19 ms·
Gmail spam-filters Stripe security messages as well
- sahillavingia 8y agoThis is a huge problem with Gmail. They've been filtering legitimate receipts and things from Gumroad in the last couple of months, and I've heard similar things from founders of several other companies. Please check your Spam folder, and mark the legitimate emails as such. Hopefully it'll help the folks (or AI) over at Gmail get better!
- loeg 8y agoI recently got a paper statement from my bank (I'm signed up for online statements only) because the bank claimed my gmail inbox rejected its notification email. (I checked spam, and it didn't land there either.)
- tgsovlerkhgsel 8y agoThere's an ever-growing list of stuff you need to set up to be considered a legitimate mail server. It started long ago with a valid reverse DNS entry, and now you need DKIM, SPF and a bunch of other stuff: https://support.google.com/mail/answer/81126?hl=en https://support.google.com/mail/answer/81126?hl=en Given that banks seem unable to send e-mail that doesn't look like phishing (using non-https links and often separate domains), I don't have high confidence that they can get the basics right.
- loeg 8y agoIn contrast, I've received every one of their past notifications. Earlier bank notifications all show DMARC/DKIM/SPF "PASS" ratings. Who knows.
- awinter-py 8y agoI mean a lot of companies are mixing spam and critical messaging -- square is an example (every place I paid with square is now sending me marketing). It kind of sucks that we still use email for password reset and billing stuff. It's like the digital equivalent of certified mail with most of the same problems.
- shereadsthenews 8y agoThis is the problem. Both of these companies are filthy spammers and are using the same domains and networks for transactional mail as for spam. They've created their own reputation issues. The fact that someone from Gmail spam ops kindly offered to reach in and manually tweak the reputation for PayPal doesn't mean this is a problem with Gmail.
- strogonoff 8y agoFor a few years now I have Gmail’s spam filter disabled completely on my accounts. I’m not sure you can do that with a setting, but there is a workaround where you create a filter that excludes messages matching some random UUID, and tick the “Never send to spam” action. So far to me the trade-off has been worth it (YMMV). Not a huge burden in terms of junk mail influx in my inbox, but one does have to be on alert for high-quality phishing when reading mail (check headers, for example).
- nh2 8y agoThat is exactly what I do (and what results in the "This message was not sent to spam because of a filter you created" message in my screenshot): Create a filter that maches all and selects "Never send to spam" as action.
- nh2 8y agoThis is a follow-up to Gmail putting PayPal classifying PayPal security notification emails as Spam (https://news.ycombinator.com/item?id=19099887 https://news.ycombinator.com/item?id=19099887), and Google stating that it's a problem with Gmail and that they've put in a temporary fix specific for PayPal. Just now, 2 months later, the same issue happened with a security login email from Stripe.
- laurentl 8y agoHonestly, the first time I saw a Paypal email (something along the line of “check out your account activity”) I thought for sure that it was a phishing attempt. Not one link in their emails point to PayPal, they all point to stg like paypal-communications.com. You know, the type of domain name a phisher would come up with. Even the link talking about security doesn’t point to the PayPal website! That, and asking me to check my recent account activity when I know I haven’t used PayPal (and PayPal should also know that), is basically PayPal training their customers to fall for scams.
- nautical 8y agoOne of the reasons I think spammers have been so successful has to do with companies only. Because companies send a LOT of spam emails / promotions etc that they have to come up with alternate domains to send emails. On customer side its very difficult to know the truth.
- scrollaway 8y agoPaypal has ridiculously low standards for their official emails. https://twitter.com/Adys/status/943346017608585216 https://twitter.com/Adys/status/943346017608585216 https://twitter.com/Adys/status/943513254655156224 https://twitter.com/Adys/status/943513254655156224
- anoncake 8y agoWow. Ive been throwing away those messages for months.
- izacus 8y ago
- fooblat 8y agoIf you are using Gmail and you are not checking the spam folder at least once a week there is a good chance you are missing legit emails. At least, this has been my experience for a while now. edit: typo
- tjoff 8y agoGmail has never been usable without turning off the spam detection. They make it kind it a bit cumbersome, you have to create a filter that overrides it. https://webapps.stackexchange.com/questions/69442/how-to-disable-gmail-anti-spam-completely https://webapps.stackexchange.com/questions/69442/how-to-dis... edit: and even then they think they know better and trash some mails as regardless.
