6 ms·

Gmail is a huge source of spam

100 points by caution 6y ago

deleted 6y ago
[deleted]
laurent123456 6y ago
Only slightly related but it seems Google has also become very bad at filtering spam too? I keep getting agency spam from Indian companies, all with very similar characteristics (HTML emails for IT jobs in the US, where I don't live, from Indian companies). I marked hundreds of them as spam, and even a basic bayesian filter would be able to easily filter this but somehow gmail let it all go through.
- boring_twenties 6y ago
  I don't get any spam in my inbox, but I do get non-spam messages marked as spam all the time, to the point where I have to check my spam folder once or twice a day.
- bluecalm 6y ago
  Yep, it started becoming terrible a few months ago imo.
- x86_64Ubuntu 6y ago
  I used to never get spam in my GMail. Now, every once in a while, I get spam in the form of Google Drive spam (pharmacy stuff) and then I get "You've won Amazon Rewards!!" type of email. It's very strange.
alex_studer 6y ago
Maybe slightly unrelated to the main topic, but: > If you’re worried about mail deliverability issues, don’t be — it’s more or less a myth in $CURRENTYEAR. If you set up DKIM properly and unlist your IP address from the DNSBLs (a simple process), then your mails will get through. Does this match most people's experience? Or is he just talking about the deliverability of smaller providers like Migadu? I run my own mail server and can never send emails to people on Gmail/Microsoft 365/etc unless it's in reply to an email that I received. I've checked DKIM and the DNSBLs, and everything seems correct...is it just a matter of not having enough volume for email providers to trust me?
- ddevault 6y ago
  Send me an email: sir@cmpwn.com I'll see if I notice any configuration issues and report back to this thread.
  - alex_studer 6y ago
    Done, thanks!
    - ddevault 6y ago
      Copying my reply to HN: Some feedback: you should add a PTR record (reverse DNS) for studer.dev and mail.studer.dev. I also noted that your DMARC record has p=quarantine, which depending on the details of your outgoing setup, may cause your emails to be placed in the spam folder if DMARC fails for any reason. I generally advise against using DMARC with any policy other than `v=DMARC1; p=none` or else you're liable to run into issues, it's not a very good standard. Otherwise, your configuration looks good to me. Also try https://www.mail-tester.com https://www.mail-tester.com to see what they think.
      - alex_studer 6y ago
        In case anyone is curious: I checked and the PTR record for my mail server (168.62.161.121 -> mail.studer.dev) is valid. mail-tester.com also gives me a 9.9/10, but I just tried sending an email to a Gmail account and it went straight to spam :( I suspect it's probably a volume thing? As in I'm not sending enough email for Gmail to make any judgements about my mail server, since I'm only an individual. Of course there's not really a great way to resolve that...
        smartbit 6y ago
        For gmail, try adding an IPv6 address with proper reverse resolving. Tip from HN some time ago.
  - Nux 6y ago
bo1024 6y ago
This seems to be going by the "from" header in an email. Do you know these emails were actually sent from gmail addresses?
- ddevault 6y ago
  All of these cases are after the user has verified their email address by acknowledging an email sent to their inbox, so we can be certain that these are actually from genuine gmail.com addresses.
  - bo1024 6y ago
    Interesting, thanks.
google234123 6y ago
So, gmail makes up 41% of registrations and also a large percentage of suspended accounts? This doesn't seem very surprising to me. Also, for me, just because an account was "suspended" doesn't mean it was spam.
- ddevault 6y ago
  A user has been suspended for any reason other than spam exactly once in the entire history of sr.ht.
  - yjftsjthsd-h 6y ago
    The guy who stored his photo library in hg?
    - ddevault 6y ago
      No, that person was just asked to stop doing it and then chose to leave the service entirely as a consequence. They were never actually banned. The person who was banned was a troll, being rude to other users and posting nonsense to various mailing lists and bug trackers.
      - audience_mem 6y ago
        You banned yourself?
samblr 6y ago
>> 5X as many spam registrations on sourcehut are from gmail than from the second-largest offender. Wow, I'm looking at Google in new way now.
- throwaway3699 6y ago
  I get what you feel, but on the flip side, if Google was even more aggressive at policing accounts and even hit 1-2 false positives, only for a scathing post to follow on a popular orange news aggregator, how is that a better situation?
