Gmail, Yahoo announce new 2024 authentication requirements for bulk senders • Hacker News Board

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#231

Post by pjd7 » Tue, Oct 31, 2023, 1:16 AM UTC

Overall the changes seem sensible. For those wanting to self host there are plenty of guides out there on how to configure various MTAs with all of the required bits.

BUT, Why does IP reputation matter so much these days when you have DKIM, MTA-STS, DANE and other mechanisms that provide verification of the sender?

Say I want to startup a Email Service Provider, I need to go and source a bunch of IPv4 typically to have a premium upsell for end users to really ensure cross sender reputation does not impact other tenants. Crazy.

IPv6 historically at least was anecdotally punished by the likes of GMAIL, Yahoo, Hotmail, Office365 etc. Does anyone know if IPv6 hosted email severs still suffer additional spam scoring?

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#232

Post by cryptoegorophy » Tue, Oct 31, 2023, 1:25 AM UTC

tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

I wish Apple Hide My Email features existed 20 years ago. Any new signup now is I use hide my email.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#233

Post by kiwijamo » Tue, Oct 31, 2023, 1:26 AM UTC

georgyo wrote: post #181

Reading all the comments makes me think I'm an outlier. I very aggressively unsubscribe from everything so I get very little mailing list spam. Maybe a few messages a month. What I do get _constantly_ is spam email messages to my inbox from Gmail and Outlook domains. At least one a day for many years. Because it from Gmail, they have very little spam filtering done, yet if any other provider sent these messages then…

In the days I ran my own main server for my domain I was surprised to find that well over 50% of spam originated from Google (both emails with @gmail.com domains but also emails from other domains being processed via their servers). And I wasn't even a Gmail customer, so it looks like they don't really filter outgoing mail to other providers. It made my inbound filtering quite tricky as I couldn't block Google as quite lot of legitimate traffic comes from friends using Gmail so the other Spamassassin rules (e.g. content analysis) had to do much of the heaving lifting. A couple of years back I gave up and outsourced the MX for my domain to Fastmail. Interestingly they also struggle to filter Gmail messages (which isn't too surprising as they also use Spamassassin) but thankfully there are only a few a week that get past and I always make sure these are flagged as spam to train the filter. Over time they end up going into my Spam folder and eventually they just don't arrive at all due to my spam settings blocking high spam scores.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#234

Post by somehnguy » Tue, Oct 31, 2023, 1:28 AM UTC

ACow_Adonis wrote: post #218

tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

i can't be the only oldskool person on hacker news who knows not to click on unsubscribe buttons because it just identifies you as a legitimate email/mark... these are spammers, not cases where you ever actually signed up to some kind of legitimate newsletter or discussion group. to pretend good faith is your first mistake...

That's the case for spam sent by illegitimate parties (actual spammers), but any real company (what OP is referring to) will respect the unsubscribe button because they're at risk of being sued otherwise. Clicking unsubscribe in those cases actually does work & doesn't put you at risk of anything.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#235

Post by kiwijamo » Tue, Oct 31, 2023, 1:29 AM UTC

stevage wrote: post #198

georgyo wrote: post #181

Reading all the comments makes me think I'm an outlier. I very aggressively unsubscribe from everything so I get very little mailing list spam. Maybe a few messages a month. What I do get _constantly_ is spam email messages to my inbox from Gmail and Outlook domains. At least one a day for many years. Because it from Gmail, they have very little spam filtering done, yet if any other provider sent these messages then…

Yep, I'm the opposite of you. I get almost zero true "spam" to my Gmail account. Maybe 1-2 messages a month. Whereas quite a few of these quasi-spam marketing emails from a company that I once had some interaction with. The worst is hotels - you stay at 10 hotels during the course of a trip, then you get added to 10 email lists for the rest of your life.

