22 ms·

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

• ilamont 3y ago
  Yahoo: https://blog.postmaster.yahooinc.com/post/730172167494483968/more-secure-less-spam https://blog.postmaster.yahooinc.com/post/730172167494483968...
• teruakohatu 3y ago
  Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.
  • chimeracoder 3y ago
    > Most of the spam I get in gmail apparently comes from other gmail accounts. Are they actually from Gmail accounts, or are they simply spoofing the sender? My bet is on the latter, because Google has heavy restrictions on Gmail that make it impractical to use for sending bulk spam. > I am not sure what a big improvement this will be for the average user. It's not going to be particularly noticeable for the average user, except for the second part (single-click unsubscribe, as opposed to a multi-step flow, is slightly stricter than what's required by CAN-SPAM). It will probably make Google's work easier, though, by having a publicly-known policy of rejecting emails without DKIM, as opposed the the status quo of having that be merely an open secret.
    • andersa 3y ago
      Spoofing the sender to show up as gmail.com on gmail.com is not possible.
    • ericpauley 3y ago
      Gmail also has DMARC quarantine enabled. What’s more likely, that someone broke DMARC or that they stole someone’s password? My bet is on the latter.
    • maybeben 3y ago
      The vast majority of spam we get that isn't trivially rejected (DMARC, malformed HELO, etc) is from real, actual gmail. But they sure do care about _incoming_ spam.
  • asddubs 3y ago
    I've gotten a few emails from my own gmail account, spoofed, which inexplicably did not land in the spam folder. This happened to me on multiple different gmail accounts, too.
    • benatkin 3y ago
      Perhaps they wanted you to see that someone was trying to spoof you. They should have a better way of doing that though :/
    • partiallypro 3y ago
      This happens to me all the time, I honestly am not sure this measure is going to solve much.
    • NullPrefix 3y ago
      Click "Mark as spam" and the all mighty machine learning might decide that the sender address (your address) is a spam sender
  • tornato7 3y ago
    I receive a lot of scam emails from Google Docs - ie random users 'sharing' Google Docs with me that are either ads or viruses or both.
    • foobazgt 3y ago
      I got one of these once. Google does run spam classifiers for docs and you can report them as spam: https://support.google.com/drive/answer/13305033 https://support.google.com/drive/answer/13305033
    • Loocid 3y ago
      Interesting I received a flood of these maybe 6 months ago. It never happened before and it never happened again.
  • queuebert 3y ago
    The majority of my spam is to firstname.lastname@gmail.com, because I have a common name. I assume spammers put together a list of common names and infer addresses from them. This would probably help me a lot.
  • preinheimer 3y ago
    Yeah, most outgoing sales people these days reach out using gmail. No unsubscribe links in any of them.
• zitterbewegung 3y ago
  Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.
  • solardev 3y ago
    ...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.
    • candiddevmike 3y ago
      Ironically, most of my breakthrough spam seems to come from @gmail.com addresses...
      • solardev 3y ago
        Same, but that's because all the other hundreds of pages of spam got filtered away already. I wouldn't be surprised if Gmail spam is higher-effort (like those individual SMS spam apps that politicians use) but higher-breakthrough.
        • supertrope 3y ago
          I read years ago a hijacked Gmail account was worth $10 on a black market while a Yahoo! Email account was worth $0.10.
    • rurp 3y ago
      Perhaps, but it's hard to say. False positives are much more harmful than false negatives. I have peronally had Gmail flag a number of legit emails as spam, and those are just the ones I know about! It's almost certain that I have lost valuable messages because I didn't check the spam folder in time. These aren't transactional emails either, I'm talking about messages from real people that I know personally. I would be willing to wade through a number of additional spam emails to avoid losing important ones but of course this is Google so there is no user facing dial to adjust the sensitivity. Users just have to trust that Google's generalized approach is well calibrated for them.
• chimeracoder 3y ago
  This isn't as big of a change as it sounds. There are three requirements. The first requirement - DKIM - is already a de facto must-have when sending emails to avoid getting marked as spam. The second is also a legal requirement in the US for all commercial email under the CAN-SPAM act[0]. And the third is more or less how email delivery has worked for the last 20 years or so anyway. [0] The "one click" and "within two days" parts are a little stricter than the bare minimum CAN-SPAM requirements, but not much, and they are not difficult for any legitimate sender to implement.
  • nerdo 3y ago
    The one-click part I believe is referring to the unsubscribe smtp header. CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn requires recipients to authenticate in order to unsubscribe and openly violates the letter and spirit of the law to the point scripts are required: https://github.com/chengyin/linkedin-unsubscribed https://github.com/chengyin/linkedin-unsubscribed
    • pixl97 3y ago
      Unsubscription requirements are a pain in the ass in the sense that anyone that steals a large list of emails (from any service, not yours in this particular case) could now run it against your service and unsubscribe a million users before you realize what's going on via a botnet.
