Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

181–190 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#181

Post by georgyo »

Reading all the comments makes me think I'm an outlier.

I very aggressively unsubscribe from everything so I get very little mailing list spam. Maybe a few messages a month.

What I do get _constantly_ is spam email messages to my inbox from Gmail and Outlook domains. At least one a day for many years. Because it from Gmail, they have very little spam filtering done, yet if any other provider sent these messages then Google would block the entire domain.

These particular spam messages get on my nerves, and these are the only ones making it through to me.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#182

Post by snthd »

yard2010 wrote: post #144
sbuk wrote: post #115

Earlier quoted context omitted.

It'll likely be the URL rewriting feature in Microsoft 365 and Outlook.com. The URL will be scanned before it's rewritten.

I've never understood why some emails are ending with :J? I thought it was a meme I didn't understand. It turns out it's just Outlook doing its thing

Some versions of outlook autocorrected a smiley to a J in the wingdings font.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#183

Post by MisterBastahrd »

EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

Some companies attempt to hit every link in order to cache the link and then embed their own link so that they can track those links, and also to examine for malware. I work for a marketing SaaS and what made us break away from the monolith structure was that our server was getting blasted to hell and back by the sheer volumes of tracking links that were automatically followed by email providers.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#184

Post by jeroenhd »

legitster wrote: post #129
overstay8930 wrote: post #17

Doesn't matter to me, if an email doesn't have a one click unsubscribe I just mark it as spam. Messes with their email reputation so they hopefully get kicked off of reputable email services.

Unfortunately for us, the Privacy team at our org has determined that a one-click unsubscribe link in the body of the email is unacceptable (passing an identifier into the URL of the link). So we accept either the client unsubscribe link, or users who click the unsubscribe link in the email have to provide their email address on the unsubscribe page.

That's rather ridiculous. There's a good reason not to put a one-click unsubscribe button in the email (email scanners will GET every URL you link to check for malware and you end up auto-unsubbing your recipients) but emails already inherently contain personal information: the email address they're directed to.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#185

Post by Macha »

pembrook wrote: post #171

The authentication stuff is all standard practice so no big change IMO. However the hard spam limit with Gmail in particular will get interesting. I predict this is going to create some insane headaches for indie Saas startups. Gmail is the only inbox provider that doesn’t offer a real feedback loop (you don’t actually know if a given email address marked you as spam when sending to gmail users). The FBL in Google po…

Honestly sounds like I'm on the side of Gmail here.

Think about this from the perspective of an actual spammer. You get a notification that address XYZ is marked as spam by user ABC. Well, now you just email user ABC from a different address.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#186

Post by LeonM »

zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

Why wouldn't you be able to set up your own email server anymore?

Yes, you need to configure authentication (DKIM, rDNS and preferably DMARC) but you should be doing that anyway, the hard requirement doesn't change that.

One-click unsubscribe is required for bulk email, but you probably don't want to be sending bulk mail from your self-hosted solution anyway.

Anti-spam isn't killing the internet, spammers did.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#187

Post by SOLAR_FIELDS »

sleepyhead wrote: post #174
tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

This is exactly why GDPR exists. What you are describing is illegal in the EU. Sending marketing communication requires clear opt in consent.

I just had this experience today. The problem is that at least in the States the regulation is ambiguous enough to be abused to hell and back. Unsubscribe in the States could mean “Unsubscribe from all” or “Unsubscribe from 1 of 20” or it could mean “unsubscribe from all now, but we will arbitrarily resign you up for some new newsletter whenever we feel like it”. I got a spam email today from some no name dropshipper I bought contacts from probably a decade ago, I got LASIK 3 years ago and haven’t needed contacts since.

Some large companies even flagrantly violate the extremely lax rules that exist in the States. Guitar Center has infamously been sending me emails that are in direct violation of the one click unsubscribe regulations for almost a decade now. I can’t even sign in to the account to cancel the emails (which is in direct violation of the regulation- it is ambiguous on a lot of things but the one thing that it isn’t is that you aren’t supposed to be required to log in to opt out of email communications) because it was made with my dad’s email from 20 years ago yet I’m the recipient of the spam.

I did report them; but of course nothing must have happened because they are still doing it.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#188

Post by jeroenhd »

donmcronald wrote: post #104
justinator wrote: post #66

I'm a little unclear how these requirements differ from just setting up correct DKIM/SPF records, and having a one-click unsub link - or is this all they're saying? If so, sounds good to me.

That's what it sounds like to me. The cynic in me thinks it's a prelude to stuff like BIMI because that lets them add a large annual cost for anyone that wants decent deliverability. It's a way for large senders to use their market position to invent a new industry with a service we all have to pay for. Free money!

Does Google even sell BIMI compatible certificates? I don't think they're making any money with that protocol.

BIMI does solve some issues with DKIM, so I can see why Google prefers it. Requiring what should be a minor fee for any company to do bulk email will also make it difficult to set up a thousand different spam domains.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#190

Post by thaumasiotes »

starttoaster wrote: post #154
yard2010 wrote: post #140

Earlier quoted context omitted.

I have that friend that whenever I don't feel like putting my own email or phone number I just put his. You probably have that friend too, the other way around

Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself that you put down when you don't want to put your own email in? I just cannot fathom any reason for you doing this that isn't just malice. Surely nobody is just so _lazy_ that they intend to screw over their friends over a minute or two process making an account.

> Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself

Have you tried doing this recently? Creating an email address has become a fairly draconian process.

Post reply on HN