Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

mailgun.com

Post reply on HN
Print view View original

231–240 of 279 posts

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#231

Post by hospitalJail »

mullingitover wrote: post #91
pests wrote: post #82

Earlier quoted context omitted.

I've seen a perverse dark pattern on one click unsubscribe. The page you land at has a button that lets you resubscribe! It looks non-obvious you've already unsubscribed and it looks like the regular two-click flow needing to enter your email address to confirm. Very sneaky.

If unsubscribing requires even two clicks I always flag it as spam. The rule is one-click to unsubscribe and I ruthlessly enforce it. Make it their problem.

Huh, I am an individual who is a scientist, not a web dev.

I paid some company to do my email.

I email 3 times per year and get 'spam' warnings from AWS every time despite everyone subscribing through a: "SUBSCRIBE TO OUR NEWSLETTER"

No bait, just an email field and submit.

I wonder if its your type that makes it so I have to be Amazon for forgiveness. Or at least that is how it used to be, now I sell addicting clicking casino games. No emails needed. I make way more money than back when I was giving away free content via email.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#232

Post by rebelde »

d3w4s9 wrote: post #157

Slightly off-topic: it seems that Outlook has given up fighting spam and isn't even in such conversations. I have a decades-old hotmail.com email address that is getting spams daily in the inbox, while a similarly old gmail.com almost always filters them out. Well, Gmail occasionally flags false positives but never false negatives. This is getting so bad that I have completely moved off that hotmail.com address.

Microsoft, like the old Microsoft, seems to completely reject all these modern methods and use their own instead. So, you get a lot of spam and my legitimate emails are rejected.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#233

Post by dexwiz »

boplicity wrote: post #169
dexwiz wrote: post #68

Earlier quoted context omitted.

Its 5000/day for marketing, and if you are sending 5000 emails a day, you probably should have unsubscribe links. https://support.google.com/mail/answer/81126#requirements-5k You also need a link, not just list-unsubscribe, and it is specifically for marketing emails. In my experience, Google is pretty accurate in figuring out transactional versus marketing. They don't tell their heuristics, but you don't think engin…

> you probably should have unsubscribe links They're not requiring just unsubscribe links. They're specifically requiring "one-click" unsubscribe links that can accept a POST request for unsubscribing. This allows their software to have an unsubscribe button that doesn't require the user to leave their software. This is the RFC that has to be complied with: https://datatracker.ietf.org/doc/html/rfc8058 Note, that thi…

No, that is for generating the Unsubscribe buttons in the email client itself. They also require a link in the body itself. From the google doc:

  Marketing messages and subscribed messages must support one-click unsubscribe, and include a clearly visible unsubscribe link in the message body.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#234

Post by corney91 »

max_ wrote: post #79

I use cloudflare's email remailer. i.e emails are mailed from from & to my Gmail via cloudflare. Using a custom email domain. Does this mean that my emails will no longer be sent?

DMARC only requires SPF or DKIM to pass, so the mail will pass of it's DKIM signed.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#235

Post by nottorp »

EGreg wrote: post #192

Unsubscribe HAS to require an authenticated session. What do they mean by “single click”? Otherwise anyone who receives a forwarded email can unsubscribe you! Right? At least we can email the peson to say they’ve been unsubscribed, as a transactional email? And give them a chance to resubscribe and prevent such unsubscriptions — or what? Enable easy unsubscription: Senders will need to implement a single-click unsubs…

> Otherwise anyone who receives a forwarded email can unsubscribe you! Right?

Yes, I have nightmares where I dream that someone else unsubscribes me from all those informative mailing lists that I NEVER OPTED IN TO.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#237

Post by chuckadams »

sylware wrote: post #200
chuckadams wrote: post #16

Earlier quoted context omitted.

SPF only authenticates the envelope-from, whereas it's DKIM that takes care of the From: header. Without DKIM, one can easily do "EHLO randomspamdomainboughtyesterday.com" and "From: accounts@citibank.com". SPF is about the transport, DKIM is about the content. And to round it out, DMARC tells the receiver what to do when the SPF or DKIM tests fail, namely "report", "quarantine", or "reject". Not sure why they're req…

This is wrong: DKIM would be used only if SPF does not "pass", if there. DNS SPF is inappropriate for those email provider implementing DNS trickery which cannot work with DNS SPF. For DNS SPF to "pass", not only the SMTP prolog and transactions must be evaluated, but also some header fields (from:,reply-to:). For instance, if you are self-hosted and your SPF DNS entry does match the domain in the SMTP prolog/transac…

I'd ask you to show me the relevant section in RFC4408 that backs up your claims about header fields, but honestly I don't care to read any more incoherent rambling screeds on the topic. Cheers.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#238

Post by callalex »

kragen wrote: post #52
TheCycoONE wrote: post #25

DKIM, SPF, and DMARC are old hat and implemented by anyone serious for years. What's buried in this article is the required https://datatracker.ietf.org/doc/html/rfc8058 support for one-click unsubscribe posts. I don't see many messages in my inbox yet with that.

also it violates longstanding security measures against malicious prank unsubscribes; it means that if you forward an email list message to someone else, they can unsubscribe you without your consent as a prank

Is this a real problem in your life?

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#239

Post by sylware »

chuckadams wrote: post #237
sylware wrote: post #200

Earlier quoted context omitted.

This is wrong: DKIM would be used only if SPF does not "pass", if there. DNS SPF is inappropriate for those email provider implementing DNS trickery which cannot work with DNS SPF. For DNS SPF to "pass", not only the SMTP prolog and transactions must be evaluated, but also some header fields (from:,reply-to:). For instance, if you are self-hosted and your SPF DNS entry does match the domain in the SMTP prolog/transac…

I'd ask you to show me the relevant section in RFC4408 that backs up your claims about header fields, but honestly I don't care to read any more incoherent rambling screeds on the topic. Cheers.

chatgpt?

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#240

Post by EGreg »

nottorp wrote: post #235
EGreg wrote: post #192

Unsubscribe HAS to require an authenticated session. What do they mean by “single click”? Otherwise anyone who receives a forwarded email can unsubscribe you! Right? At least we can email the peson to say they’ve been unsubscribed, as a transactional email? And give them a chance to resubscribe and prevent such unsubscriptions — or what? Enable easy unsubscription: Senders will need to implement a single-click unsubs…

> Otherwise anyone who receives a forwarded email can unsubscribe you! Right? Yes, I have nightmares where I dream that someone else unsubscribes me from all those informative mailing lists that I NEVER OPTED IN TO.

Straw man much?

I subscribe to receive emails or newsletters. I forward them to someone. They unsubscribe me. I stop getting them. I wonder what happens and blame the site. They couldn't even inform me what happened.

Developers are supposed to make the correct security architecture for things. Letting anyone who gets your forwarded email take actions as you on the site without any further authentication, is not the right security model.

Post reply on HN