      • TheCycoONE 3y ago
        The opaque id is suppose to not be guessable. I does mean you can't batch send emails by calling RCPT TO though which will hurt bandwidth.
    • chimeracoder 3y ago
      > CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn requires recipients to authenticate in order to unsubscribe and openly violates the letter and intent of the law to the point scripts are required: There are several known-bad actors. LinkedIn isn't even the worst offender - Amazon is much more brazen, though they get less flak for it because the number of violating non-transactional emails they send is lower. Regardless, I stand by my point that this isn't a big shift. Google stating publicly that they will penalize people who are violating an law that turns 20 years old this year, and which has generally been implemented by almost all legitimate bulk email providers[0], is not something I'm particularly surprised about or worried by. Again, the first and third bullet points in this press release are already de facto policy at Gmail, and have been for over a decade. The news is that Google is stating this publicly, not that they're doing something new. [0] The notable exceptions notwithstanding, it's quite rare to find a bulk email sender who violates this, because very few legitimate mail providers will allow it, and it's pretty difficult to set up your own mail server with decent inbox delivery rates.
• tiffanyh 3y ago
  > "Gmail’s AI-powered defenses stop more than 99.9% of spam, phishing and malware from reaching inboxes and block nearly 15 billion unwanted emails every day." This will be a pain for legit use cases but will net to a better place for the ecosystem. Much like strong KYB/KYC for bulk text messaging.
  • joering2 3y ago
    You joking right? The amount of text messages spam I receive now on Verizon, and some 8 months ago before on T-mobile is staggering.
    • tiffanyh 3y ago
      Are you suggesting that because of stronger KYB/KYC for sending bulk, that increased the amount of spam text you get?
      • 998244353 3y ago
        I think they are suggesting that the stronger KYB/KYC was ineffective at reducing the amount of spam.
    • supertrope 3y ago
      They're cracking down with "10DLC." Mass SMS senders must identify themselves, pay a fee, and register each campaign including its content.
• ilyt 3y ago
  > To help ensure messages you send to Gmail accounts are delivered as expected, you should set up either SPF or DKIM for your domain. But spammers already do that, why would enforcing that even help ?
  • sltkr 3y ago
    I think the explanation is a little incomplete, but it makes sense if you expand the explanation a bit. What really happens is this: when GMail receives a lot of email from domain xyzzy.com, and a lot of it seems to spam (either it's marked spam explicitly by the recipient, or maybe Google uses some weird AI or whatever to identify messages as spam) then GMail will start marking email from that domain as spam. Obviously if you own xyzzy.com and you're not a spammer you want to avoid this. So what can you do? SPF and DKIM are ways to prevent unauthorized senders from delivering mail that appears to come from your domain. SPF is a way to list IP addresses authorized to deliver mail on your behalf, and DKIM contains cryptographic keys needed to sign email coming from your main. That means if you have SPF and DKIM enabled, the only people able to send mail that appears to come from your domain are people that are authorized to do so (there are a few more bears on the road, but broadly this is true). It's true that spammers can register their own domains for the sole purpose of sending spam, and they can enable SPF and DKIM on those too, but if they use domains exclusively to send spam, they will still be marked as spam domains by GMail, at least eventually. But this doesn't explain why GMail should be distrustful of domains without SPF and DKIM records. There are literally hundred of millions DNS records worldwide, and only the tiniest minority (think, 1% or less) of those have SPF/DKIM records, and not having those records isn't evidence of being a spammer per se. But look from the perspective of spammers. If GMail adopts the policy that email from rare domains without SPF/DKIM records is accepted so long as they don't send high volumes of spam, then it's trivial for spammers to collect 100 million domains without SPF/DKIM and send literally 1 message from each, which results in a 100 million spam messages being accepted by GMail. That's why GMail wants you to add SPF/DKIM records to your domain if you're not a spammer. It allows GMail to block email from the >99% of domains that don't have SPF/DKIM enabled. And for the remaining 1% of domains, it can either delete email outright (if it's forbidden by SPF/DKIM), or else it can reliably identify a domain as being spammy.
• overstay8930 3y ago
  Doesn't matter to me, if an email doesn't have a one click unsubscribe I just mark it as spam. Messes with their email reputation so they hopefully get kicked off of reputable email services.
  • notwhereyouare 3y ago
    biglots is horrible about this. I have unsubscribed MULTIPLE times and I keep getting emails. Now marked as spam
  • kevincox 3y ago
    I do exactly the same. I give them one chance to let me unsubscribe. If it is more than 2 or 3 clicks I give up and mark as spam. If they keep sending I mark as spam.
  • LeifCarrotson 3y ago
    I honestly don't care about their reputation, I just mark anything I don't want as spam. It's easier than finding the tiny 8-point link at the bottom and rolling the dice on whether their unsubscribe is one click or not. I don't feel obligated to protect their shitty business model.
