confirm they wanted to sign up by clicking a link on an email they get.
jlgaddis 9y ago
> Problem is, once the user filled up the contact form to make an enquiry, he is unlikely to go to his/her inbox to confirm... a subscription link. Or, worded another way: the user really doesn't give a damn about your subscription. If they can't be bothered enough to take a few seconds to open one e-mail message and click on a single link, then whatever you're offering obviously isn't something that they actually want. As a non-marketer, it seems to me that marketers would want something like double opt-in -- just so that you can ensure that those on your list are people actually interested in $product. Or is it more about the quantity of users on your list and not the quality of those users?
- SomeStupidPoint 9y ago
  My (somewhat glib) opinion: Marketers want quantity; salespeople want quality. It's because that's what each one is paid for -- and so companies end up paying too much for marketers to undercut their salesteams' effectiveness because they misaligned the incentives, pay for marketing they don't need (or even harms them!), and then sit there wondering why it's not translating into sales (or worse, saturates salespeople with duds and costs sales). I used work in marketing and my (slightly exaggerated) opinion is you should fire everyone on your marketing team, hire more salespeople, a socialmedia person, and maybe a single dedicated person to track overall sales performance. But what's the point of marketing? You should be selling from that first contact -- and if you have two teams doing the same job with differing incentive structures, no wonder your organization is inefficient and pulling at different goals.

makeramen 9y ago

Would be nice to have some sort of do-not-call list equivalent for email mailing lists, or at least something that forces double-opt-in on the receiving end. Too bad we're not MailChimp's customers so they could care less really.

BillinghamJ 9y ago
Couldn’t care less?
- makeramen 9y ago
  Oh ok. Thanks.

hobarrera 9y ago

So, MailChimp will make more money, as users get more unwanted emails, and clients have to pay for it. Wow.

Nition 9y ago

From MailChimp's second post[1]: > More and more business owners are bringing up double opt-in. What they’ve been saying is that double opt-in is not an easy journey for their customers. Some go so far as to say that double opt-in is “broken.” I would go so far as to say if customers cannot be bothered clicking one confirmation link in an email, they didn't really care about your newsletters. [1] https://blog.mailchimp.com/why-single-opt-in-and-an-update-for-our-eu-customers https://blog.mailchimp.com/why-single-opt-in-and-an-update-f...

danielfoster 9y ago
I used Mailchimp to collect email addresses for an beta user waitlist in 2015. I eventually used a work-around to disable double opt-in because so many users had signed up, never clicked the confirmation email, and were then confused why they never received access to our product when others had. As a user I also prefer single opt-in. If I sign up for something, I want to be signed up. Clicking confirmation links is an annoying extra step.
- caf 9y ago
  Here's the thing, though. As a user, if I start getting your mailing list emails because someone else decided to sign me up and there was no confirmation, I'm going to mark it as spam.
  - Gustomaximus 9y ago
    That should be a minimal number of cases, reduced further by having a big clear one click unsubscribe option. It always amazes me the business that make unsubscribing difficult. That is the real way to get placed in spam.
    - caf 9y ago
      Does anyone trust the unsubscribe link in apparent spam, though?

synicalx 9y ago

Honest question here, does anyone actually want to receive newsletters? I don't think I've ever set foot in the 'Promotions' tab in my Gmail account, other than to delete everything in it.

wishinghand 9y ago
The ones who sign up for them do. I read Javascript/Node/goweekly.com newsletters in their email format. The Phaser.io newsletter is another. I think you're more the outlier than the norm.
derefr 9y ago
Some of my favourite "blogs" are only available in the form of e-mail newsletters. patio11's post-BingoCardCreator blog, for example, only existed as a newsletter (with non-indexed webpage alternates) for the longest time—though I see that there's now an index (http://www.kalzumeus.com/archive/ http://www.kalzumeus.com/archive/), complete with RSS meta-tag. In other cases, newsletters can serve as a sort of low-volume link aggregator. I'm subscribed to the http://elixirdose.com http://elixirdose.com newsletter and end up with a few Elixir-related articles to read each month. In other cases, it's just fun to follow regular company newsletters, because those companies are essentially soap operas in progress. The http://zenmagnets.com http://zenmagnets.com newsletter is 90% about their ongoing legal battle against the Consumer Product Safety Commission. And, every once in a while, I appreciate getting informed that a product/service I've built something on top of—but which I'm not actively building on right now (i.e. I pay them money every month, but I never go to their website)—has new features, which might inspire me to build something else on them. I like getting announcement emails from {AWS, DigitalOcean, Twilio, etc.} for this reason.
- patio11 9y ago
  My blog and newsletter are ~separate, FWIW. As far as I am aware I do not have an RSS or single page listing the newsletter archive.
joejev 9y ago
I get newsletters for a few music labels to see their new releases. I also get announcements for local music shows.

shampster 9y ago

"double opt-in" is a term I'm used to hearing in a pejorative way from the pro-spam side. The anti-spam side calls it "confirmed opt-in" which I think is a more accurate description.

