Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

21–30 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#21

Post by ericpauley »

chimeracoder wrote: post #13
teruakohatu wrote: post #3

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

> Most of the spam I get in gmail apparently comes from other gmail accounts. Are they actually from Gmail accounts, or are they simply spoofing the sender? My bet is on the latter, because Google has heavy restrictions on Gmail that make it impractical to use for sending bulk spam. > I am not sure what a big improvement this will be for the average user. It's not going to be particularly noticeable for the average u…

Gmail also has DMARC quarantine enabled. What’s more likely, that someone broke DMARC or that they stole someone’s password? My bet is on the latter.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#22

Post by maybeben »

chimeracoder wrote: post #13
teruakohatu wrote: post #3

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

> Most of the spam I get in gmail apparently comes from other gmail accounts. Are they actually from Gmail accounts, or are they simply spoofing the sender? My bet is on the latter, because Google has heavy restrictions on Gmail that make it impractical to use for sending bulk spam. > I am not sure what a big improvement this will be for the average user. It's not going to be particularly noticeable for the average u…

The vast majority of spam we get that isn't trivially rejected (DMARC, malformed HELO, etc) is from real, actual gmail. But they sure do care about _incoming_ spam.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#23

Post by chimeracoder »

nerdo wrote: post #14
chimeracoder wrote: post #5

This isn't as big of a change as it sounds. There are three requirements. The first requirement - DKIM - is already a de facto must-have when sending emails to avoid getting marked as spam. The second is also a legal requirement in the US for all commercial email under the CAN-SPAM act[0]. And the third is more or less how email delivery has worked for the last 20 years or so anyway. [0] The "one click" and "within t…

The one-click part I believe is referring to the unsubscribe smtp header. CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn requires recipients to authenticate in order to unsubscribe and openly violates the letter and spirit of the law to the point scripts are required: https://github.com/chengyin/linkedin-unsubscribed

> CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn requires recipients to authenticate in order to unsubscribe and openly violates the letter and intent of the law to the point scripts are required:

There are several known-bad actors. LinkedIn isn't even the worst offender - Amazon is much more brazen, though they get less flak for it because the number of violating non-transactional emails they send is lower.

Regardless, I stand by my point that this isn't a big shift. Google stating publicly that they will penalize people who are violating an law that turns 20 years old this year, and which has generally been implemented by almost all legitimate bulk email providers[0], is not something I'm particularly surprised about or worried by.

Again, the first and third bullet points in this press release are already de facto policy at Gmail, and have been for over a decade. The news is that Google is stating this publicly, not that they're doing something new.

[0] The notable exceptions notwithstanding, it's quite rare to find a bulk email sender who violates this, because very few legitimate mail providers will allow it, and it's pretty difficult to set up your own mail server with decent inbox delivery rates.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#24

Post by rurp »

solardev wrote: post #6
zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

Perhaps, but it's hard to say. False positives are much more harmful than false negatives. I have peronally had Gmail flag a number of legit emails as spam, and those are just the ones I know about! It's almost certain that I have lost valuable messages because I didn't check the spam folder in time. These aren't transactional emails either, I'm talking about messages from real people that I know personally.

I would be willing to wade through a number of additional spam emails to avoid losing important ones but of course this is Google so there is no user facing dial to adjust the sensitivity. Users just have to trust that Google's generalized approach is well calibrated for them.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#25

Post by asddubs »

teruakohatu wrote: post #3

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

I've gotten a few emails from my own gmail account, spoofed, which inexplicably did not land in the spam folder. This happened to me on multiple different gmail accounts, too.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#26

Post by albertgoeswoof »

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical.

At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders.

We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce).

However I am curious how Google will track this. Just because the header is set, it doesn’t mean it’ll do anything. In fact it can be used by spammers to identify legit email addresses and spam them separately.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#27

Post by koito17 »

zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

I rarely get spam in my inbox, if at all, but I also never sign up for newsletters nor give airlines, grocery stores, etc. my e-mail address.

I get spam messages once in a blue moon on my iPhone (specifically, on iMessage, I get recipients with a string of random letters ending in gmail.com). Ironically, it's ALWAYS a gmail.com or hotmail.com address. Funny how the overwhelming majority of spam I can remember comes from Gmail and Outlook, both of which love sending everyone else's messages straight into the spam tray, despite having DKIM + DMARC set up, static IP not on any Spamhaus blocklist, etc.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#28

Post by notwhereyouare »

overstay8930 wrote: post #17

Doesn't matter to me, if an email doesn't have a one click unsubscribe I just mark it as spam. Messes with their email reputation so they hopefully get kicked off of reputable email services.

biglots is horrible about this. I have unsubscribed MULTIPLE times and I keep getting emails. Now marked as spam

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#29

Post by fiddlerwoaroof »

solardev wrote: post #6
zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

My personal mailserver works just fine with some rudimentary anti-spam measures (mostly manual filter lists).

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#30

Post by solardev »

candiddevmike wrote: post #12
solardev wrote: post #6

Earlier quoted context omitted.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

Ironically, most of my breakthrough spam seems to come from @gmail.com addresses...

Same, but that's because all the other hundreds of pages of spam got filtered away already.

I wouldn't be surprised if Gmail spam is higher-effort (like those individual SMS spam apps that politicians use) but higher-breakthrough.

Post reply on HN