13 ms·

I manage an outbound mail server for a mid-sized company. I happen to also use it for my own personal mail. We have had on and off deliverability issues for ye

• walrus01 5y ago
  Not everyone can spend $500 on lawyer billable hours per SMTP destination multiplied by N number of destinations. I also think that the likelihood of success in sending legal threats to somebody that demand they accept your SMTP traffic will not stand up in court, if you ever escalated it that far. As somebody who runs postfix MX on the receiving side of things, I can guarantee you that the day I receive a legal threat from some unknown third party with which I don't have a pre-existing business/contract relationship, demanding that I accept their email, is the day that I blacklist their entire organization and tell them "okay, I'll await service of your statement of claim". You actually think that the best answer to a network engineering problem is to make legal threats at third party ISPs? Companies with which you don't have a signed service order contract and/or master services agreement? You say you're a mid sized company. I think you're running a huge legal risk of angering a Comcast or AT&T size entity that has much deeper pockets and legal resources than you. The day that one of those giants calls you out on your bluff is going to be very expensive. On an ISP-to-ISP relationship level, this is not how you solve SMTP flow traffic problems. I can tell you that if I went to a NANOG conference representing my AS and proudly told other people "oh yeah, we've started sending threats from our lawyers to $OTHERISP1 and $OTHERISP2 because they won't take our mail traffic", that I would quickly be treated as a pariah.
  • mhh__ 5y ago
    Could you get a lawyer to draft you one template that looks scary while also not leading to much follow up unless you really want to be whitelisted by that particular entity?
  • CPLX 5y ago
    He didn’t say threaten them. It’s pretty easy to envision a situation where a lawyer sends a quite friendly and factual email to a company, that is literally identical to the one the IT head would have sent, but because it’s coming from a lawyer the recipient uses completely different internal routing to process the request. So someone actually takes the request seriously. Seems both plausible and a reasonable thing to do for a company large enough to have a legal department. People pay attention to lawyer letters. You’ve pretty much confirmed as much by noting that letters from a lawyer are so concerning to you that the mere mention of one makes you assume it’s a threat. If you got a letter from an attorney asking for something nicely, and it was a reasonable request you would automatically reply “SUE ME” just on principle? What’s the principle?
    • walrus01 5y ago
      In the American legal system, if somebody spends the money to take the time to have their lawyer hand craft and send me a letter about something such as this, I'm going to take it as a threat whether or not it specifically contains one. The implication is that if you do not do whatever is demanded in the letter, the next step will be the client of said lawyer escalating the situation to paying their lawyer to actually sue you.
      • jahewson 5y ago
        Yes that’s the idea. They’ve spent a bit of money to make a sincere and well-founded request that will cause you to consult your own lawyer who will explain to you why you’re probably doing something wrong and need to do what the letter asks of you. Of course there’s a lot of garbage out there too.
      • CPLX 5y ago
• bo1024 5y ago
  Do you know what the lawyers said beyond "I'm a lawyer and would like you to edit the blacklist" ? Are these companies doing something illegal by blacklisting you unfairly, or do you have grounds for some sort of civil suit (if so, what grounds)?
  • tyingq 5y ago
    I would think "Tortious interference" is the most likely legal basis to complain about it. "Tortious interference is a common law tort allowing a claim for damages against a defendant who wrongfully interferes with the plaintiff's contractual or business relationships"
    • phishersfritz 5y ago
      Safe your 500 bucks per hour. A lawyer will not do anything. A blacklist is not directly interfering with your business. They just provide a list that contains IPs, your IP, and say we have seen spam traffic from it in the last x hours. The mail receiver, who trusts and uses the list might be interfering, but it is his right to pick and choose who he is accepting email from. Same right you have to pick and choose who you let into your bar, apartment, club, house, ... what so ever.
      • jgerrish 5y ago
        Safe your 500 bucks per hour. A lawyer will not do anything Sigh, I think I understand this statement. A warning to patent holders or a call to let it all burn down. A clever appeal to class divisions. I can't work through all the implications. But I do know the "enemy" of my "enemy" is not necessarily my "friend". I've seen the nightmare of the next Internet. Whether it's micropayments for digital stamps, or slowly refilling quotas, or hard hierarchical controls, it's more power to central authority. I know I'll never win this argument. The Internet will keep fracturing and normal citizens will get more frustrated. There will be a change. But just like the hatred of social media, lurking underneath it is an insatiable thirst for power.
      • deleted 5y ago
        [deleted]
• jasode 5y ago
  >Get your legal department involved. We have repeatedly been taken off various public and private blacklists by having lawyers do their job. What's the particular law that makes those curators of blacklists pay attention to your company's lawyers? Do you have example text of those legal requests?
  • _0ffh 5y ago
    Just guessing, but maybe threatening to sue for damages might work?
    • chrisseaton 5y ago
      But the companies aren't obligated to accept your email are they? What grounds do you have to ask for damages?