    • eastbound 3y ago
      I once went to an Atlassian conf and they resold all our emails to dodgy people. Or perhaps leaked them over the black markets. Not only I keep receiving almost the same email suggesting to buy 5,000 email addresses of Atlassian customers with always the same fields, but it’s always from different domains. I didn’t think of submitting an Atlassian ticket for each spam I receive. That would teach them. NEVER give your true email to Atlassian.
      • deleted 3y ago
        [deleted]
      • tgsovlerkhgsel 3y ago
        Same with Blackhat. You can provide a different e-mail on your profile... and then they'll still happily pass both that and your original sign-up address to any vendor you interacted with, and it will be resold so you end up with spam from vendors that weren't even there.
• albertgoeswoof 3y ago
  This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how Google will track this. Just because the header is set, it doesn’t mean it’ll do anything. In fact it can be used by spammers to identify legit email addresses and spam them separately.
  • j45 3y ago
    I'm wondering if they see enough gmail traffic receiving such an email that maybe they can infer how much funny business might be going on?
  • pirsquare 3y ago
    Why would you allow users to unsub from transactional emails?
    • queuebert 3y ago
      Because you're not evil?
    • albertgoeswoof 3y ago
      Because (according to this announcement) if you don't, Google will put you in the spam folder. Edit: I suppose it does say "unsubscribe from commercial email in one click". But it's hard to say exactly what they mean. They also don't define Bulk Senders - is that the domain or the sending SMTP server?
      • evangow 3y ago
        They defined bulk senders in the 3rd paragraph: "bulk senders — those who send more than 5,000 messages to Gmail addresses in one day"
• jedberg 3y ago
  It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender). If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the penny back. If they don't act on it within a week you get your penny back. Legit senders won't be harmed because they will get their pennies back, spammers won't be able to afford sending messages anymore. The real interesting part would be stuff like LinkedIn notifications -- if people find them useful they'd give the penny back, but companies would have to decide how many people might actually find it useful for their cost analysis.
  • theglenn88_ 3y ago
    If I had a penny for every legitimate email I marked as spam, I’d be a billionaire. Jokes aside, why wouldn’t you just farm pennies by marking all emails as spam? You could say, “well you could detect people that abuse the system” - and now the mouse is chasing the cat.
    • jedberg 3y ago
      Because people would stop sending you email.
    • AnthonyMouse 3y ago
      The flaw is in giving the penny to the user instead of the email provider. If an email provider is claiming everything you send them is spam, you stop sending to them, which for a real email provider is a problem if you're sending non-spam email their customers actually want.
    • butlike 3y ago
      You bring up a vaid case. People farming pennies could be an issue, but on the other hand, farming pennies is a more noble cause, and one that ostensibly seems far easier to catch. I'd rather do a lookup to find the outliers who are harvesting pennies than to try and cat-and-mouse spammers who are masquerading as legitimate senders.
• EvanAnderson 3y ago
  Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on the quest string. Anybody ever seen that?
  • nwienert 3y ago
    I thought it was part of CAN SPAM that you can’t require a second action and that was why the big email sending providers moved to that.
    • KeepFlying 3y ago
      Probably true but how do you handle autodetonation of email links in that case? Too many emails servers will click links automatically to check for issues. That was my understanding at least.
      • justinator 3y ago
        Unsubscribe link goes to a page that has a form that's automatically submitted via JavaScript. Disable that for the first 5 minutes of that link's life to get around automated things.
    • EvanAnderson 3y ago
      So many email security systems preemptively access every URL in messages. I found that I receive a GET for virtually every unsubscribe URL I send out. I don't read clicking a "confirm" button as a second action. The attorney didn't either. He also said CAN SPAN doesn't apply to a 501(c)3. I still try to comply to be a good citizen.
    • jabroni_salad 3y ago
      You can require a second action such as clicking a button. What you can't do is take them to a page that says "to unsubscribe, send a certified letter to our headquarters and wait 90 business days". The entire transaction must be completed at the page you link to.
• pirsquare 3y ago
  This is the direct link to the guidelines. https://support.google.com/mail/answer/81126 https://support.google.com/mail/answer/81126 Strange there's no mentioned about transactional emails. Since we wouldn't include unsubscribe link for transactional emails.
  • cuu508 3y ago
    Depends. I suppose it would not make sense to have "unsubscribe" for "reset password" notifications, but for "there's a new event in your account, come log in to see it" type notifications it would.
• justinator 3y ago
  I'm a little unclear how these requirements differ from just setting up correct DKIM/SPF records, and having a one-click unsub link - or is this all they're saying? If so, sounds good to me.