  - sanxiyn 6y ago
    False positives are okay. Google gets scathing posts because they suck at customer service. Hire people to do customer service like everyone else does already!
    - throwaway3699 6y ago
      How does customer service detect a false positive as such any more than a machine can, without 1) enabling social engineering 2) damaging the privacy of unrelated users by snooping in their account?
      - zamadatix 6y ago
        Customer service can offer a path of recourse for the false positive. If the AI understood how to deal with it it wouldn't have closed it and since nobody is there to explain the AI must have missed something you're just shit out of luck, birth certificate in hand your account was banned because you were underage.
scotuswroteus 6y ago
search for: "unsubcribe" click "delete" done
CameronNemo 6y ago
Anecdotally, my inbox is filled with spam from google forms. Somehow scammers are convincing google forms to send me an email with their message. I imagine it is difficult for my provider to distinguish spam google forms emails from non-spam.
kureikain 6y ago
It's very similar to my experience. 50% of spam come from a valid gmail account, as in, using gmail smtp server, come from gmail origin(.google.com reverse dns) have valid DKIM. The only way to filter out spam is look at the content and run some simple ML on it. 50% of spam come from non .com TLDs such as .cam .work from random servers around the world: China, Bulgari, Hungari, France, Germany... But it's very easy to block other TLDs because their IP are on DNSBL already. But what can I do with gmail? Gmail IP get on DNSBL all the time. Example: 209.85.222.196 is listed right now on spam.dnsbl.sorbs.net and ips.backscatterer.org But at the same time, this is just the nature of an email service. If we have a large user base then no matter what we do, a small percentage of users are abuser which are successfully to send out spam using our services before we can detect and ban them. On AWS SES, they requires user to keep a reputation of less than 0.1% emails flagged as spam. Go over than that and you will be put on a review queue. Reach 5% and get banned permanently. But before that occurs, spam are send out already.
- stjo 6y ago
  Bulgaria* and Hungary*
jsnell 6y ago
I'm confused. What, exactly, is the author looking for Google to do about these "spam registrations"? The abuse problem that an identity provider can solve is bulk account creation, but a) they are already doing a better job of it than any other free identity provider, b) given how low the numbers in the post are, this is clearly not any kind of bulk account issue. (Also, not stating either the total number of suspensions or the proportion of suspensions that are for gmail seems like a conspicuous omission. The author states that 41% of all registrations are from gmail, and the absolute highest proportion of spammy registrations is 63%.)
- ddevault 6y ago
  It is an issue of bulk registration. The reason why the numbers are low is because we detect it fairly quickly and teach their shape to our abuse prevention tools.
  - jsnell 6y ago
    I can only go by the numbers you actually posted. If you have a different data set that actually supports your thesis, why not post those numbers?
    - ddevault 6y ago
      We don't keep stats on discarded registrations, and usually the spammer gives up or changes tactics when they realize what's going on. How exactly does this invalidate my thesis?
      - thu2111 6y ago
        These are accounts that are abusing your website, right, not sending email spam. The problem is Google doesn't know the accounts are bad so its systems never learn to spot the tactics being used to get past the bulk signup controls.
zokier 6y ago
It is unclear if Gmail is proportionally any worse than the others. Is the 119 suspended accounts more or less than 41% of the total number of suspended accounts?
EvanAnderson 6y ago
I guess I'm just lucky. My current personal spam corpus goes back to 2019-05-30. Of the 39454 messages only 80 of them have a ".google.com" server as the immediately preceding "Received:" hop.
skunkworker 6y ago
Recently in the last 6 months Gmail has gotten significantly worse in filtering out spam, I'll get really strange messages showing up in my inbox, where the red ssl ({{domain}} did not encrypt this message) shows up. It's quite frustrating
aendruk 6y ago
I recently migrated off of Gmail and noticed an immediate increase in the amount of spam I receive from Gmail senders. > I’ve forwarded many, many reports to abuse@gmail.com, but… Not sure if it makes much difference but I’ve been using this form instead: https://support.google.com/mail/contact/abuse https://support.google.com/mail/contact/abuse

