Gmail, Yahoo announce new 2024 authentication requirements for bulk senders • Hacker News Board

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#331

Post by autoexec » Tue, Oct 31, 2023, 8:15 AM UTC

zo1 wrote: post #322

geek_at wrote: post #302

Earlier quoted context omitted.

Just a perspective from the other side of the coin: I host various services for schools like online registration for parent - teacher conferences. When the platform is live hundreds of parents are logging in, choosing their appointments and have to confirm them via email (only one email per person not per appointment) And Yahoo is the Single worst email service to send to. I have correctly configured sfp, dmarc, dkim…

I seriously don't get why we can't have some sort of licensing authority for this type of thing. Maybe they issue you a secret key to include in email headers, or put your entire domain on some sort of whitelist. And complaints get handled by a human to confirm that it's not a "oh I don't like this, or I don't remember signing up for this" non-sense complaint that would get you blocked or have your license revoked wi…

You should try starting one. You'd just need to work with every email provider on the planet (including people running personal email servers) and convince them to let you decide for them what is spam or not, get them to implement a massive list of IPs/domains to whitelist on their servers, get them to let you edit that list whenever new mass mailers sign up for your "We're totally not spam" service, and then get them to provide some way for complaints to come back to you so that you can enforce your rules. It'd be a hard sell for mail providers, and it wouldn't solve the spam problem for any messages that aren't sanctioned by your service.

You'd also have to do a lot of work to validate new senders long before they send their first message and you start getting complaints or else you're just letting spammers pay you to completely bypass every mail provider's spam filters until they finally get blocked and have to create a new account with you under a different company name.

If you can convince everyone to trust you, and your service, and that it'd be worth it for mail providers to do all that work on their end on top of everything they're doing currently to prevent spam, it really could improve deliverability.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#332

Post by Pikamander2 » Tue, Oct 31, 2023, 8:23 AM UTC

autoexec wrote: post #323

tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

> I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. Never interact with spam. Unsubscribing just tells spammers that your email address is actively being checked, and that you're the kind of p…

>Never interact with spam. Unsubscribing just tells spammers that your email address is actively being checked, and that you're the kind of person who clicks on links found in unsolicited messages.

This only applies to scam emails like newsletters from sketchy domains that you never signed up for, which are sent out specifically to find active email addresses. For those, clicking the "unsubscribe" link is indeed counterproductive.

For actual businesses like Linkedin though, it makes more sense than not to unsubscribe from unwanted emails anytime they're sent. On occasion you'll find yourself back on a different newsletter list, but it's relatively rare and more often than not just incompetence rather than malice; legitimate companies want to send their emails out to people who buy stuff, not people who mark them as spam and lower their reputation.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#333

Post by megous » Tue, Oct 31, 2023, 8:28 AM UTC

solardev wrote: post #215

megous wrote: post #95

Earlier quoted context omitted.

Any data? Or just "I say so"... Before I decided to leave it due to its horrendous false positive rate, gmail was driving like half of notification emails from my servers and mailing lists to spam, despite me never marking them as such. I was regularly missing important things. It's much better with just regular client side bogofilter and some training on my personal mail/spam archive. And I do zero server side filte…

No, sorry, it's purely anecdotal. And also more applicable to the last few decades, when other email services were still terrible, than nowadays with many adequate options. I think I have the opposite preference to you: false positives are OK to me if that means less spam gets through. In fact I've seen many of those notifications in my gmail spam and thought to myself, "Huh, you know, maybe I don't need those that b…

I largely communicate with people who contact me for the first time (people who use my FOSS projects). Different needs, I guess.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#334

Post by carstenhag » Tue, Oct 31, 2023, 8:28 AM UTC

Phelinofist wrote: post #319

geek_at wrote: post #302

Earlier quoted context omitted.

Just a perspective from the other side of the coin: I host various services for schools like online registration for parent - teacher conferences. When the platform is live hundreds of parents are logging in, choosing their appointments and have to confirm them via email (only one email per person not per appointment) And Yahoo is the Single worst email service to send to. I have correctly configured sfp, dmarc, dkim…

Why confirm via mail at all?

This is a requirement in some jurisdictions (double opt in) for some cases. Not sure about "User has a confirmed email + account at our service, he wants to sign up for a reminder" use case though.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#335

Post by account42 » Tue, Oct 31, 2023, 8:28 AM UTC

> Gmail’s AI-powered defenses stop more than 99.9% of spam, phishing and malware from reaching inboxes

And what percentage of legitimate mail?

> and that they process unsubscription requests within two days

This is a laughably lax requirement.