  • donmcronald 3y ago
    That's what it sounds like to me. The cynic in me thinks it's a prelude to stuff like BIMI because that lets them add a large annual cost for anyone that wants decent deliverability. It's a way for large senders to use their market position to invent a new industry with a service we all have to pay for. Free money!
    • jeroenhd 3y ago
      Does Google even sell BIMI compatible certificates? I don't think they're making any money with that protocol. BIMI does solve some issues with DKIM, so I can see why Google prefers it. Requiring what should be a minor fee for any company to do bulk email will also make it difficult to set up a thousand different spam domains.
• johnklos 3y ago
  You mean Yahoo isn't the rotting carcass of the company it once was? I see nothing but decay: their abuse addresses don't work, nor do any of the addresses they have in WHOIS, either for their domains or their networks, that haven't been switched to oath.com. Their SOA isn't real. They've basically stopped accepting abuse complaints. Is Marcel Becker, supposedly the "Sr. Dir. Product at Yahoo", according to this article, the only person working at Yahoo handling email these days? I'm only half joking - Yahoo is incredibly unresponsive when it comes to abuse.
• exabrial 3y ago
  > Enable easy unsubscription Does that include the spam I get from Google? Because you guys have been sending non CANSPAM compliant emails lately with "Account Updates" which are thinly veiled marketting emails.
• Semaphor 3y ago
  The only spam I get on my old Gmail account, is some democratic party people who think opt in is for chumps. So whenever I check that account, I click report spam for all their spam mails. Maybe their successor won't be such an ass. One of them recently lost his election and I was very happy about that. Edit: no idea why I only get democratic spam, maybe people with my name in the USA too dumb to enter their actual email don't like republicans. But I have no acceptance for spammers, no matter their politics.
• jabart 3y ago
  Right now google allows the SPF domain, and/or the DKIM signing domain to be different than the From domain, not just a subdomain but an entire different domain. From an ESP perspective, will this drop shared SPF(Return-Path) domains? I'm assuming DKIM has to match, just not sure about the return-path side. It's a bit vague in the support article.
• tempnow987 3y ago
  Does anyone know if this will stop NGP Van emails (seems to be dem party platform). I cannot get off their mailing lists - they seem to resell the email constantly. I've probably unsubscribed from NGP emails 50+ times. It's crazy. How are they not entirely blocked?
  • joering2 3y ago
    if you mean the email marketing software for political campaigns, then yeah sorry you are toasted (your email is) - they resell lists and spam everyone into oblivion. Apparently (as per Can-SPAM Act) politicians are (obviously) exempt from spam practices, so if you are mailing on behalf of politician or his campaign, its all wild west no limits and no rules apply.
• thiht 3y ago
  > It’s clear that email has become an essential part of daily communication. Wow, I almost missed that! Apparently even Google has to start their blog articles with SEO crap like this
• killthebuddha 3y ago
  If I wanted to learn everything there is to know about email and SMS spam/abuse policies, technical best practices, important standards, etc, what would be a good strategy? It feels like a super important but ridiculously intractable subject.
• adrr 3y ago
  Can we add a TTL to marketing emails? Max length is two weeks before the email is automatically deleted.
  • LinuxBender 3y ago
    Some mail providers somewhat support this. Fastmail for example allows setting retention limits on each folder including the trash and spam folders. One could make a folder for marketing and make rules for some of the bulk senders and then just keeping adding them as one finds them. Perhaps if enough people asked their mail provider they could add a global check-box for all the common email campaign providers.
  • lostapathy 3y ago
    I put together some time-based filtering I use on my own inbox, it's awesome. I like letting most of my email land in my inbox, because I don't want to need to check (and purge a bunch of folders). But email of declining value will automatically get moved to folders after a certain amount of time. for example: * Monitoring alerts go to trash after 4 hours (if it's still broken, I'll get more emails, after all). * shipping notices from amazon etc go to trash after 3 days (long enough for the item to arrive on time) * Notices from ups/fedex about "your item is arriving today" go away after 24 hours * Marketing I don't mind seeing but has a shelf life - I have 2 or 3 time intervals setup for those * Mailing lists I'd like to read (but often don't get back to) delete after 2 weeks * Utility bills move to a folder for utility bills after 24 hours etc. It's awesome - but oddly enough, nobody I ever tell about it gets that excited.
• einpoklum 3y ago
  Regardless of this specific policy change/tweak: We should all stop using email providers who are known to massively compromise our privacy, build profiles of our online activities, manipulate us through ads, pass lots (or all) information to the government, and consolidate ownership of too much of Internet communications and activity. Specifically, we should stop using GMail (and Yahoo), and encourage our friends to leave that email service as well. There are plenty of fine alternatives.
• Sytten 3y ago
  Does this apply to all emails including transactional? What I am supposed to do if a user requests a password reset but unsubscribed from our emails? Most of the spam I received these days is from gmail addresses these days.