- mateo1 8y agoThis has been my experience as well, but even with only 2 accounts it takes several clicks and quite a few seconds of waiting to check all of my email because it's also fragmented with the 'social', advertisement' and 'main' tags.
- ValentineC 8y ago> even with only 2 accounts it takes several clicks and quite a few seconds of waiting to check all of my email because it's also fragmented with the 'social', advertisement' and 'main' tags. I've kept those "tags" turned off on every Gmail account I control — I'd rather not risk having something important enter "social" or "promotions".
- asdfasgasdgasdg 8y agoNo exemplars since March 1 for me. 179 true positives and zero false positives.
- GordonS 8y agoWhat really annoys me is that (with the web version at least), you need to click a "More" link to even see how many spam emails you have sitting unread, so I don't get a visual reminder to check it occasionally :/
- mesaframe 8y agoSituation is worse with Outlook. They'll mark mails from Microsoft itself as spam.
- aendruk 8y agoThis is good. Several of the messages from Microsoft that I've received in my Office 365 mailbox are spam.
- vimslayer 8y agoThis. So many people in this thread seem to think that an email needs to be from a Nigerian Prince to be spam.
- Fogest 8y agoA good chunk of emails I get from YouTube go to spam. I have notifications on by email for when some youtubers post new videos: https://i.imgur.com/8E0oGrP.png https://i.imgur.com/8E0oGrP.png However some of them do not get spam filtered, only a chunk of them do. It's weird because these come from YouTube, so it's a similar problem where Gmail is filtering Google emails....
- massaman_yams 8y agoAnd allow the occasional obvious phish to deliver to the inbox.
- jcims 8y agoIn my experience the amount of Microsoft-themed phishing attempts that make it through Outlook (O365) is unbelievable.
- jetrink 8y agoI just checked my spam folder and there is an email from YouTube in there. (It is a notification that I subscribed to telling me that one of my favorite channels posted a new video.)
- cmurf 8y agoI'm confused. How is it in 2019 that financial services companies, in particular ostensibly internet savvy companies, aren't using DMARC? How in the world can authenticated legitimate emails ever end up in spam? And surely by now Google spam filtering has a pretty good idea what emails can be categorized as "financial institution" likely, and if they aren't conforming to an agreed upon DMARC policy to put those in spam? Or even better, a mandatory agreed upon tag that indicates the content is 'financial institution account security notification' related (i.e. not marketing spam from that institution), but any emails that use that tag but don't also use the agreed upon DMARC policy always go to spam.
- massaman_yams 8y agoDMARC already allows a domain owner to specify a recommended action (no action, quarantine, or reject) to take in the event an ISP receives a message that fails DMARC. This DMARC policy can be published at the subdomain level, and best practice is for organizations to use separate IPs/subdomains for sending different types of mail traffic (security notifications vs. marketing, for example), so security notifications can have a significantly stricter policy than marketing mail. In the paypal example, the 'via' in the from address line is an indicator the message is not DMARC aligned (but doesn't tell us whether or not the actual originating domain publishes a formal DMARC record - I can't tell that since it's blacked out in the GH post). So for the paypal example, you're right, it looks like they're most likely not following best practices. It may be possible that the 'via' domain is simply a different legitimate paypal domain, which is an edge case that DMARC isn't designed to cover - I think we'll see a technical standard emerge in the next 5 years to handle that kind of thing; maybe built on some of what BIMI is doing - https://www.ietf.org/id/draft-bkl-bimi-overview-00.txt https://www.ietf.org/id/draft-bkl-bimi-overview-00.txt
- unilynx 8y agoWhy should DMARC (unless combined with a whitelist) be a non-spam signal ? Spammers would quickly learn to set up the proper DNS records.
- massaman_yams 8y ago
- deleted 8y ago[deleted]
- cavisne 8y agoThe problem with both domains is they can be used for actual spam, like fake invoices/receipts.