      • deleted 5y ago
        [deleted]
        • chrisseaton 5y ago
          If someone threatens to sue for damages for something where they are clearly not entitled to damages, why would your lawyers advise you to act on that? If I wrote to you now threatening to sue you for damages unless you delete your comment would you delete it? Why?
      • dqv 5y ago
        I guess you could try to go for the tortious interference angle: I have a contract with the customer which involves interacting with them by email. Customer uses EmailCompany. EmailCompany unfairly blocks me from emailing customer. EmailCompany is interfering with the contract. Both myself and the customer have a reasonable expectation that we should be able to carry out our contract by emailing back and forth, so EmailCompany is obstructing the contract. Any of this sort of "advocacy" only works if the customer actually cares about receiving your emails though. In my experience, the customer will just switch email providers when I tell them we're blocked. I had an email provider just the other day who wasn't accepting my emails. I tried to get them to unblock us, but to no avail. I told my customer and he went and registered a new email elsewhere.
• wolverine876 5y ago
  > Get your legal department involved. Excellent idea, thank you.
• noduerme 5y ago
  Too late to edit my original post, but I want to address a few questions that were brought up by several people. 1. I don't know how the lawyers worded the letters. Obviously it's not illegal for a host to block inbound mail. But clearly the legal team made someone look more closely at our particular case. If you're not doing anything nefarious, it's easy for someone mid-level to clear you off a blacklist if they want to. The company I work for isn't a household name outside a few states, but it's large and respectable enough that getting a cursory glance from someone with the power to say "take them off the blacklist" is probably enough. 2. We've had these IPs for > 5 years. Our reverse DNS, DKIM, SPF are all in order. The mail comes from the same IPs as the company's main website/app services. The company uses Constant Contact for marketing emails, so our outbound server only sends things like receipts for purchases, service agreements, confirmations of renewal/cancellation, verification codes for login (password reset / new signup / new device), and intra-company mail which sometimes goes to employees' personal addresses. Being able to firmly state that we never send marketing off this server, and we regularly assess exim logs and we are sure we've never been hijacked has usually gotten good results, even without lawyers. 3. When we first got these IPs, around 2015, there were more problems. I don't know who they belonged to before. For the first year it was whack-a-mole with the blacklists. But truthfully, I've never had a problem personally getting us taken off any of the public blacklists shown on mxtoolbox. It's the private blacklists of mail providers like AT&T, Comcast and AOL that caused repeated issues. There's no public way to check if you're on these, and as far as I can tell their removal forms are black holes. The removal form for AT&T looks like it hasn't been updated since the '90s, and I've never received even an automated response from using it. 4. We did, for awhile, advise customers to get other email addresses. Unfortunately, the customers with an @comcast or @att account are also probably the least tech-savvy. It's just not feasible to have customers calling their local retail outlet and having a manager spend an hour trying to walk them through why they didn't get their signup verification code, and three days later this bubbles up to corporate and finally to me. And it isn't a good look for us as a company to say "sorry, Comcast doesn't like us for some reason." 5. For awhile we had customers write to Comcast and AT&T asking why they were bouncing important emails from us. Overall this had basically no effect. The customers would get back automated emails telling them how to configure Outlook. However, one such customer was a lawyer who I ended up corresponding with personally (through my gmail account, since he couldn't get my emails), who got such a bug up his butt about it that he seemed to get AT&T to unblock us, which only lasted a month or so. This was where I got the idea to approach the CEO about unleashing the legal department. 6. Variations of "Don't waste $500/hr. on a lawyer". IMHO lawyers are pretty terrible to have against you, and pretty awesome to have on your side. I'm glad I work for a company whose philosophy is to keep as much of our infrastructure as possible in-house, and which also refuses to pony up something that feels like a ransom, even if it would be more expedient. I personally don't have $500/hr. to pay a lawyer, and it would be a much worse uphill battle for a sole proprietor or small company these days trying to manage their own email server than it was ten years ago, or is now even with the backing of a larger company. But it's important to us that we don't get pushed around by big providers, and retain as much autonomy as possible in our business dealings with customers. That's part of the philosophy I brought to the company, it's why we run dedicated hardware, and I'm the one who pushed to spend the money to have the lawyers get involved. If more mid-sized companies took this approach, and if other IT leads pushed for running their own metal and their own mailservers (granted, yeah, it's an endless pain in the ass), then big email providers would be forced to actually take things on a case by case basis the way they did ten years ago, rather than block blacklisting whole /24s with the assumption that every company and individual will eventually cave and be forced into their monopoly. So to whoever says that decline is inevitable, save your money, lawyers suck, etc, without offering any positive solutions: you're welcome.
• Wolfenstein98k 5y ago
  Classic example of regulatory burden in action. Any firm small enough to not have a legal team can't compete. Edit; to be clear I'm not saying this results from some legislation, although you could make that case. Just that scale has many benefits and the principle of regulatory burden obtains!
  • noduerme 5y ago
    Yes, but - if more small-ish companies did this, it could have an outsized impact. The company I work for is to AT&T what like an amoeba is to a whale; not much bigger than a single phytoplankton (e.g. an end user).