Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

111–120 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#111

Post by jedberg »

ahoka wrote: post #108
jedberg wrote: post #32

It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender). If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the p…

You have invented bitcash, the ancestor of bitcoin.

Well not exactly. The currency isn't the hard part, it's the payment transfer infrastructure that would be hard. If the big players all go on board and agreed to one thing we'd be off to the races.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#112

Post by jacobwg »

EvanAnderson wrote: post #80
austhrow743 wrote: post #74

Earlier quoted context omitted.

My reading is that in your comment they replied to, you said you require confirmation for unsubscription. One click unsubscription is presumably what they want.

I require a button to be clicked to confirm. No entry, no JavaScript, nothing else. Just something to make a POST request because I receive GET requests for almost every URL I send out. My experience is that every unsubscribe goes to a form w/ a submit button. Shitty ones make you type your email address. (Mine doesn't.)

I've seen a hybrid where you have a form with a button to confirm, but include JavaScript to auto-submit the form on load. For the crowd that has JS disabled, they can click the button, but otherwise it's one-click from the email.

No idea if this holds if/when the email crawler bots start executing JS on crawl.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#113

Post by jsnell »

taveras wrote: post #98
jsnell wrote: post #81

Earlier quoted context omitted.

> A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam. That doesn't really make sense? If you used an address on your own domain, other people would be pretty unlikely to enter that email address instead of their own. The problem with misaddressed email should be limited to domains with really high username density; nobody else than the Gmails and Outlooks of the world nee…

Transactional email intended for other people is exactly my problem. My name is common in certain areas, and I consistently get transactional email from banks, telecoms, and insurance companies around the world. These businesses do not verify that their customer’s email is truly their own prior to sending emails. Framing custom domains as the solution to this problem is a bit rash, no?

I'm not framing it as a general solution. But the GP was already migrating to a different domain and claimed this was the main blocker.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#114

Post by knodi123 »

pirsquare wrote: post #51
albertgoeswoof wrote: post #26

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how…

Why would you allow users to unsub from transactional emails?

I got a really cool vanity email address, back in the early days of gmail. But the downside of that is 100s of goofball people around the world randomly guessing it when they want to put some bullshit value in a field on a web form. The worst was when my address got posted to to some indian jobs forum, under a title like "test job" - I got dozens of applications per hour for a few days. I had to make filters to block all email that included the words "bangalore", "delhi", or "hyderabad".

Anyway, the job applications have died down, but I still get plenty of others for people who are creating accounts. I unsubscribe when I can, and "mark spam" when I can't.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#115

Post by sbuk »

EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

It'll likely be the URL rewriting feature in Microsoft 365 and Outlook.com. The URL will be scanned before it's rewritten.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#116

Post by 998244353 »

tiffanyh wrote: post #52
joering2 wrote: post #44

Earlier quoted context omitted.

You joking right? The amount of text messages spam I receive now on Verizon, and some 8 months ago before on T-mobile is staggering.

Are you suggesting that because of stronger KYB/KYC for sending bulk, that increased the amount of spam text you get?

I think they are suggesting that the stronger KYB/KYC was ineffective at reducing the amount of spam.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#117

Post by jsnell »

TylerE wrote: post #86
jsnell wrote: post #81

Earlier quoted context omitted.

> A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam. That doesn't really make sense? If you used an address on your own domain, other people would be pretty unlikely to enter that email address instead of their own. The problem with misaddressed email should be limited to domains with really high username density; nobody else than the Gmails and Outlooks of the world nee…

Becaus having used an address personally and professionally for close to 20 years, I can’t really abandon it, and I honestly get way too much important stuff to only go I. There once a month or so. If I forward all emails to the new address, I get buried under the avalanche.

Why limit yourself to only either forwarding emails or to "check for important emails" once per month?

For example, email clients generally allow you to use multiple accounts at the same time. Configure your client to read emails from both accounts at the same time, and any time an important email arrives at the legacy account try to update the sender.

(I mean, I'm sure that xkcd.com/1172 applies, but still this seems like an odd thing to be blocked by.)

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#118

Post by [deleted] »

eastbound wrote: post #96
LeifCarrotson wrote: post #55

Earlier quoted context omitted.

I honestly don't care about their reputation, I just mark anything I don't want as spam. It's easier than finding the tiny 8-point link at the bottom and rolling the dice on whether their unsubscribe is one click or not. I don't feel obligated to protect their shitty business model.

I once went to an Atlassian conf and they resold all our emails to dodgy people. Or perhaps leaked them over the black markets. Not only I keep receiving almost the same email suggesting to buy 5,000 email addresses of Atlassian customers with always the same fields, but it’s always from different domains. I didn’t think of submitting an Atlassian ticket for each spam I receive. That would teach them. NEVER give your…

[deleted]

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#119

Post by crazygringo »

mauriciob wrote: post #85
pirsquare wrote: post #51

Earlier quoted context omitted.

Why would you allow users to unsub from transactional emails?

Wrong address is one reason. For example, I receive transactional emails from a US-based ISP for someone else and the only way to unsubscribe is calling their customer service line. I’m not even in the same country.

Exactly, seriously -- I get monthly+ e-mails from a gym and a car dealership and some golf course because somebody else put in my e-mail.

I contacted the customer support for all of them and they said they can't do anything about it. To change the customer's e-mail address, I need to prove I'm the customer, and obviously I have no idea who they are.

So I gave up and implemented a Gmail filter in the end, but I definitely wish that parallel with the traditional unsubscribe, there was a way to say "this isn't that person's e-mail". Where I don't have to prove I'm the person, I just have to demonstrate I receive the e-mails.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#120

Post by WirelessGigabit »

albertgoeswoof wrote: post #26

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how…

Side-note: for list-unsubscribe, do you determine the subscriber's identity that needs to be unsubscribed based on the sender or the receiver (like @unsubscribe.service.com)?

Reason I'm asking is Unsubscribe rarely works for me due to my catch-all not SENDING emails from the address it was received on. It sends it from my actual address. Very annoying.

Post reply on HN