I have a Gmail account I opened in the early days of Gmail and stopped using on a regular basis when I got my own domain around mid-2000's. Whenever I occasionally check in, I always find heaps of spam. Many I've tried unsubscribing for and still get the mail--obviously Gmail's filter doesn't take into account senders I've flagged time and time again as spam.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#236

Post by nvr219 » Tue, Oct 31, 2023, 1:32 AM UTC

cryptoegorophy wrote: post #232

tgsovlerkhgsel wrote: post #155

> we’ll enforce a clear spam rate threshold that senders must stay under I hope they make it really strict. I'm sick of companies that send you spam ("newsletters") just because you interacted with them once, then when you unsubscribe, you get unsubscribed from that one list, so they keep spamming you just with a slightly different newsletter type. (Edit: Also, everything requiring a notification - by e-mail if they…

I wish Apple Hide My Email features existed 20 years ago. Any new signup now is I use hide my email.

I use fastmail masked email (which is basically the same thing) with the firefox plugin. I love it.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#237

Post by kijin » Tue, Oct 31, 2023, 1:33 AM UTC

figassis wrote: post #219

sph wrote: post #195

Earlier quoted context omitted.

If I'm certain I don't know the company, or I know the company but there is no unsubscribe button, it goes straight to Spam, no questions asked. A decade ago I went to my country's embassy to renew my passport, and they now use my email to subscribe me to the newsletters of any new political party. All unsubscribe links just 404s. Shameful behaviour. Anything I receive from any of their political candidates goes stra…

There's worse. An unsubscribe link that asks you to submit your email. Few things anger me more, because they went through the trouble of pretending to comply, and a decision was made to make my day more difficult.

That exists for a reason, and it's not nefarious at all.

Lot of people, especially of the older generation, forward all sorts of emails to their friends and family every day. If one person who received a forwarded email doesn't like it and clicks the unsubscribe link, the original recipient (who clearly likes the email enough to forward it around) gets unsubscribed. That's a bug. If you don't like the unfunny newsletter your uncle keeps forwarding you, that's a problem between you and your uncle, not between your uncle and his newsletter!

The email submission form exists to ensure that the person unsubscribing is the person who is actually on the mailing list. It will not prevent an annoyed nephew from deliberately unsubscribing the original recipient, but it will prevent most cases of mistake by third parties.

Similarly, many unsubscribe links require two clicks instead of one, because some email services used to automatically check out every link they found in the body of an email. A one-click link would unsubscribe everyone before they even saw the email. Nowadays we have better protocols and better email scanners, but old industry habits die hard.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#238

Post by tppiotrowski » Tue, Oct 31, 2023, 1:34 AM UTC

figassis wrote: post #219

sph wrote: post #195

Earlier quoted context omitted.

If I'm certain I don't know the company, or I know the company but there is no unsubscribe button, it goes straight to Spam, no questions asked. A decade ago I went to my country's embassy to renew my passport, and they now use my email to subscribe me to the newsletters of any new political party. All unsubscribe links just 404s. Shameful behaviour. Anything I receive from any of their political candidates goes stra…

There's worse. An unsubscribe link that asks you to submit your email. Few things anger me more, because they went through the trouble of pretending to comply, and a decision was made to make my day more difficult.

Also needing to log in before you can unsubscribe.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#239

Post by kiwijamo » Tue, Oct 31, 2023, 1:40 AM UTC

solardev wrote: post #6

zitterbewegung wrote: post #4

Oh fun so basically no one will be able to setup their own email servers by themselves anymore. Antispam is killing the open internet now.

...and saving email at the same time. It's totally unusable without spam filters, and the open models/blacklists don't come anywhere close to Gmail's capabilities.

You mean the same Gmail that is responsible for >50% of all spam to other providers? They may be good at filtering mail from other providers to Gmail accounts, but they are lousy when it comes to the other direction i.e., mail out of Gmail to other providers. Unless they're prepared to block their own users from sending spam to other providers (or even other Gmail users) this initiative won't be of much use.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#240

Post by incompatible » Tue, Oct 31, 2023, 1:47 AM UTC

tppiotrowski wrote: post #238

figassis wrote: post #219

Earlier quoted context omitted.

There's worse. An unsubscribe link that asks you to submit your email. Few things anger me more, because they went through the trouble of pretending to comply, and a decision was made to make my day more difficult.

Also needing to log in before you can unsubscribe.

Especially if your account is no longer accessible; a problem I had with Uber after changing my phone number. Bombarded with "Uber Eats" spam and no way to unsubscribe without going through some kind of ridiculous process to reactivate the account.