Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spam blacklisting is out of control

blog.roastidio.us

Post reply on HN
Print view View original

361–370 of 430 posts

Re: Spam blacklisting is out of control

#361

Post by vintermann »

Silhouette wrote: post #122
YPCrumble wrote: post #84

Earlier quoted context omitted.

I agree completely with this, but the one problem is that you haven’t addressed how we control spam without these “trusted” intermediaries. “Trusted” here meaning that they aren’t spammers.

Spam has largely been a solved problem for decades IME. You don't need some big-data-crunching mega-mail-host to block it successfully. For my personal mail, I use a small provider that isn't configured to block anything automatically and the built-in tools in my mail software. For my businesses, we have a pretty standard SpamAssassin-style setup. Either way, I see hardly any spam in my inbox despite receiving mail t…

You must be living in a different world than me. I regularly get spam even from large corporations, that I know I never signed up for anything for. I know it is actually them, because it's DKIM signed with their domain certificates. Walmart (which doesn't exist in my country), Unilever and tons or their brands.

Even a national division of Microsoft got hands on my email and decided to sign me up for invites to developer events (I know I hadn't signed up for it, because they didn't even use my name in the mails, which they certainly would have known if they had gotten it through any legitimate source).

I assume it's bullshit KPIs, or signup schemes. Some poor seller at Microsoft or Walmart who's ranked according to how many people sign up to the opt-out company promotions, and buys harvested addresses to juice their numbers.

I even got some very obvious fraud spam ("Your [expensive product] is waiting for you!", trying to get you to sign up as a "product tester" only paying $$$ per month) with full DKIM signatures from a site hosted at a Danish hosting provider, and Danish business info. You'd think this sort of thing gets shut down quickly, but nope. The only times I've tried to address this sort of thing through the proper channels (domain registrar's abuse accounts, etc.), I've only gotten markedly more spam.

At least DKIM signatures makes it easy to autodelete mail. No need to even go into the spam folder, I'm happy to forbid Walmart from communicating with me by mail forever.

Re: Spam blacklisting is out of control

#362

Post by nottorp »

mjrpes wrote: post #34

I fought the battle to keep my SMTP server IP off blacklists, and lost. You can do everything possible, have a perfectly clean IP, have a good amount of outbound email traffic, only send transactional email, etc. Still, there will be edge cases where email does not go through. AT&T email servers would constantly blacklist me and not respond to requests to remove me, gmail/yahoo/outlook would silently put emails in th…

> through a transactional SMTP sender, like Postmark or Mailgun.

... cheapest is $10/month. Not paying that for my meager email traffic. Are there other options for personal domains?

Re: Spam blacklisting is out of control

#363

Post by Avamander »

indymike wrote: post #10

RBLs are useful, but there are a few that are not what they appear to be. The particular one in question, UCEPROTECT is a) not worth paying b) should never be used by a production mailserver to block messages. From the beginning there have been enterprising RBLs that are clearly overbroad, and offer to accept money. The money is not for getting off the list, it is always for something else so as to appear legitimate…

Actually no RBL alone should be used for decisive actions such as banning.

It's not UCEPROTECT either, big vendors like Cisco with their IronPorts are just as bad.

Re: Spam blacklisting is out of control

#364

Post by pteraspidomorph »

xfer wrote: post #336
pteraspidomorph wrote: post #155

Earlier quoted context omitted.

Microsoft: 1. Set up on https://sendersupport.olc.protection.outlook.com/snds/ 2. Read everything at https://sendersupport.olc.protection.outlook.com/pm/ 3. Make sure everything is fixed, then use the link to the form hidden under Troubleshooting > "Sender services, tools, and issue submission" (the link's label is "here") to contact support. Make sure all fields are provided, including a website. It may take a few d…

You failed to mention that if you haven't managed to complete this successfully(google also has a similar form: https://postmaster.google.com ), google will just mark it as SPAM, but outlook will *silently* drop your mails.

Both google and outlook can drop your mails without delivering them to the recipient, but you can find the rejection error code in your MTA logs. Though it's true that microsoft just rejects everybody and google might not reject you at all, at least outlook has a procedure of sorts these days. I do not see any form at postmaster.google.com that I'm allowed to access.

Re: Spam blacklisting is out of control

#365

Post by watchdogtimer »

nottorp wrote: post #362
mjrpes wrote: post #34

I fought the battle to keep my SMTP server IP off blacklists, and lost. You can do everything possible, have a perfectly clean IP, have a good amount of outbound email traffic, only send transactional email, etc. Still, there will be edge cases where email does not go through. AT&T email servers would constantly blacklist me and not respond to requests to remove me, gmail/yahoo/outlook would silently put emails in th…

> through a transactional SMTP sender, like Postmark or Mailgun. ... cheapest is $10/month. Not paying that for my meager email traffic. Are there other options for personal domains?

I've been using the free tier at MailJet to relay mail for my server for several years and have had few problems. Several others offer free tiers too (SendinBlue, etc.)

Re: Spam blacklisting is out of control

#366

Post by derekzhouzhen »

autoexec wrote: post #345
derekzhouzhen wrote: post #99

Earlier quoted context omitted.