Also for fucks sake, stop auto-localizing your documentation based on IP geolocation.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#336

Post by carstenhag » Tue, Oct 31, 2023, 8:30 AM UTC

jupp0r wrote: post #199

sleepyhead wrote: post #174

Earlier quoted context omitted.

This is exactly why GDPR exists. What you are describing is illegal in the EU. Sending marketing communication requires clear opt in consent.

Are you sure? I don't have more than anecdotal data, but I remember unsubscribing from EU newsletters to be much more cumbersome than from US ones.

I was recently subscribed to ~500 newsletters within 10 minutes, and the most annoying ones to unsubscribe where from Brasil, US, India, etc.

(An attacker used the paypal guest account feature and used my IBAN [european bank account number] and tried to hide the mail within those hundreds of mails. They were successful for some days, until the purchase showed up on my bank account)

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#337

Post by vntok » Tue, Oct 31, 2023, 8:32 AM UTC

withinboredom wrote: post #317

albertgoeswoof wrote: post #137

Earlier quoted context omitted.

It's transactional email - so generally speaking it's not a subscription list that recipients are on per se. This is in line with the CAN SPAM guidance (although that is a US law it's good guidance to follow globally). Also it requires senders to actually implement it, which is not possible to confirm. Although we could add a catch all service that does this automatically, which I think we'll do.

This is the definition of spam. Unsolicited email with no way to revoke consent. Your user’s recipients should be able to revoke consent whenever they feel like it. If they can’t reply to the email, or unsubscribe, and the only choice to revoke consent is to mark an email as spam … you are sending spam.

No, it is not. You're missing a few key qualifiers that will depend on the country but generally include the notion of "bulk" email (thus directly excluding transactional emails).

A couple examples of such nuancing qualifiers:

- "unless prior permission has been obtained or unless there is a pre-existing commercial relationship between the parties" (UK)

- "for the purposes of direct marketing" (EU)

You may read this table to get more examples of local definitions and the associated regulations, per country: https://en.m.wikipedia.org/wiki/Email_spam_legislation_by_co...

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#338

Post by throwaway290 » Tue, Oct 31, 2023, 8:32 AM UTC

account42 wrote: post #335

> Gmail’s AI-powered defenses stop more than 99.9% of spam, phishing and malware from reaching inboxes And what percentage of legitimate mail? > and that they process unsubscription requests within two days This is a laughably lax requirement. Also for fucks sake, stop auto-localizing your documentation based on IP geolocation.

Probably half of legit mail from self-hosted servers... Anyone using them at all?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#339

Post by autoexec » Tue, Oct 31, 2023, 8:32 AM UTC

Pikamander2 wrote: post #332

autoexec wrote: post #323

Earlier quoted context omitted.

> I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. Never interact with spam. Unsubscribing just tells spammers that your email address is actively being checked, and that you're the kind of p…

>Never interact with spam. Unsubscribing just tells spammers that your email address is actively being checked, and that you're the kind of person who clicks on links found in unsolicited messages. This only applies to scam emails like newsletters from sketchy domains that you never signed up for, which are sent out specifically to find active email addresses. For those, clicking the "unsubscribe" link is indeed coun…

> For actual businesses like Linkedin though, it makes more sense than not to unsubscribe from unwanted emails anytime they're sent.

Why? What's in it for you?

You filter them = never see the spam they send you again

You unsubscribe = pray that it's not a phishing email disguised as linkedin spam, hope that if it's real they don't just start sending you different spam, and that maybe they haven't agreed to sell your (now confirmed as more valuable) email address to 3rd parties (aka, their "partners") now that you've made that email address worthless to them otherwise.

The absolute most you can ever hope for in the "unsubscribe" case has the exact same outcome as the "filter" case, while the filter case has less risk and as a bonus lets the spammers waste their time.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#340

Post by vntok » Tue, Oct 31, 2023, 8:41 AM UTC

OJFord wrote: post #214

pirsquare wrote: post #51

Earlier quoted context omitted.

Why would you allow users to unsub from transactional emails?

Because I don't need or want: - confirmation of my order - my order has been despatched - my order is out for delivery - my order has been delivered to locker - reminder to collect from locker - my order has been collected from locker - feedback on customer support chat experience - my return label has been generated - reminder to return my item - my refund is processing That's Amazon, in case it's not obvious. I don…

You are evidently in a tiny tiny minority of people with very special needs. The vast majority of users want to get these notifications, and most want to have them sent by email because it is one of the most uniquitous channels along with SMS and allows the recipient to "keep living and check the message later on when the time is right" (contrary to a regular in-app notification).

The vast majority of Amazon customers do not have its app installed. And those who do have the app can disable Amazon emails or create filters in their own mailbox, it's not exactly difficult.