3 ms·

A webforum I know has a rule against marking email notifications they send at spam (You can opt out of receiving them through the site, they just don't want you

A webforum I know has a rule against marking email notifications they send at spam (You can opt out of receiving them through the site, they just don't want you doing it on the email client end) to avoid this happening to them. For a small org, it's kind of a real risk? I'm not sure how larger orgs mitigate it.

uuddlrlrbaba 3y ago
They pay 3rd parties to handle relay duties. A large chunk of reliable delivery is based on those received headers, aka what systems your mail is relayed through.
- awesomeMilou 3y ago
  Lol wait, that sounds like e-mail deliverability is almost set up like cartels.
  - ozr 3y ago
    Cartel is maybe overly pejorative, but it's definitely based on relationships. Postmasters at large ESPs and inbox providers can and will text each other to resolve issues. This is pretty much how the internet works as well (BGP, etc). It's opaque, but open.
    - theK 3y ago
      But is the Internet really as centralized as Email has become? I was living under the impression that Internet backbone providers where more diversified than that.
      - ElevenLathe 3y ago
        With BGP, you are usually only peering with a couple entities unless you are yourself in the "big boys club". It's a relationship business, but you only need a relationship with the handful of engineers who are on the other side of your own links.
  - 77pt77 3y ago
    Mass sending is controlled by sendgrid and the likes of that.
    - patja 3y ago
      Sendgrid is no silver bullet for deliverability. They have many IP addresses listed in blocklists. https://check.spamhaus.org/sbl/listings/sendgrid.com/ https://check.spamhaus.org/sbl/listings/sendgrid.com/
      - 77pt77 3y ago
        Curiously my domain shows as zero but it's part of at least one RBL.
KTibow 3y ago
Is there any way for them to enforce that
- buro9 3y ago
  I run webforums, and this is enforced trivially. I don't send marketing, I only send transactional emails. Notifications are opt-in, and transactional. Logins / signups are done via sending a TOTP to the email, these too are transactional. If someone marks notifications of new posts in a subscribed thread as spam... fine, but this is self-solving, as this person will trigger no more email ever reaching them for that email address, meaning they also cannot now sign in to the website, and therefore cannot subscribe to more email updates, or visit things to refresh "last viewed", and so would never be notified again. Emailing a TOTP as a login has increased deliverability by self-selecting the removal of those who hit the spam button. Deliverability of email from the webforums is over 99%. Reporting email as spam, effectively bans oneself from the website. I didn't even need to do anything.
  - saurik 3y ago
    When you report something as spam to Google they only claim they "might" cause later emails from the same sender to go to your spam folder; regardless, those emails going to one's spam folder doesn't mean they don't get them at all, it just means they have to look at their spam folder to log in.
    - buro9 3y ago
      When you use services like Sendgrid, having a spam report will automatically prevent future emails being deliverable, third parties and intermediaries do this precisely to protect their email reputation. Marking spam may not be immediately be a death knell within Gmail, Hotmail, etc, but because of the potential impact from being marked as spam, virtually everything treats it like a death knell. This is fine for me, my service is entirely opt-in, and if someone hits the spam button it risks impacting other users who _want_ the email, so I am not bothered that this person effectively unsubbed themselves and killed their account.
  - 3y ago
bboygravity 3y ago
I run a small org (freelancer) and I have a super advanced bullet proof set of solutions against this. Any 1 of those should do the trick (I do all of these): 1. Don't trick people into signing up for mailinglists. 2. Don't spam. 3. Don't use mailinglists. My small business is fine.
- spacebanana7 3y ago
  Not against a targeted attack like the one described. A clickfarm marking password reset emails as spam could create real harm. Even a malicious individual doing this to 2-3 fair transactional emails could cause damage for a small business with low volume.
  - jeromegv 3y ago
    The attack described could not work with a strict DMARC policy. However of course, most small companies have no idea how to do SPF/DKIM/DMARC.
    - spacebanana7 3y ago
      Could you explain how DMARC would prevent this? If I attempted to create dozens of accounts on a website, trigger password resets emails, and report them as spam, where would DMARC prevent me?
    - pc86 3y ago
      Nobody is spoofing anything, DMARC won't help. This is marking legitimate emails as spam at scale to trigger actual spam controls against the legitimate organization.

