Spam blacklisting is out of control • Hacker News Board

Re: Spam blacklisting is out of control

#131

Post by adrium » Sat, Feb 05, 2022, 9:00 PM UTC

I have been running my own mail server for two years on my private ISP and have less problems than expected - even with the dynamic IP address (in practice, it changes once in 6-12 months) and no PTR. I also switched the ISP once. I have SPF, DKIM, DMARC.

Edit: The nice thing about running the mail server personally and without a relay (like mailgun) is that mail is to-my-end encrypted. If the other party is running its own mail server, it could even be E2E encrypted. Considering the vast amount of personal information that going through email, this makes me feel good in terms of privacy.

I have never heard of UCEPROTECT and fortunately, I never had to deal with it. The language on the webpage somehow reminds me of Kryptochef...

A small inconvenience is that I had to unblock the IP on Spamhaus PBL every month. By now, it feels as if they know me, because I now only have to do this once if I get a new IP...

Many mail servers are nice and provide the reason for the block even with hints how to unblock it. I successfully unblocked it on Abusix and Microsoft. Never had an issue with Google.

GMX on the other hand will never accept my email because they require a proper PTR record. They are the only company I have come across and I find that scandalous.

Re: Spam blacklisting is out of control

#132

Post by walrus01 » Sat, Feb 05, 2022, 9:01 PM UTC

noduerme wrote: post #108

mjrpes wrote: post #34

I fought the battle to keep my SMTP server IP off blacklists, and lost. You can do everything possible, have a perfectly clean IP, have a good amount of outbound email traffic, only send transactional email, etc. Still, there will be edge cases where email does not go through. AT&T email servers would constantly blacklist me and not respond to requests to remove me, gmail/yahoo/outlook would silently put emails in th…

I manage an outbound mail server for a mid-sized company. I happen to also use it for my own personal mail. We have had on and off deliverability issues for years (AT&T and Comcast being the worst). As head of IT it fell to me to post whitelisting requests and try to get mail delivering again. I decided after awhile that this really isn't my job, and made a suggestion to the CEO which he took to heart: There is anoth…

Not everyone can spend $500 on lawyer billable hours per SMTP destination multiplied by N number of destinations.

I also think that the likelihood of success in sending legal threats to somebody that demand they accept your SMTP traffic will not stand up in court, if you ever escalated it that far.

As somebody who runs postfix MX on the receiving side of things, I can guarantee you that the day I receive a legal threat from some unknown third party with which I don't have a pre-existing business/contract relationship, demanding that I accept their email, is the day that I blacklist their entire organization and tell them "okay, I'll await service of your statement of claim".

You actually think that the best answer to a network engineering problem is to make legal threats at third party ISPs? Companies with which you don't have a signed service order contract and/or master services agreement?

You say you're a mid sized company. I think you're running a huge legal risk of angering a Comcast or AT&T size entity that has much deeper pockets and legal resources than you. The day that one of those giants calls you out on your bluff is going to be very expensive.

On an ISP-to-ISP relationship level, this is not how you solve SMTP flow traffic problems. I can tell you that if I went to a NANOG conference representing my AS and proudly told other people "oh yeah, we've started sending threats from our lawyers to $OTHERISP1 and $OTHERISP2 because they won't take our mail traffic", that I would quickly be treated as a pariah.

Re: Spam blacklisting is out of control

#133

Post by mhh__ » Sat, Feb 05, 2022, 9:03 PM UTC

walrus01 wrote: post #132

noduerme wrote: post #108

Earlier quoted context omitted.

I manage an outbound mail server for a mid-sized company. I happen to also use it for my own personal mail. We have had on and off deliverability issues for years (AT&T and Comcast being the worst). As head of IT it fell to me to post whitelisting requests and try to get mail delivering again. I decided after awhile that this really isn't my job, and made a suggestion to the CEO which he took to heart: There is anoth…

Not everyone can spend $500 on lawyer billable hours per SMTP destination multiplied by N number of destinations. I also think that the likelihood of success in sending legal threats to somebody that demand they accept your SMTP traffic will not stand up in court, if you ever escalated it that far. As somebody who runs postfix MX on the receiving side of things, I can guarantee you that the day I receive a legal thre…

Could you get a lawyer to draft you one template that looks scary while also not leading to much follow up unless you really want to be whitelisted by that particular entity?

Re: Spam blacklisting is out of control

#134

Post by pishpash » Sat, Feb 05, 2022, 9:09 PM UTC

berdon wrote: post #112

newaccount74 wrote: post #100

Earlier quoted context omitted.

That's why I said the email should contain info about the sender -- there should of course be a way to contact them. Ideally you should just be able to reply to the message and tell them about the error. If there's no way to contact a company, that's a whole different problem, and not really one that would be fixed with unsubscribe links in important email messages.

In 99% of the cases - there is no recourse. In one instance, I tried replying and they asked me to prove my identity as the customer to cancel the emails.

This, I've had people receiving bank alerts for an account they don't own and they can't be stopped. What these companies lack are customer-centric processes that they've thought through.

Wtf is wrong with putting contact information in the unsubscribe link, or reach out productively on request? Why would you presume somebody clicks it by accident vs. the much more likely case of it being a legitimate request? Are you afraid they really want to cancel your service? Or are you afraid you can't send spam under the guise of transactional messages? Or worse, listen to customers about how best to alert them? Truly ridiculous!

