4 ms·

There is an obvious solution, do not send emails to gmail addresses.

by jbuhbjlnjbn 5y ago

aembleton 5y ago
... or to domains that use gmail. Possible to find out using dig but not as simple as avoiding gmail addresses.
- toast0 5y ago
  Only if the domain uses google's MX as the public facing MX. If it delivers to an intermediate MX for filtering or archiving or ??? and then redelivers to google, it's not visible. Of course, if you don't set the public MX to google, blackberry phones won't use the right SMTP for outgoing mail, and then mail will fail DMARC, because you can't actually configure the SMTP server anyway. Hope they fixed that in BB10, before they stopped selling phones.
  - account42 5y ago
    > If it delivers to an intermediate MX for filtering or archiving or ??? and then redelivers to google, it's not visible. That is a) a very odd and theoretical setup b) probably would cause Google's MX to reject most messages for SPF failures
    - ashtonkem 5y ago
      You don’t even need MX trickery to make this an issue; how many people who moved over to Gmail setup forwarding rules from their old email address to Gmail? You’d never be able to tell from the outside that your messages are going to an unsafe location
    - toast0 5y ago
      This is not theoretical, if you've got say support@example.com that goes to your support queue, and employee@example.com that goes to your employee, and you want employee email on G Suite, your options are: a) have your own MX that handles support mail and forwards employee mail to Google MX; G Suite provides a not exactly public domain you can forward to and you can whitelist your forwarder(s) IPs so Google uses the received headers for spam checking and SPF checks. If you don't setup the whitelist properly, a lot of mail will bounce or get flagged, yeah; but Google isn't dumb, they detect mail forwarding IPs with good behavior and will eventually semi-whitelist them without intervention. b) The opposite way, where google is public MX and then delivers either specific addresses or unhandled wildcards to your MX to manage the support queue. (Or you might also forward it to a third party). c) some people use third party email archival services (for example, ProofPoint) or virus scanning that shows as the public MX, and then forwards to some other MX for actual delivery
    - aembleton 5y ago
      > a very odd and theoretical setup Nope, I use https://mxguarddog.com/ https://mxguarddog.com/ for one of my domains. That acts as a spam filter, but also hides the ultimate MX host.
ashtonkem 5y ago
You can give out this advice, very few people will follow it. Given the choice between giving up some privacy and the convenient of sending an email to a friend or colleague using gmail, the vast majority of people will choose the latter. Meaningful improvements to privacy must come with negligable convenience tradeoffs if you want people to actually adopt them.

There is an obvious solution, do not send emails to gmail addresses.

aembleton 5y ago

... or to domains that use gmail. Possible to find out using dig but not as simple as avoiding gmail addresses.

toast0 5y ago
Only if the domain uses google's MX as the public facing MX. If it delivers to an intermediate MX for filtering or archiving or ??? and then redelivers to google, it's not visible. Of course, if you don't set the public MX to google, blackberry phones won't use the right SMTP for outgoing mail, and then mail will fail DMARC, because you can't actually configure the SMTP server anyway. Hope they fixed that in BB10, before they stopped selling phones.
- account42 5y ago
  > If it delivers to an intermediate MX for filtering or archiving or ??? and then redelivers to google, it's not visible. That is a) a very odd and theoretical setup b) probably would cause Google's MX to reject most messages for SPF failures
  - ashtonkem 5y ago
    You don’t even need MX trickery to make this an issue; how many people who moved over to Gmail setup forwarding rules from their old email address to Gmail? You’d never be able to tell from the outside that your messages are going to an unsafe location
  - toast0 5y ago
    This is not theoretical, if you've got say support@example.com that goes to your support queue, and employee@example.com that goes to your employee, and you want employee email on G Suite, your options are: a) have your own MX that handles support mail and forwards employee mail to Google MX; G Suite provides a not exactly public domain you can forward to and you can whitelist your forwarder(s) IPs so Google uses the received headers for spam checking and SPF checks. If you don't setup the whitelist properly, a lot of mail will bounce or get flagged, yeah; but Google isn't dumb, they detect mail forwarding IPs with good behavior and will eventually semi-whitelist them without intervention. b) The opposite way, where google is public MX and then delivers either specific addresses or unhandled wildcards to your MX to manage the support queue. (Or you might also forward it to a third party). c) some people use third party email archival services (for example, ProofPoint) or virus scanning that shows as the public MX, and then forwards to some other MX for actual delivery
  - aembleton 5y ago
    > a very odd and theoretical setup Nope, I use https://mxguarddog.com/ https://mxguarddog.com/ for one of my domains. That acts as a spam filter, but also hides the ultimate MX host.

ashtonkem 5y ago

You can give out this advice, very few people will follow it. Given the choice between giving up some privacy and the convenient of sending an email to a friend or colleague using gmail, the vast majority of people will choose the latter. Meaningful improvements to privacy must come with negligable convenience tradeoffs if you want people to actually adopt them.