uuddlrlrbaba 3y ago

They pay 3rd parties to handle relay duties. A large chunk of reliable delivery is based on those received headers, aka what systems your mail is relayed through.

awesomeMilou 3y ago
Lol wait, that sounds like e-mail deliverability is almost set up like cartels.
- ozr 3y ago
  Cartel is maybe overly pejorative, but it's definitely based on relationships. Postmasters at large ESPs and inbox providers can and will text each other to resolve issues. This is pretty much how the internet works as well (BGP, etc). It's opaque, but open.
  - theK 3y ago
    But is the Internet really as centralized as Email has become? I was living under the impression that Internet backbone providers where more diversified than that.
    - ElevenLathe 3y ago
      With BGP, you are usually only peering with a couple entities unless you are yourself in the "big boys club". It's a relationship business, but you only need a relationship with the handful of engineers who are on the other side of your own links.
- 77pt77 3y ago
  Mass sending is controlled by sendgrid and the likes of that.
  - patja 3y ago
    Sendgrid is no silver bullet for deliverability. They have many IP addresses listed in blocklists. https://check.spamhaus.org/sbl/listings/sendgrid.com/ https://check.spamhaus.org/sbl/listings/sendgrid.com/
    - 77pt77 3y ago
      Curiously my domain shows as zero but it's part of at least one RBL.

KTibow 3y ago

Is there any way for them to enforce that

buro9 3y ago
I run webforums, and this is enforced trivially. I don't send marketing, I only send transactional emails. Notifications are opt-in, and transactional. Logins / signups are done via sending a TOTP to the email, these too are transactional. If someone marks notifications of new posts in a subscribed thread as spam... fine, but this is self-solving, as this person will trigger no more email ever reaching them for that email address, meaning they also cannot now sign in to the website, and therefore cannot subscribe to more email updates, or visit things to refresh "last viewed", and so would never be notified again. Emailing a TOTP as a login has increased deliverability by self-selecting the removal of those who hit the spam button. Deliverability of email from the webforums is over 99%. Reporting email as spam, effectively bans oneself from the website. I didn't even need to do anything.
- saurik 3y ago
  When you report something as spam to Google they only claim they "might" cause later emails from the same sender to go to your spam folder; regardless, those emails going to one's spam folder doesn't mean they don't get them at all, it just means they have to look at their spam folder to log in.
  - buro9 3y ago
    When you use services like Sendgrid, having a spam report will automatically prevent future emails being deliverable, third parties and intermediaries do this precisely to protect their email reputation. Marking spam may not be immediately be a death knell within Gmail, Hotmail, etc, but because of the potential impact from being marked as spam, virtually everything treats it like a death knell. This is fine for me, my service is entirely opt-in, and if someone hits the spam button it risks impacting other users who _want_ the email, so I am not bothered that this person effectively unsubbed themselves and killed their account.
- 3y ago

bboygravity 3y ago

I run a small org (freelancer) and I have a super advanced bullet proof set of solutions against this. Any 1 of those should do the trick (I do all of these): 1. Don't trick people into signing up for mailinglists. 2. Don't spam. 3. Don't use mailinglists. My small business is fine.

spacebanana7 3y ago
Not against a targeted attack like the one described. A clickfarm marking password reset emails as spam could create real harm. Even a malicious individual doing this to 2-3 fair transactional emails could cause damage for a small business with low volume.
- jeromegv 3y ago
  The attack described could not work with a strict DMARC policy. However of course, most small companies have no idea how to do SPF/DKIM/DMARC.
  - spacebanana7 3y ago
    Could you explain how DMARC would prevent this? If I attempted to create dozens of accounts on a website, trigger password resets emails, and report them as spam, where would DMARC prevent me?
  - pc86 3y ago
    Nobody is spoofing anything, DMARC won't help. This is marking legitimate emails as spam at scale to trigger actual spam controls against the legitimate organization.