- RIMR 8y agoWith a proper SPF record, we can verify whether or not they came from the right servers. Google verified that PayPal's e-mails were legitimate. You can't spoof those addresses convincingly unless you compromise a legitimate mail server listed in the SPF, or hijack BGP to impersonate a legitimate mail server in the SPF. Google is filtering known trustworthy senders for dubious reasons.
- brazzledazzle 8y agoThat’s not what they mean. They mean the services can be used in a “legitimate” way that doesn’t involve hijacking to spam people.
- aloukissas 8y agoJust the other day, I posted a similar question [1] here, after discovering that even gmail-to-gmail messages I send to my close friends get categorized as spam. There has been a significant regression in Gmail's spam filter recently (both false positives + negatives). [1] https://news.ycombinator.com/item?id=19500357 https://news.ycombinator.com/item?id=19500357
- metildaa 8y agoSpammers are using Gmail for mass mailing now fyi.
- vbezhenar 8y agoI guess Stripe is big enough to notice for them. But imagine tiny website. Is there any chance to reach gmail developers in case of similar failure? Gmail just makes e-mail an unreliable transport.
- deleted 8y ago[deleted]
- pxtail 8y agoDon't worry, AMP-emails will work reliably for sure
- massaman_yams 8y agoIt's not the best solution in cases of clear false positives, but they do provide a help document outlining what kind of practices result in reduced risk of these kinds of problems. (It's oriented toward high volume senders, but many of the recommendations apply at any scale.) https://support.google.com/mail/answer/81126?hl=en https://support.google.com/mail/answer/81126?hl=en
- sjagoe 8y agoTheir postmaster tools don't show anything up at low volumes. I'm a freelance consultant, and my mail volume is very low. Usually setting up contracts, and sending out invoices. Not much else. My mail volume is too low to show up there. I don't send out bulk or promotional emails, I use SPF and DKIM, and I've still seen a lot go to spam. My mail is hosted by FastMail, not a home server.
- mehrdadn 8y agoIs this a Gmail issue or a G Suite issue? You'd think they're similar but they haven't been in my experience. G Suite spam filtering has always sucked for me and others I know. I've gotten completely legitimate replies classified as spam from completely normal and legitimate people in the same domain as far back as 2013, if not earlier. In the case of someone else I know this happened to, it was an extremely critical email that got classified as spam. P.S. If any Gmail folks are here: There's a bug in Gmail/G Suite that might as well be equivalent to marking an email as spam, since it prevents you from seeing emails: last time I checked, the "Important" section of Priority Inbox seemed to sort based on the timestamp of the most recent important email in the conversation, not the most recent email in the conversation. So if a subsequent email comes that isn't Important, the conversation doesn't pop up to the top -- so if it's not on your screen already, you don't see it as unread.
- shereadsthenews 8y agoA lot of large enterprises using GSuite route their mail through external systems that provide various dubious services and which often screw up the spam classification by having dirty VIPs or being open spam relays etc. Perhaps your organization was infected by such a thing. Otherwise having a threaded message or a sender in your address book is a virtually guaranteed saving throw against spam classification.
- mehrdadn 8y agoYou made me go back and check the email I had in mind. I'm not sure to be honest. What I do see is that it soft-failed SPF: > Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning {user@domain} does not designate {IP} as permitted sender) So I guess you can use that to blame the domain owner, but I feel like the fact that it was a reply to my own email should've been enough to allow it through? Moreover, there are other emails around that time that weren't replies but still softfailed SPF, and they were still let through.
- shereadsthenews 8y ago
- phantom_oracle 8y agoGoogles draconian algorithms aside, there are legitimate security concerns with "security alert" messages. Here are some of them: 1. The likelihood of you clicking and opening such an email is higher than regular emails 2. Phishers and scammers know this (point 1 above) 3. Malicious content is embedded in such emails 4. It is very effective, even against tech-savvy individuals
- renholder 8y ago>Malicious content is embedded in such emails Isn't that what content scanning is supposed to check for? I mean, it's not like they're not scanning the email body for keyword extrapolation, anyways, right? To be fair, though, Stripe should change their SPF record to hard-fail (-all). ;; ANSWER SECTION: stripe.com. 600 IN TXT "v=spf1 ip4:173.193.210.51/32 ip4:166.78.69.60/32 ip4:198.2.180.60/32 ip4:13.111.2.227/32 include:spf1.stripe.com include:greenhouse-outbound-mail.stripe.com ~all" stripe.com. 600 IN TXT "docusign=4a93db58-af07-4632-a881-b569d41a6c57"
- speeq 8y agoMy Gmail spam folder has emails from Google Cloud in it which I find amusing because it states the following: > Why is this message in spam? It is similar to messages that were identified as spam in the past. Oh really Google? You've identified your own emails as spam? Well then!