Re: Spam blacklisting is out of control

#135

Post by gog » Sat, Feb 05, 2022, 9:10 PM UTC

scarface74 wrote: post #85

neilv wrote: post #62

The US federal government should tackle huge email account providers that effectively (by accident or design) use anti-spam as a pretext to sabotage self-hosted email.

Yes because the government involved in technology always makes things better as I click on “allow cookies” on every damn website.

Punishing anti-competitive measures doesn't have to be always complicated.

"Allow cookies" modals are horrible but GDPR gives people in the EU rights to be forgotten and not contacted in the future. Reminding companies about GDPR regulations works very well.

Re: Spam blacklisting is out of control

#136

Post by pishpash » Sat, Feb 05, 2022, 9:11 PM UTC

elondaits wrote: post #105

berdon wrote: post #93

Earlier quoted context omitted.

What about situations where your email somehow (mistype) gets set up for someone else's account? I have 2-3 people with similar emails to my previous email address that would mistype and I'd receive their emails. These weren't spam but the companies wouldn't offer _any_ way to fix this. My recourse is to just flag them as spam in gmail.

You can create a Gmail filter to delete or archive them automatically and avoid poisoning the spam filter.

It's not on me to do their job for them. It costs time and hence money.

Re: Spam blacklisting is out of control

#137

Post by thayne » Sat, Feb 05, 2022, 9:18 PM UTC

If I were to design a replacement messanging system to replace email, I would design it with deny by default, where messages that aren't signed by someone on your contact list are rejected. Maybe with a system to request that someone add you to their contact list (though with a limit on how much text can be in that request).

Maybe something like that could be done with email, but without a culture around it, figuring out what addresses you need to add to your contact list when you add new services could be a pain.

Re: Spam blacklisting is out of control

#138

Post by walrus01 » Sat, Feb 05, 2022, 9:20 PM UTC

pl0x wrote: post #116

The adblock lists are out of the control. Adblock Plus and Brave will block put your site on a block list to then sell ads against your site to companies like Verizon and Google. Brave loves Verizon so much they even listed them as a featured advertiser. https://brave.com/brave-ads/

note that there is a huge difference between corrupted for profit things like "adblock plus" and the community sourced, not for profit things like ublock origin.

Re: Spam blacklisting is out of control

#139

Post by adrium » Sat, Feb 05, 2022, 9:22 PM UTC

huhtenberg wrote: post #15

> Or I can leave the current hosting company Yep, that's the one. If your hoster doesn't care about spam spreading from their IP space, you should take your mail server elsewhere. There's literally nothing to think about. And if they do care about this issue, they are likely to be taking steps to remove any of their IP space from the blacklists, without being nudged. PS. I've been running a mail server for close to 2…

I have a similar experience: Some hosting providers / AS host shady stuff and I understand that VPS ranges end up on block lists quite easily.

I only block AS 4134 and AS 4837, some AS that host services like shodan, and aggressive crawlers like semrush.

Anything that sends packets to my server get ratelimited quickly. Still barely noticeable for occasional human interaction. I also started with /24, but I am now up to /12.

PS. By the way, has anyone ever seen spameri@tiscali.it in the logs? It shows up almost on a weekly basis as RCPT TO address from literally all over the world.

Re: Spam blacklisting is out of control

#140

Post by kbenson » Sat, Feb 05, 2022, 9:23 PM UTC

Silhouette wrote: post #76

mjrpes wrote: post #34

I fought the battle to keep my SMTP server IP off blacklists, and lost. You can do everything possible, have a perfectly clean IP, have a good amount of outbound email traffic, only send transactional email, etc. Still, there will be edge cases where email does not go through. AT&T email servers would constantly blacklist me and not respond to requests to remove me, gmail/yahoo/outlook would silently put emails in th…

While I am happy for you that you have found a solution, the solution you found is symptomatic of a very dangerous situation: it is increasingly impossible for individuals or SMEs to use essential online facilities like sending messages or transferring money reliably unless they use a broker service as an intermediary. We are allowing small numbers of tech firms to take control of vital functionality that should be u…

This is just the internet moving to match the real world. In the real world, reputation matters and some people don't want to talk to you unless someone can vouch for you. For areas where the general public needs to interact, third party intermediary services spring up to fill this need.

This is why for any store over the size of a mom and pop operation in a neighborhood, you can't just tell the owner who you know by name to put it on your account, and instead for credit purchases you use a credit card company which acts as an intermediary and smooths problems over on both sides, and refuses to work with stores and people that are untrustworthy.

This is why there are mailing list (mass email) services and why mail servers allow them. They keep their customers working within the accepted bounds (they ensure removal works and fire clients that abuse), and this allows mass email for accepted reasons while still being able to come down hard in random exploited servers/accounts.

This is why big email services are very selective about what servers they talk to. I work at an ISP where our main outbound mail servers are on IPs that we try not to change because they've got decades of reputation attached. Even so, we recently brought up two new servers for email forwards, and shifted a small percentage of our mail queue traffic to them and ramped it up over a couple weeks, and that seemed to work "warming them up" to the likes of Gmail and yahoo, etc. It used to be there were lists of mail operators you could be part of and you could use reputation within that to get them to be lenient with you when you started. These days it's all so centralized in a few very large players that they really likely just talk to each other.