  • evangow 3y ago
    This is a great question. I would love to see more documentation on what this means for transactional emails. Adding systems in place to handle unsubscribing from transactional emails will mean quite a bit of engineering time/effort for many companies.
• tgsovlerkhgsel 3y ago
  > we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they couldn't get me to install their app - just to get me to engage with their site.) Once such behavior has the potential of landing your entire domain in the spam folder, maybe they'll be more careful. Edit: For example, I can't imagine LinkedIn being able to pull of their "phish people, steal their address book, spam each contact three times with no opt-out" bullshit for so long if strict spam thresholds were in place.
  • 3c6bYDXLMj 3y ago
    What do you mean? There’s a huge difference between “Product Spotlight” and “Best Deals” /s
  • sleepyhead 3y ago
    This is exactly why GDPR exists. What you are describing is illegal in the EU. Sending marketing communication requires clear opt in consent.
    • SOLAR_FIELDS 3y ago
      I just had this experience today. The problem is that at least in the States the regulation is ambiguous enough to be abused to hell and back. Unsubscribe in the States could mean “Unsubscribe from all” or “Unsubscribe from 1 of 20” or it could mean “unsubscribe from all now, but we will arbitrarily resign you up for some new newsletter whenever we feel like it”. I got a spam email today from some no name dropshipper I bought contacts from probably a decade ago, I got LASIK 3 years ago and haven’t needed contacts since. Some large companies even flagrantly violate the extremely lax rules that exist in the States. Guitar Center has infamously been sending me emails that are in direct violation of the one click unsubscribe regulations for almost a decade now. I can’t even sign in to the account to cancel the emails (which is in direct violation of the regulation- it is ambiguous on a lot of things but the one thing that it isn’t is that you aren’t supposed to be required to log in to opt out of email communications) because it was made with my dad’s email from 20 years ago yet I’m the recipient of the spam. I did report them; but of course nothing must have happened because they are still doing it.
• nickdothutton 3y ago
  So spamming is fine, so long as you stay under some threshold. Thanks a lot.
  • vore 3y ago
    5000 emails a day is an extremely low limit for spammers, though.
• jmduke 3y ago
  Good. I'm someone who a) uses Google Suite (or Workplace, or whatever it's called) b) runs a newsletter service [buttondown.email] that sends millions of emails every day, most of them to Gmail. The amount of cold email I get from prospecting/outreach tools that is nigh-impossible to unsubscribe from is _infuriating_. Any legitimate bulk sender is already conforming to DKIM + one-click unsubscription, and anything we can do to cut down on obvious spam is a win in my book. There's a lot of things Gmail does as de facto tsar of email that I don't love — initiatives like AMP for email come to mind — but this is an unalloyed positive in my mind.
• delfinom 3y ago
  Now if Google/Gmail could do something about all the email spam between Gmail accounts.
• pembrook 3y ago
  The authentication stuff is all standard practice so no big change IMO. However the hard spam limit with Gmail in particular will get interesting. I predict this is going to create some insane headaches for indie Saas startups. Gmail is the only inbox provider that doesn’t offer a real feedback loop (you don’t actually know if a given email address marked you as spam when sending to gmail users). The FBL in Google postmaster tools is anonymized and unreliable at best. So essentially, you never know if a Gmail user marked you as spam so you can stop sending to them. Gmail will just by default mark your emails as spam for that user going forward, without telling you. This means your spam complaint level will inevitably rise over time without you knowing why and what email addresses are causing the issue. Unless Gmail actually starts providing a real FBL like other inbox providers, the hard spam limit is going to snowball into a nightmare for even the most conservative and legitimate senders.
  • Macha 3y ago
    Honestly sounds like I'm on the side of Gmail here. Think about this from the perspective of an actual spammer. You get a notification that address XYZ is marked as spam by user ABC. Well, now you just email user ABC from a different address.
    • pembrook 3y ago
      Not even spammers want to waste time & money emailing people who have already marked their emails as spam (that's as clear a signal as any to move onto the next victim). The real problem is, for legitimate senders, the people who send less emails actually get higher levels of spam complaints! This is because humans are human and they forget who you are. I would argue this actually incentivizes sending more emails. This is why marketers all recommend sending garbage emails daily/weekly/monthly. The truth is, the companies with full-time spam (marketing) departments will do just fine with these changes. It's the little guy who is going to have to navigate these complexities (likely unsuccessfully), and get shut out from yet another technology that used to be open. On top of that, Google has started to offer perks for senders within Gmail for a $1,500 per year fee (VMC). They're basically one step away from collecting rents on all of email by way of their monopoly.
• dizzydes 3y ago
  For the next two months our inboxes will be wild with opt-in pitches...