- kyrra 8y agoIt's more like people are cooking spam when they get the emails.
- sjagoe 8y agoI hate GMail and G Suite spam filtering. I am an freelance consultant, and a number of times I have seen my business email (hosted at FastMail) go to spam in a Google hosted mailbox. As a single consultant, I don't send a huge volume of mail because a number of my clients set me up with their internal email for business communication. The mail that I do send is invoices, and setting up contract signing; that sort of thing. The mails are always expected communication. I have SPF and DKIM configured and validated by FastMail. Mail somehow still goes to spam. I set up with google's postmaster tools, but it shows nothing because I don't send a big enough volume of emails for it to care. I set up dmarc to get reports when mail is delivered under my domain to a GMail or G Suite hosted address. Every single dmarc report (it's easy for me to keep on top of them because my mail volume is that low) is "spf: pass; dkim: pass". I really don't like that the only way to get this looked at is through publicly shaming Google like this; I have not seen any way I can talk to somebody at Google to solve the problem. FastMail support said they were unable to help me solve it either, suggesting I need to send mail into the Google garden and have the recipient click "not spam" until their filter learns.
- tlogan 8y agoI think it is not up to "SPF and DKIM configured". I believe is because of you have some "bad" keyword invoice, money, etc. in the body of the email causing this. I assume that is the problem because when I reported to Google support about "why this Stripe email is in spam" and I provide them with email body. Then reply from Google G Suite support went to spam (since it had email body in it). And of course the fact that you use FastMail does not help.
- Animats 8y agoIt's a Google product. Of course it limits your communication with Google competitors. If you used Google Pay, like you're supposed to, it would work fine. It's a free email system. They have to make money off you somehow. What did you expect?
- nh2 8y agoAs per other comments in this thread, it seems to classify emails from Google products as Spam as well. Also for a minor correction (not that I think this matters): It's not free, it's paid for, because it's a G Suite account.
- deleted 8y ago[deleted]
- tlogan 8y agoI can confirm that there are some big problems with Google spam filter. Even emails from Google G Suite support ended up marked as spam. That started happening like 4 months ago. We had a problem with following emails: - all emails from sns.amazonaws.com are in spam - all Stripe emails about "Suspected fraudulent payment on your Stripe account" are in spam They all say "Similar messages were used to steal people's personal information. Avoid clicking links, downloading attachments, or replying with personal information." Anyway, if you depend on G Suite email to receive important notifications from PayPal, Stripe, or Amazon you will need to monitor your spam folder. It seems like there are some keywords (invoice, payment - I really do not know.) which will trigger spam filter.
- sneak 8y agoI run my own mailserver (not an open relay, long-term ip, et c) and gmail always puts my messages in spam. It’s sad and annoying.
- mike-cardwell 8y agoGoogle recently filtered some emails into spam for us. Those emails were sent by Google Docs, in response to us adding comments to our own private doc. This was all within the same organization. I've also repeatedly seen them suddenly spam filter individual messages in long threads of conversation. Like they weren't taking into account that a message was part of a two way conversation at all, even though they have In-Reply-To and Reference headers linking them to those non spam filtered conversations. They also randomly spam filter transactional emails that we send from our servers that are from our own domain, to the same domain as hosted by GMail, that is fully validated by SPF, DKIM and DMARC. That should never happen. We clearly trust our own domain, so if mail from that domain is authenticated, let the bloody email through 100% of the time! It's like they spent all their time working on how to blacklist email, and zero time working on when to whitelist it. The most important part of a spam filter is the whitelisting.