100 points by caution 6y ago

deleted 6y ago

[deleted]

Only slightly related but it seems Google has also become very bad at filtering spam too? I keep getting agency spam from Indian companies, all with very similar characteristics (HTML emails for IT jobs in the US, where I don't live, from Indian companies). I marked hundreds of them as spam, and even a basic bayesian filter would be able to easily filter this but somehow gmail let it all go through.

boring_twenties 6y ago
I don't get any spam in my inbox, but I do get non-spam messages marked as spam all the time, to the point where I have to check my spam folder once or twice a day.
bluecalm 6y ago
Yep, it started becoming terrible a few months ago imo.
x86_64Ubuntu 6y ago
I used to never get spam in my GMail. Now, every once in a while, I get spam in the form of Google Drive spam (pharmacy stuff) and then I get "You've won Amazon Rewards!!" type of email. It's very strange.

alex_studer 6y ago

Maybe slightly unrelated to the main topic, but: > If you’re worried about mail deliverability issues, don’t be — it’s more or less a myth in $CURRENTYEAR. If you set up DKIM properly and unlist your IP address from the DNSBLs (a simple process), then your mails will get through. Does this match most people's experience? Or is he just talking about the deliverability of smaller providers like Migadu? I run my own mail server and can never send emails to people on Gmail/Microsoft 365/etc unless it's in reply to an email that I received. I've checked DKIM and the DNSBLs, and everything seems correct...is it just a matter of not having enough volume for email providers to trust me?

ddevault 6y ago
Send me an email: sir@cmpwn.com I'll see if I notice any configuration issues and report back to this thread.
- alex_studer 6y ago
  Done, thanks!
  - ddevault 6y ago
    Copying my reply to HN: Some feedback: you should add a PTR record (reverse DNS) for studer.dev and mail.studer.dev. I also noted that your DMARC record has p=quarantine, which depending on the details of your outgoing setup, may cause your emails to be placed in the spam folder if DMARC fails for any reason. I generally advise against using DMARC with any policy other than `v=DMARC1; p=none` or else you're liable to run into issues, it's not a very good standard. Otherwise, your configuration looks good to me. Also try https://www.mail-tester.com https://www.mail-tester.com to see what they think.
    - alex_studer 6y ago
      In case anyone is curious: I checked and the PTR record for my mail server (168.62.161.121 -> mail.studer.dev) is valid. mail-tester.com also gives me a 9.9/10, but I just tried sending an email to a Gmail account and it went straight to spam :( I suspect it's probably a volume thing? As in I'm not sending enough email for Gmail to make any judgements about my mail server, since I'm only an individual. Of course there's not really a great way to resolve that...
      - smartbit 6y ago
        For gmail, try adding an IPv6 address with proper reverse resolving. Tip from HN some time ago.
- Nux 6y ago

bo1024 6y ago

This seems to be going by the "from" header in an email. Do you know these emails were actually sent from gmail addresses?

ddevault 6y ago
All of these cases are after the user has verified their email address by acknowledging an email sent to their inbox, so we can be certain that these are actually from genuine gmail.com addresses.
- bo1024 6y ago
  Interesting, thanks.

google234123 6y ago

So, gmail makes up 41% of registrations and also a large percentage of suspended accounts? This doesn't seem very surprising to me. Also, for me, just because an account was "suspended" doesn't mean it was spam.

ddevault 6y ago
A user has been suspended for any reason other than spam exactly once in the entire history of sr.ht.
- yjftsjthsd-h 6y ago
  The guy who stored his photo library in hg?
  - ddevault 6y ago
    No, that person was just asked to stop doing it and then chose to leave the service entirely as a consequence. They were never actually banned. The person who was banned was a troll, being rude to other users and posting nonsense to various mailing lists and bug trackers.
    - audience_mem 6y ago
      You banned yourself?

samblr 6y ago

>> 5X as many spam registrations on sourcehut are from gmail than from the second-largest offender. Wow, I'm looking at Google in new way now.