• lnxg33k1 3y ago
  To be honest I had to block mails from @gmail.com as its the only place i get spam from, so if they try to make their service less of a wasteland thatd be really appreciated
• georgyo 3y ago
  Reading all the comments makes me think I'm an outlier. I very aggressively unsubscribe from everything so I get very little mailing list spam. Maybe a few messages a month. What I do get _constantly_ is spam email messages to my inbox from Gmail and Outlook domains. At least one a day for many years. Because it from Gmail, they have very little spam filtering done, yet if any other provider sent these messages then Google would block the entire domain. These particular spam messages get on my nerves, and these are the only ones making it through to me.
  • stevage 3y ago
    Yep, I'm the opposite of you. I get almost zero true "spam" to my Gmail account. Maybe 1-2 messages a month. Whereas quite a few of these quasi-spam marketing emails from a company that I once had some interaction with. The worst is hotels - you stay at 10 hotels during the course of a trip, then you get added to 10 email lists for the rest of your life.
    • kiwijamo 3y ago
      I have a Gmail account I opened in the early days of Gmail and stopped using on a regular basis when I got my own domain around mid-2000's. Whenever I occasionally check in, I always find heaps of spam. Many I've tried unsubscribing for and still get the mail--obviously Gmail's filter doesn't take into account senders I've flagged time and time again as spam.
    • oynqr 3y ago
      You might not get much spam delivered to your Gmail inbox, but that doesn't stop Gmail from being the largest _source_ of actually delivered spam.
  • drdaeman 3y ago
    > I very aggressively unsubscribe from everything Never unsubscribe from anything you haven't subscribed for (or at least where you haven't gave your email address to the sending party), because I believe any interaction with unsolicited emails provide spammers with a clear signal that their spam is not just delivered but also read and interacted with, so they get more agressive.
• crawdog 3y ago
  Curious if this applies to political ad senders.
• drdaeman 3y ago
  What exactly are the news here? I see three points but fail to comprehend them, because I thought all those things were a norm for a long while: 1. Is it the news that Google still accepted bulk volumes of unauthenticated mails in 2023? If that's true - finally, good riddance. Although I believe most spam those days comes from legit hacked domains. 2. Am I reading this right that List-Unsubscribe and/or unsubscription link is going to be required for high-volume senders, marketing and transactional? That's good to hear, although - again - it's hard to believe this is a requirement only now. I thought everyone with at least a sliver of honesty already had those for a long while. 3. Enforce low spam report ratio? It's news to me that the "report spam" buttons didn't behave that way already, I assumed that if users actively report then domain gets blocked (unless it's whitelisted, e.g. to defend from a false reporting DoS attack).
  • DistractionRect 3y ago
    > Is it the news that Google still accepted bulk volumes of unauthenticated mails in 2023 Apparently so. I just read through this earlier today, and it's kinda insane how broken email is. Kinda remains me of the "You go to jail" meme, believe it or not, straight to inbox. [0] https://news.ycombinator.com/item?id=37628337 https://news.ycombinator.com/item?id=37628337
• RIMR 3y ago
  This will be interesting to see how this plays out internationally, since some countries don't have the same anti-spam laws we do. Will I stop getting notifications from some of the non-EU, non-US services that I am a member of just because they don't have in-email unsubscribe links (I can still unsub on their website)? These are not companies under sanction, so I have every right to communicate with them freely, even if they don't obey the same laws as where I live. Should I end up suffering damages because Google blocks legitimate communications, will they be taking liability for their interference? For clarity, I am not against anti-spam measures, but I do worry about centralized services being overly strict and doing damage to their customers, especially if it is so draconian that it prevents delivery of important communications as retaliation.
• happytiger 3y ago
  Bulk sending breaks the utility of email. I wish there was a way to say, “Don’t allow my email to receive bulk sent emails.” I can’t imagine how much that would improve my life. I just don’t want to see it. It breaks my attention far too frequently for far too little utility, and I would love it if entire emails I own could be bulk spam free. I don’t really want a better version of our shitty current system.
  • linsomniac 3y ago
    The issue is: How does a server determine that a message is bulk sent?
    • happytiger 3y ago
      That’s what BCL scoring and the like are for.
  • pembrook 3y ago
    On the contrary, I only care about receiving email from bulk senders. I pretty much exclusively use email to read newsletters and handle communication with companies/accounts. Any 1:1 communication with real people pretty much exclusively happens elsewhere for me.
    • happytiger 3y ago
      That’s cool. What I am saying is that you should be able to decide what works for you. I don’t want any. You do. Why not give users the ability to control what they want? It’s not a technical challenge.
• beretguy 3y ago
  I’m surprise nobody mentioned SimpleLogin yet to counter spam.
• schappim 3y ago
  The title could be rewritten as: "Advertising Companies Take Additional Measures to Diminish the Effectiveness of Email Marketing."
• berniedurfee 3y ago
  What’s in it for Google?
