Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

mailgun.com

Post reply on HN
Print view View original

171–180 of 279 posts

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#171

Post by eli »

boplicity wrote: post #169
dexwiz wrote: post #68

Earlier quoted context omitted.

Its 5000/day for marketing, and if you are sending 5000 emails a day, you probably should have unsubscribe links. https://support.google.com/mail/answer/81126#requirements-5k You also need a link, not just list-unsubscribe, and it is specifically for marketing emails. In my experience, Google is pretty accurate in figuring out transactional versus marketing. They don't tell their heuristics, but you don't think engin…

> you probably should have unsubscribe links They're not requiring just unsubscribe links. They're specifically requiring "one-click" unsubscribe links that can accept a POST request for unsubscribing. This allows their software to have an unsubscribe button that doesn't require the user to leave their software. This is the RFC that has to be complied with: https://datatracker.ietf.org/doc/html/rfc8058 Note, that thi…

Yes, that's the List-Unsubscribe header and it doesn't require a POST request.

Email deliverability has always meant staying on top of changing requirements.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#172

Post by diggan »

boplicity wrote: post #170
ryandrake wrote: post #12

As a self-hoster for over a decade, setting up SPF, DKIM, and DMARC are pretty much once-and-done and free, so there's pretty much no downside. I'd be shocked if most self-hosters haven't set these up long ago.

For those sending in bulk, the more challenging part will be complying with rfc8058 https://datatracker.ietf.org/doc/html/rfc8058

For sending outgoing emails in a self-hosted environment, the toughest step will absolutely be to find a host willing to accept you as a customer.

A lot of places don't accept outgoing SMTP traffic at all, some allow it for personal usage and finding someone who accepts you sending lots of outgoing SMTP traffic is gonna be really hard, except if that host already hosts lots of already spam-marked IPs.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#173

Post by boplicity »

eli wrote: post #171
boplicity wrote: post #169

Earlier quoted context omitted.

> you probably should have unsubscribe links They're not requiring just unsubscribe links. They're specifically requiring "one-click" unsubscribe links that can accept a POST request for unsubscribing. This allows their software to have an unsubscribe button that doesn't require the user to leave their software. This is the RFC that has to be complied with: https://datatracker.ietf.org/doc/html/rfc8058 Note, that thi…

Yes, that's the List-Unsubscribe header and it doesn't require a POST request. Email deliverability has always meant staying on top of changing requirements.

No -- this actually expands on the List-Unsubscribe header, and adds a POST request header for one-click unsubscribe.

From the RFC:

> This document addresses this part of the problem, with an HTTPS POST action

Look at the examples in the RFC for a clear description.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#174

Post by jabroni_salad »

sylware wrote: post #3

Abusive, SPF is plenty enough unless you cannot map the domain with the right IPs due to DNS trickery (rotation, etc), then you would need an IP agnostic way to do some checks, hence the cryptographic DNS based signature. That said, with no-DNS email addresses, SPF comes for free (alice@[x.x.x.x] bob@[ipv6:...]). Namely, if SPF does pass, cryptographic DNS based signature mecanisms are excessive and must not be used…

https://github.com/CanIPhish/spf-bypass

i wish. If you are using spf-only, you are consenting to being spoofed.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#175

Post by flumpcakes »

freddieleeman wrote: post #93

For those interested in testing their email for SPF, DKIM, and DMARC compliance or eager to learn about these mechanisms that enhance email security and prevent spoofing, check out https://learnDMARC.com . This is a site I developed to promote adoption and share knowledge. It includes a challenging quiz, tough even for professionals. I'd be keen to know your scores on the first attempt – honesty counts!

This is great! I scored 60% because I didn't realise 5321 HELO was also checked. That's news to me, I've never seen that before. I got 90% on my 2nd attempt :)

Also I think there was one question that was a mistake, it had a policy along the lines of:

v=DMARC1; p=reject; ; pct=0;

I answered that a failing message would have an effect of p=none, but the right answer was apparently p=quarantine. Is that right, considering pct=0? (Unless I was blind and the pct wasn't set to 0 in the question...)

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#176

Post by xur17 »

alright2565 wrote: post #154
pests wrote: post #100

Earlier quoted context omitted.

I tried that once with Nextdoor. They will group their mailings into different lists. The unsubscribe button only removes you from that list. To disable them all is 30+ clicks on the site once logged in. It's horrible.

I just went through this with Nextdoor in October. Well, I personally didn't do all 50 clicks, but I asked their customer service to do it and they confirmed I was unsubscribed. Of course, I got a new message from them yesterday because they've added a dozen different lists since then and automatically opted everyone into them.

Is this technically permitted behavior under CANSPAM? Seems like a company could just create a new "newsletter / list" for every new marketing email they send.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#177

Post by ndriscoll »

jwr wrote: post #113
dexwiz wrote: post #68

Earlier quoted context omitted.

Its 5000/day for marketing, and if you are sending 5000 emails a day, you probably should have unsubscribe links. https://support.google.com/mail/answer/81126#requirements-5k You also need a link, not just list-unsubscribe, and it is specifically for marketing emails. In my experience, Google is pretty accurate in figuring out transactional versus marketing. They don't tell their heuristics, but you don't think engin…

> Google is pretty accurate in figuring out transactional versus marketing. They don't tell their heuristics, but you don't think engineers who build web crawlers cannot build email classifiers? Yes, I definitely think that. The engineers can build anything, but where the company focuses matters. I've seen transactional E-mails get sorted into people's spam/junk/newsletter folders too many times.

I also get tons of spam to my inbox despite regularly marking it as such, so if they are classifying marketing emails, they're not doing anything with that information.

How hard is it to classify a message that literally contains the string "this is an advertisement"?

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#178

Post by zie »

atesti wrote: post #140
TheCycoONE wrote: post #25

DKIM, SPF, and DMARC are old hat and implemented by anyone serious for years. What's buried in this article is the required https://datatracker.ietf.org/doc/html/rfc8058 support for one-click unsubscribe posts. I don't see many messages in my inbox yet with that.

I have seen Outlook and other systems click on every link in our mailings. Using a sandboxed browser. How can one click unsubscribe work here? Mail scanners, virus scanners and even Microsoft's own spam filters would probably click these links!

The unsubscribe links are POST, not GET's. That's basically the entire safety net.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#179

Post by zie »

jasonjayr wrote: post #27
TheCycoONE wrote: post #25

DKIM, SPF, and DMARC are old hat and implemented by anyone serious for years. What's buried in this article is the required https://datatracker.ietf.org/doc/html/rfc8058 support for one-click unsubscribe posts. I don't see many messages in my inbox yet with that.

I understand that the request happens in the background by the MUA at the user's express consent, and the unsubscribe is not allowed to send back any ui/html/whatever to present to the user, but the RFC is missing any information about how a response ought to be handled, HTTP Status code wise? Retry if 400/500? Give user any affirmative or negative response that it succeeded or failed?

You can't send back anything? oops. I better re-read the RFC's, that's not how I implemented it...

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#180

Post by eli »

boplicity wrote: post #173
eli wrote: post #171

Earlier quoted context omitted.

Yes, that's the List-Unsubscribe header and it doesn't require a POST request. Email deliverability has always meant staying on top of changing requirements.

No -- this actually expands on the List-Unsubscribe header, and adds a POST request header for one-click unsubscribe. From the RFC: > This document addresses this part of the problem, with an HTTPS POST action Look at the examples in the RFC for a clear description.

Ah, my mistake. The MAILTO: style unsubscribes were a bit of a pain to deal with anyway.
Post reply on HN