I don't want my hosting company to dictate what I can do and what I can't do. I don't spam, but I won't hold my moral standard to everyone else.

Your hosting company is free to allow all the spam they want to leave their network and every other ISP on the planet is free to drop all traffic from your irresponsible hosting company's IP space. freedom sure is nice.

I and I alone is responsible for my act. It is a slippery downward slope once you start outsourcing responsibility.

Re: Spam blacklisting is out of control

#367

Post by samtuke »

Underphil wrote: post #104
Godel_unicode wrote: post #78

Earlier quoted context omitted.

> antithetical to the principles of the open internet. No. These blocklists are employed by the actor receiving the email. They have a perfect right, even on "the open internet", to decide that they want to limit who can send them messages. There are tons of checks on the people who provide those blacklists, in the form of their users complaining about lack of mail delivery and ultimately not using their list anymore…

Absolutely agree. This doesn't fall under the principles of the open internet nor anything in the 'net neutrality' arena. You have no right to expect anyone to receive traffic from your server if they choose not to. It's a major pitfall of running your own relay, but it's not unethical.

Unfortunately 50% of the world's mailboxes are hosted by 2 companies. That means the open internet is far as email goes is already dead in practical terms for most people. When they block another host that host no longer has email network access.

Re: Spam blacklisting is out of control

#368

Post by hansel_der »

smf wrote: post #359
hansel_der wrote: post #350

Earlier quoted context omitted.

yea, in an ideal world, the blocklist provider would educate others in how to avoid beeing blocklisted. yet, if this course is met with success then the blocklist provider is out of business. there seems to be some conflict of interest here.

Please see my comment below: https://news.ycombinator.com/item?id=30227886 and the subsequent threads below. Not all blocklist providers are the same.

terribly sorry that you felt personally implicated, that was not my intent.

thou every security-for-profit scheme suffers from afromentioned conflict of interest.

Re: Spam blacklisting is out of control

#369

Post by denton-scratch »

luser007 wrote: post #358
walrus01 wrote: post #132

Earlier quoted context omitted.

Not everyone can spend $500 on lawyer billable hours per SMTP destination multiplied by N number of destinations. I also think that the likelihood of success in sending legal threats to somebody that demand they accept your SMTP traffic will not stand up in court, if you ever escalated it that far. As somebody who runs postfix MX on the receiving side of things, I can guarantee you that the day I receive a legal thre…

Tangentially related: Somebody created a github containing domains he thought should be blocked: https://github.com/chadmayfield/my-pihole-blocklists A year later I bought a domain that had expired under my country TLD. It turns out that domain for some reason was previously added to that list. Now, as you can see, the man behind that Github repo has decided to archive that repo and therefore make it read only. As yo…

> I find it analogous to somebody standing on a soap box in a village and announcing: "Don't trust James. Don't trust Mary either.

You're speaking of some random domain-list on github - that isn't even maintained? Taken from someone's private pihole?

Anyone using a list of that kind to block is simply incompetent. Even as part of a scoring system, it's pretty silly. Before adding a blocklist, a postmaster needs to familiarize herself with the list's policies. Are list entries aged-out? How quickly? Do they use spamtraps, or user-reports? Or is it just the whim of the list-maintainer? Do they block individual addresses, whole domains, or entire allocations?

> So this random dude causes real problems for legitimate business and individuals and we should just accept it?

So you're having problems sending mail to a domain where the postmaster cares more about rejecting spam than she does about receiving legitimate email. That's a matter for your recipient to take up with their MSP. And if the recipient wants to receive mail from small-time domains, they need to accept that they're going to receive some spam as well; but maybe they need to switch to an MSP that only rejects on strong evidence.

My point is that it's your recipient's choice to use an MSP that blocks using some crazy list they found on github.

Some postmasters will block everything from selected countries; at one time I would block everything from Romania, because none of my users had correspondents in Romania, and email from Romania at that time was 100% spam. But I wasn't providing service to the public. I knew all my users.

Different MTAs have different users, and different patterns of abusive email. So if you want to use a custom blocklist, make your own, based on your own incoming spam (and then you can honour removal requests yourself). Otherwise use a public blocklist, based on multiple spamtraps in multiple ISPs.

So yes, you should just accept it. You don't have a right to have mail delivered by any MSP you send to; they're private organisations or individuals, and they're entitled to determine what their own policies are. In the world of email, nobody is entitled to protection from the foolishness of others.

Re: Spam blacklisting is out of control

#370

Post by maccolgan »

nottorp wrote: post #362
mjrpes wrote: post #34

I fought the battle to keep my SMTP server IP off blacklists, and lost. You can do everything possible, have a perfectly clean IP, have a good amount of outbound email traffic, only send transactional email, etc. Still, there will be edge cases where email does not go through. AT&T email servers would constantly blacklist me and not respond to requests to remove me, gmail/yahoo/outlook would silently put emails in th…

> through a transactional SMTP sender, like Postmark or Mailgun. ... cheapest is $10/month. Not paying that for my meager email traffic. Are there other options for personal domains?

AWS SES
Post reply on HN