  • pembrook 3y ago
    The truth is, most small businesses cannot figure out how to add DNS records to their domain. So they will no longer be able to inbox. And the more complicated and difficult Gmail makes it for companies to access your inbox via open tech like email, the more likely it is you'll be forced to pay for Gmail Ads. The bonus is Google gets to couch this as being "for the users." Gmail already has fantastic spam filtering and it's highly likely they use all this stuff as spam signals already. I would be very very careful of any claims from a giant advertising monopoly that this is "for the good of all."
• coding123 3y ago
  Now spam comes from calendar invites, DRIVE shares, and who knows what is coming in the future.
• pjd7 3y ago
  Overall the changes seem sensible. For those wanting to self host there are plenty of guides out there on how to configure various MTAs with all of the required bits. BUT, Why does IP reputation matter so much these days when you have DKIM, MTA-STS, DANE and other mechanisms that provide verification of the sender? Say I want to startup a Email Service Provider, I need to go and source a bunch of IPv4 typically to have a premium upsell for end users to really ensure cross sender reputation does not impact other tenants. Crazy. IPv6 historically at least was anecdotally punished by the likes of GMAIL, Yahoo, Hotmail, Office365 etc. Does anyone know if IPv6 hosted email severs still suffer additional spam scoring?
  • U8dcN7vx 3y ago
    Delivery via IPv6 still seems more stringent. IPv4 now requires "authentication" as well where previously only IPv6 did. Last I checked Google didn't use DANE, preferring instead MTA-STS -- perhaps understandable for a giant web property.
• maxo133 3y ago
  This is step closer, after few more steps they'll make sure only those "approved" companies can operate email server... leading to more internet centralization.
• r053bud 3y ago
  Yeah, at this point, I’ve completely lost my main email address to spam and mailing lists; half of which seem to have broken unsubscribe pages. I’ve abandoned this email completely for personal communications and have a new email for that now. I continue to use my old email for any service or website, since I know they will likely sell my email in addition to spamming me to death. This has all gotten completely out of control. Yet again, regulation seems to be about a decade behind.
• billy99k 3y ago
  While this sounds great on the surface, it's used to control things like our elections. Politicians that Google likes can send as much mail as they want. Ones they don't mysteriously gets all of their email marked as spam. Normies don't understand that big tech will basically control our elections from now on (and they won't understand how) unless we get the government involved.
• joeross 3y ago
  I haven't trusted the spam button or unsubscribe functions for a long time. It never felt like it worked. I've been making filters to auto delete stuff instead and it just works.
• cookiengineer 3y ago
  If you are running your own postfix MTA and those mass email providers keep spamming you even when you write their abuse@ teams: I created a simple anti spam tool/blocklist generator that can be integrated with postfix's postmap format, because spamhaus was totally useless for those providers. [1] It's trying to be dead-simple, and also blocks the alternative ASNs these spam providers have in reserve. Haven't found a fully automated way yet because whois protocol is kinda broken, but I'm working on it. [1] https://github.com/cookiengineer/postfix-spamdb https://github.com/cookiengineer/postfix-spamdb
• CrzyLngPwd 3y ago
  Yes another nail in the coffin for email. We have toi jump through hoops to send email to the big email providers already, and some (outlook, hotmail, yahoo) take months before allowing any volume of email to be sent to our own customers!
• account42 3y ago
  > Gmail’s AI-powered defenses stop more than 99.9% of spam, phishing and malware from reaching inboxes And what percentage of legitimate mail? > and that they process unsubscription requests within two days This is a laughably lax requirement. Also for fucks sake, stop auto-localizing your documentation based on IP geolocation.
  • throwaway290 3y ago
    Probably half of legit mail from self-hosted servers... Anyone using them at all?
    • account42 3y ago
      YMMV but Gmail hasn't been that bad for me. The only problem I (knowingly) had was with a newly registered domain and mails still at least went to the spam folder there. Microsoft has been much more annoying, punishing you for bad IP "neighbors" that you have no relation with. Of course I don't know if all my mails get delivered since I don't do any tracking, just relying of voluntary in-band or out of band replies / receipt confirmations. And being based on black box heuristics (and "AI" lol) there is no guarantee that my experience with Gmails spam filters is the norm - but Gmail rejecting half of self-hosted mail seems a very pessimistic estimate. Still, just citing numbers for how much spam they blocked is (deliberately?) only showing half of the picture.
