Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

101–110 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#101

Post by ahoka »

rurp wrote: post #24
solardev wrote: post #6

Earlier quoted context omitted.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

Perhaps, but it's hard to say. False positives are much more harmful than false negatives. I have peronally had Gmail flag a number of legit emails as spam, and those are just the ones I know about! It's almost certain that I have lost valuable messages because I didn't check the spam folder in time. These aren't transactional emails either, I'm talking about messages from real people that I know personally. I would…

Most people I know regularly read their spam folders… which kinda defeats the purpose.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#102

Post by albertgoeswoof »

wredue wrote: post #100
kvakerok wrote: post #88

Earlier quoted context omitted.

You can simply put two buttons on the email, one for unsubscribe, one for re-subscribe. If they unsub by accident they can simply pull the last email and re-sub. It's not rocket science.

Or, send an email saying “Hey. You unsubscribed. Here’s a link to resubscribe if you happen to want to!” Right after someone unsubs.

You could also send them a reminder a few days later, just to be sure that they meant it. And then perhaps every week or so for good measure.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#103

Post by amalcon »

mauriciob wrote: post #85
pirsquare wrote: post #51

Earlier quoted context omitted.

Why would you allow users to unsub from transactional emails?

Wrong address is one reason. For example, I receive transactional emails from a US-based ISP for someone else and the only way to unsubscribe is calling their customer service line. I’m not even in the same country.

I get a number of these for some reason. If they don't let me unsubscribe, I just report it as spam. It's not perfect, but it's what little I can do.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#104

Post by donmcronald »

justinator wrote: post #66

I'm a little unclear how these requirements differ from just setting up correct DKIM/SPF records, and having a one-click unsub link - or is this all they're saying? If so, sounds good to me.

That's what it sounds like to me.

The cynic in me thinks it's a prelude to stuff like BIMI because that lets them add a large annual cost for anyone that wants decent deliverability. It's a way for large senders to use their market position to invent a new industry with a service we all have to pay for. Free money!

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#105

Post by TheCycoONE »

pixl97 wrote: post #18
nerdo wrote: post #14

Earlier quoted context omitted.

The one-click part I believe is referring to the unsubscribe smtp header. CAN-SPAM is ignored for the most part anyway, e.g. LinkedIn requires recipients to authenticate in order to unsubscribe and openly violates the letter and spirit of the law to the point scripts are required: https://github.com/chengyin/linkedin-unsubscribed

Unsubscription requirements are a pain in the ass in the sense that anyone that steals a large list of emails (from any service, not yours in this particular case) could now run it against your service and unsubscribe a million users before you realize what's going on via a botnet.

The opaque id is suppose to not be guessable. I does mean you can't batch send emails by calling RCPT TO though which will hurt bandwidth.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#106

Post by cxr »

exabrial wrote: post #82
EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

In a previous life, we prevented the GET url problem by having a javascript POST and forward to a secondary URL. This allows everything to be "one click" (which honestly is a good thing) but prevents crawlers from accidentally triggering the unsubscribe. Not sure this still works today and obviously this is not legal advice.

Not an answer to the question they asked.

---

Okay, HN. Go ahead and explain what's offensive here.

The question that was asked: "I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on the [query] string. Anybody ever seen that?"

The question the parent commenter seems to have hallucinated: "Does anyone know how we can keep mail services from unsubscribing folks in error when these mail services scan our subscribers' emails, but also still offer our subscribers 1-click unsubscribe?"

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#107

Post by tempnow987 »

pirsquare wrote: post #51
albertgoeswoof wrote: post #26

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how…

Why would you allow users to unsub from transactional emails?

So they don't start getting blocked as spam? For transactional emails deliverability is often CRITICAL.

Oddly, on the cash app thing, I have a very basic username and seem to constantly have folks sending me money, sometimes good amounts. I never use the app, and eventually I hope the money goes back if I don't collect it.

More annoying on email but much less than it used to be - I think more systems require email verification now so a bit less common to get the misdirected order emails etc.

But yes, if I can't unsubscribe - then I block and report spam - even if it looks like transactional email (some is a lead-in to a scam where they will refund you for the "bogus" purchase).

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#108

Post by ahoka »

jedberg wrote: post #32

It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender). If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the p…

You have invented bitcash, the ancestor of bitcoin.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#109

Post by NullPrefix »

asddubs wrote: post #25
teruakohatu wrote: post #3

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

I've gotten a few emails from my own gmail account, spoofed, which inexplicably did not land in the spam folder. This happened to me on multiple different gmail accounts, too.

Click "Mark as spam" and the all mighty machine learning might decide that the sender address (your address) is a spam sender

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#110

Post by tempnow987 »

Does anyone know if this will stop NGP Van emails (seems to be dem party platform). I cannot get off their mailing lists - they seem to resell the email constantly. I've probably unsubscribed from NGP emails 50+ times. It's crazy. How are they not entirely blocked?
Post reply on HN