Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

31–40 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#31

Post by benatkin »

asddubs wrote: post #25
teruakohatu wrote: post #3

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

I've gotten a few emails from my own gmail account, spoofed, which inexplicably did not land in the spam folder. This happened to me on multiple different gmail accounts, too.

Perhaps they wanted you to see that someone was trying to spoof you. They should have a better way of doing that though :/

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#32

Post by jedberg »

It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender).

If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the penny back. If they don't act on it within a week you get your penny back.

Legit senders won't be harmed because they will get their pennies back, spammers won't be able to afford sending messages anymore. The real interesting part would be stuff like LinkedIn notifications -- if people find them useful they'd give the penny back, but companies would have to decide how many people might actually find it useful for their cost analysis.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#33

Post by solardev »

rurp wrote: post #24
solardev wrote: post #6

Earlier quoted context omitted.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

Perhaps, but it's hard to say. False positives are much more harmful than false negatives. I have peronally had Gmail flag a number of legit emails as spam, and those are just the ones I know about! It's almost certain that I have lost valuable messages because I didn't check the spam folder in time. These aren't transactional emails either, I'm talking about messages from real people that I know personally. I would…

I'd take the false positives, personally. If someone really needs to reach me and doesn't get to me on the first try, they usually just email or text back and go "Hey, did you get my email?". Or, just quickly skim through the spam folder once a week.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#34

Post by EvanAnderson »

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like:

hxxp://example.com/unsubscribe?id=abcd1234

A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on the quest string. Anybody ever seen that?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#35

Post by atomicnumber3 »

chimeracoder wrote: post #9
zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

> Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now. It's been a long time since you've been able to set up your own email servers without DKIM and expect that your emails will get reliably delivered to Gmail users, especially for bulk mail. The second requirement is more or less already a legal requirement in the US, and the thir…

This is my impression too. I briefly used emails from a domain I own to my gmail account as a way to send myself "notifications". My impression was that absolute table stakes to even make e-mail deliver work AT ALL were:

- non residential IP (I had to proxy through my VPS) - SPF - DKIM - use TLS with a modern cipher

And even with this, I still had to "favorite" (or whatever) AND set up a rule to "never send to spam" for my alerts@ sender address because I would still get them going to spam for no reason that I could find - I'd check the message and would see that SPF and DKIM PASSED and yet it was still going to spam.

I ended up switching to using webhooks to send alerts to a discord channel for a server that only had me in it. It works fine. It's a lot more surefire than trying to figure out email delivery

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#36

Post by theglenn88_ »

jedberg wrote: post #32

It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender). If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the p…

If I had a penny for every legitimate email I marked as spam, I’d be a billionaire.

Jokes aside, why wouldn’t you just farm pennies by marking all emails as spam?

You could say, “well you could detect people that abuse the system” - and now the mouse is chasing the cat.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#37

Post by nwienert »

EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

I thought it was part of CAN SPAM that you can’t require a second action and that was why the big email sending providers moved to that.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#38

Post by muppetman »

solardev wrote: post #6
zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

"open models/blacklists don't come anywhere close to Gmail's capabilities"

I disagree with you. I use Postfix with rspamd plugged into it for my personal email account. I get way more spam to my gmail than I do to my personal account, and I sign up to everything with my personal account.

rspam also dkim signs my emails when I send them etc, verifies SPF/DKIM/DMARC on recipet etc.

Now to counter that - I am a TINY mail server - Probably 100 emails a day tops.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#39

Post by jedberg »

theglenn88_ wrote: post #36
jedberg wrote: post #32

It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender). If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the p…

If I had a penny for every legitimate email I marked as spam, I’d be a billionaire. Jokes aside, why wouldn’t you just farm pennies by marking all emails as spam? You could say, “well you could detect people that abuse the system” - and now the mouse is chasing the cat.

Because people would stop sending you email.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#40

Post by KeepFlying »

nwienert wrote: post #37
EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

I thought it was part of CAN SPAM that you can’t require a second action and that was why the big email sending providers moved to that.

Probably true but how do you handle autodetonation of email links in that case? Too many emails servers will click links automatically to check for issues.

That was my understanding at least.

Post reply on HN