• Synchro 3y ago
  None of that seems new. What would be new is if both gmail and Yahoo provided any means of allowing legit bulk senders to actually send properly. The one-click unsubscribe is from 2017's RFC8058. Everyone that's sending in volume is already doing all the usual stuff - DKIM, SPF, DMARC, matching reverse IPs, etc. The privacy-first email marketing service I wrote (https://info.smartmessages.net https://info.smartmessages.net) implements account-wide unsubscribe by default (unsubscribing you from one list unsubscribes you from all). It requires double opt-in, and asks for explicit consent before doing any tracking whatsoever (so no Google Analytics, no cookies, no trackers), which of course is what the (at least EU and UK) law requires. You're not going to see shitty exploiters like MailChimp doing anything like this; abusing your data is just too lucrative. It's still ridiculously hard to deliver messages at any volume, and there is zero recourse when you are penalised incorrectly. Gmail's spam filtering is just dire - if I send myself an email from gmail, it goes into spam. A large proportion of the spam I receive is sent from gmail. Google's postmaster tools are a joke. It's entirely normal for them to give you a "bad" spam rating when you have 0 spam reports, 0 auth failures, strict DKIM and DMARC, and every single message has double-opt-in audit trails. This useless feedback makes it very difficult for senders to actually comply with their ever stricter, but ever more opaque requirements. Proving that subscribers actually want to receive messages from you its difficult. So back in 2017 I wrote an outline proposal https://github.com/Smartmessages/subscriptionproofrfc https://github.com/Smartmessages/subscriptionproofrfc to create a standard, possibly built on top of DKIM keys, to provide provable subscriptions. This would pretty much solve the entire thing for legit senders, but of course the industry is not really interested in cooperation or complying with any law that might reduce the number of people they send to by even the tiniest amount. /cynicalrant
  • account42 3y ago
    > legit bulk senders Now who could you mean by those. > The privacy-first email marketing service I wrote Oh right, spammers.
    • Synchro 3y ago
      Get a grip. So you would consider twitter and Facebook notifications you have explicitly requested as spam? I also run a social network with 20k users that is equally accessible over web and email, and we have had peaks up to about 4 million messages/month containing nothing but conversations between users, and we run into all these bulk sending issues all the time. Please explain, oh wise one, how is emailing people messages they have explicitly asked for spam?
• denton-scratch 3y ago
  I couldn't figure out from the announcement whether these controls are to be applied to people sending bulk to gmail addresses, or from them. Nearly all the spam I see is from a gmail address. I suspect this new measure is to protect gmail recipients.
• hunter-2 3y ago
  Wait, how does one send 5000 messages in one day? I thought Gmail had an upper limit of 500/day?
• josephd79 3y ago
  This is nothing new for Google, they already do this.
• janandonly 3y ago
  During the pandemic era, I would use my Gmail account to send emails to people who signed up for an on-line museum tour that I held over Zoom. I was shocked to find out that maybe 1/3 of all recipients had to find my emails in their SPAM box. Eventually, I paid for a service that allows to send SMS in bulk so that I could inform people to check their e-mail and spam box for the login details. I hope these new measurers will mean that less email is earmark as spam. The fact that is sent out 300 mails with identical text and multiple links in it, is in no way a sign that it is spam. It got so bad in facts that some people reported not even seeing my mails in their spam box (or, many older folks don't know how to find/open their spam folders). So eventually, I asked them to send a mail to me first, to which I would simply reply.
  • pcdoodle 3y ago
    It got to the point for us when a customer with gmail would ask for an update about their order with us, we couldn't get an email back in front of them.
• kposehn 3y ago
  While I'm all for doing a better job at reducing spam, this also will effectively drive a lot of those advertising dollars that go into bulk email straight into sponsored email products from Google and Yahoo. The main webmail platforms do not benefit economically from spam. They have every incentive to turn it to their advantage by diverting ad dollars from bulk email and forcing it into their own ad platforms.
• SkyPuncher 3y ago
  [Deleted]. Sorry, accidental post and the app I’m using doesn’t have delete.
• heroprotagonist 3y ago
  Planet Fitness have a system that will send you mail simply if you visit their website. Steps to reproduce: * Search for a gym on Google maps. * Click a Planet Fitness result that's somewhere nearby. * Expand to their website link, follow it, and browse several pages on their site. * Do NOT give them your email. * Wait a few days and check your email. * Watch your email through the next couple weeks for follow-up emails that continue to urge you to action. This will probably require you to use a browser with an extensive history. EG, not one with temporary container tabs or other such privacy considerations. Something you've used the email on in a variety of scenarios, enough to have it linked to your identity with some sufficiently large advertising agency. It's illegal, a complete violation of CANN SPAM act, but I imagine it makes them more money than they'd lose if they ever actually got slapped down. I just wonder which information provider they're using that has 'sold the goose', so to speak. By giving an email address they no longer sit between the company and the user's marketing efforts, so it must be fairly expensive to do. But it enables these kinds of follow-up campaigns.
• kodapoda 3y ago
  Feature request: please require a direct unsubscribe link in emails. The new trend is that companies use 3rd party tracking services, which are blocked by my DNS settings. So I can't even unsubscribe from 60-80% of emails without disabling my custom DNS. Google requires the unsubscribe link to be present already, they just need to require it to be accessible.