throwaway3699 6y ago
I get what you feel, but on the flip side, if Google was even more aggressive at policing accounts and even hit 1-2 false positives, only for a scathing post to follow on a popular orange news aggregator, how is that a better situation?
- sanxiyn 6y ago
  False positives are okay. Google gets scathing posts because they suck at customer service. Hire people to do customer service like everyone else does already!
  - throwaway3699 6y ago
    How does customer service detect a false positive as such any more than a machine can, without 1) enabling social engineering 2) damaging the privacy of unrelated users by snooping in their account?
    - zamadatix 6y ago
      Customer service can offer a path of recourse for the false positive. If the AI understood how to deal with it it wouldn't have closed it and since nobody is there to explain the AI must have missed something you're just shit out of luck, birth certificate in hand your account was banned because you were underage.

scotuswroteus 6y ago

search for: "unsubcribe" click "delete" done

CameronNemo 6y ago

Anecdotally, my inbox is filled with spam from google forms. Somehow scammers are convincing google forms to send me an email with their message. I imagine it is difficult for my provider to distinguish spam google forms emails from non-spam.

kureikain 6y ago

It's very similar to my experience. 50% of spam come from a valid gmail account, as in, using gmail smtp server, come from gmail origin(.google.com reverse dns) have valid DKIM. The only way to filter out spam is look at the content and run some simple ML on it. 50% of spam come from non .com TLDs such as .cam .work from random servers around the world: China, Bulgari, Hungari, France, Germany... But it's very easy to block other TLDs because their IP are on DNSBL already. But what can I do with gmail? Gmail IP get on DNSBL all the time. Example: 209.85.222.196 is listed right now on spam.dnsbl.sorbs.net and ips.backscatterer.org But at the same time, this is just the nature of an email service. If we have a large user base then no matter what we do, a small percentage of users are abuser which are successfully to send out spam using our services before we can detect and ban them. On AWS SES, they requires user to keep a reputation of less than 0.1% emails flagged as spam. Go over than that and you will be put on a review queue. Reach 5% and get banned permanently. But before that occurs, spam are send out already.

stjo 6y ago
Bulgaria* and Hungary*

jsnell 6y ago

I'm confused. What, exactly, is the author looking for Google to do about these "spam registrations"? The abuse problem that an identity provider can solve is bulk account creation, but a) they are already doing a better job of it than any other free identity provider, b) given how low the numbers in the post are, this is clearly not any kind of bulk account issue. (Also, not stating either the total number of suspensions or the proportion of suspensions that are for gmail seems like a conspicuous omission. The author states that 41% of all registrations are from gmail, and the absolute highest proportion of spammy registrations is 63%.)

ddevault 6y ago
It is an issue of bulk registration. The reason why the numbers are low is because we detect it fairly quickly and teach their shape to our abuse prevention tools.
- jsnell 6y ago
  I can only go by the numbers you actually posted. If you have a different data set that actually supports your thesis, why not post those numbers?
  - ddevault 6y ago
    We don't keep stats on discarded registrations, and usually the spammer gives up or changes tactics when they realize what's going on. How exactly does this invalidate my thesis?
    - thu2111 6y ago
      These are accounts that are abusing your website, right, not sending email spam. The problem is Google doesn't know the accounts are bad so its systems never learn to spot the tactics being used to get past the bulk signup controls.

zokier 6y ago

It is unclear if Gmail is proportionally any worse than the others. Is the 119 suspended accounts more or less than 41% of the total number of suspended accounts?

EvanAnderson 6y ago

I guess I'm just lucky. My current personal spam corpus goes back to 2019-05-30. Of the 39454 messages only 80 of them have a ".google.com" server as the immediately preceding "Received:" hop.

skunkworker 6y ago

Recently in the last 6 months Gmail has gotten significantly worse in filtering out spam, I'll get really strange messages showing up in my inbox, where the red ssl ({{domain}} did not encrypt this message) shows up. It's quite frustrating

aendruk 6y ago

I recently migrated off of Gmail and noticed an immediate increase in the amount of spam I receive from Gmail senders. > I’ve forwarded many, many reports to abuse@gmail.com, but… Not sure if it makes much difference but I’ve been using this form instead: https://support.google.com/mail/contact/abuse https://support.google.com/mail/contact/abuse