JohnTHaller 9y ago
Anyone calling it 'double opt-in' has the whiff of being a spammer even if they aren't one. If you're not checking that the subscriber clicked the "yes I want this" link in the email, anyone can subscribe anyone they want to your mailing list. There are tons of 'email bomb' services that will 'subscribe' a target to 100s or 1000s of newsletters that don't confirm opt-ins.
- jlgaddis 9y ago
  > Anyone calling it 'double opt-in' has the whiff of being a spammer even if they aren't one. Wow, I'm kinda surprised to hear that because I manage several e-mail servers (for thousands of users) and I am about as anti-spam as one can be. I'm certainly way more aggressive in spam filtering than most others I know. I run my own RBLs (shared across several different systems); I have spamtraps and keep a handful of domains registered solely for that purpose; I do tarpitting; I will blacklist domains and IP addresses -- or ranges of addresses -- at the drop of a hat; and much more. Until reading this thread today, I have never even heard the term "confirmed opt-in". "Double opt-in" is what I've always heard it referred to as and so that's what I've always called it. As I said, I'm about as opposite of a spammer as one can be. You should be careful about making such broad generalizations or accusations.
  - JohnTHaller 9y ago
    Years ago, email marketing companies schemed to use the phrase 'double opt-in' to make the process seem more onerous ('ugh, double the work is so unnecessary, right?') even though the original term was 'confirmed opt in' or 'verified opt in'. That original terminology was specifically chosen because without it, there's no way to know if the email address typed into that online form was someone legitimately signing up or not. Especially when email bombing was much more popular 15 years ago. Sadly, many folks only know the 'double' term these days. 'Double' is more commonly used today since email marketing firms do most of the talking about it. For instance, "confirmed opt in" has 92k results in Google while "double opt in" has 438k. It's much the same as the way the gambling industry rebranded themselves as the 'gaming' industry. Although in the case of 'double opt in' it's been more successful.

ynniv 9y ago

Come on, this should be really easy to fix. If MailChimp is really sending you so many emails that you are upset with their service, you should be able to make your own MailChimp account and tell them that your email address requires double opt in. Or you can make a rule for their MX to end up in a special folder. Or they can detect a well above average number of lists for a single email address and trigger double opt-in for that address. This is a problem for a vast minority of users.

tomc1985 9y ago

I wish there was a non-consentual way to force businesses to continue needed products and services. The narrative lately (especially here on HN) has been seemingly nothing but firms watering down --if not sunsetting-- valued products and services for their own seemingly selfish ends. "Business isn't charity" -- maybe it should be. At the least we'd get more service-oriented folks in charge, instead of the current crop of profiteering assholes that infest these lands.

mintplant 9y ago

> And a small number of these people might think it's worth their effort to sign up my publicly-available email addresses to hundreds, no... thousands of legitimate newsletters and mailing lists that I have no interest in. People do that to my email, too, but they call themselves "growth hackers".

xster 9y ago

I imagine it can't be the most profitable market to write spams in Cantonese. [subtitle: it's like sending spam in Glaswegian]

BillinghamJ 9y ago

You can actually get your entire domain blacklisted on Mailchimp if you want. Absolutely nothing will be sent to any email on the domain. https://mailchimp.com/contact/ https://mailchimp.com/contact/ Click “legal & privacy questions”, then “access our contact form”

xster 9y ago

Not a flippant response: Curious why this isn't the default mode of operation: - Business sends spam - Gmail users mark spam as spam - Gmail starts putting all emails from business as spam for all Gmail users - Business fails - New businesses don't send spam I can't imagine Gmail being in bed with spammers since Gmail gets paid when spammers pay Gmail to put spam on top of all your emails, not when spam is in your emails.

tyingq 9y ago
New domains are cheap. You don't spam from mybiz.com You spam from mybizmail.com, mybizmarketing.com, mybizoffers.com, etc.
- xster 9y ago
  Is that really the problem though? Most of the junk that makes it into my mailbox are from real businesses that probably stands to go bankrupt if they had to change their domain name. But they all have to spam because that's what the market does now to win.
  - tyingq 9y ago
    Facebook notifications come from facebookmail.com, CarMax spams from email-carmax.com. AT&T uses att-mail.com. And so on. They don't all do it, but many do. And if they burn their main domain, it's an easy option.

pedalpete 9y ago

I believe this benefits MailChimp's business model. They charge based on how many subscribers are in your lists, so a single opt-in increases how many people sign up and therefore how many people they charge for. I'll be leaving MailChimp because the cost outstrips the value as our list has grown.

wdr1 9y ago

I wish MailChimp (and others) would stick with double opt-in. However, if we've lost that battle, it would be nice if they gave a user the option to require double opt-in on their email before being added to a new MailChimp list.

andrewdubinsky 9y ago

Lots of competitors only use single opt-in & have more favorable policies for list owners. I'm not sure they have a choice.

proactivesvcs 9y ago

I had no idea MailChimp ever used any sort of opt-in. More than half the MailChimp-delivered email I get is spam.

InternetOfStuff 9y ago

Form a German perspective, that was a pretty close call. As the article states, in places like Germany, double opt-in (or an equivalent) is mandated by the application of German (or even EU?) law. If they had really gone through, they would have put their German users into a legally vulnerable position. The rudeness of meddling with customers' settings notwithstanding, this kind of lapse is inexcusable from a company specialising in mailinglist delivery.