Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spam domains that plague my email

gist.github.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Spam domains that plague my email

#41

Post by djbusby »

inferiorhuman wrote: post #7
lwf wrote: post #4

Surprised to not see gmail.com in the list[1]. [1]: https://drewdevault.com/2021/02/25/Gmail-is-a-huge-source-of... , https://news.ycombinator.com/item?id=26265329

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

I've used Postgrey, for Postfix, and it's greatly reduced my spam. However, first emails from new folk are delayed a bit.

https://postgrey.schweikert.ch/

Re: Spam domains that plague my email

#42

Post by cube00 »

inferiorhuman wrote: post #7
lwf wrote: post #4

Surprised to not see gmail.com in the list[1]. [1]: https://drewdevault.com/2021/02/25/Gmail-is-a-huge-source-of... , https://news.ycombinator.com/item?id=26265329

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

The current round is using DKIM verified messages from the gmail.com domain.

DKIM: 'PASS' with domain gmail.com

Re: Spam domains that plague my email

#43

Post by Beltalowda »

chaoz_ wrote: post #29
Beltalowda wrote: post #26

Earlier quoted context omitted.

Anecdotally, I have to say I rarely have issues with FastMail's spam filtering, which uses SpamAssassin (not sure what their setup is exactly of course). I rarely get spam in my inbox (maybe an email or two a month), and it almost never marks things as false positives (last one was years ago).

SpamAssasin does ok only on subset of spam emails.. The problem is that underlying model is not capable to differentiate fake email from your boss (unless it's really simple) VS many other external emails you get. I guess you would still want that 2nd level of protection for your ORG with sensitive data even if some "please buy X" - spam emails are still getting in. Ofc Google is also not ideal :)

> The problem is that underlying model is not capable to differentiate fake email from your boss (unless it's really simple) VS many other external emails you get.

But that's not really "spam", right? That's targetted phishing, which is quite a different thing.

Re: Spam domains that plague my email

#44

Post by 8organicbits »

r1ch wrote: post #11
nubela wrote: post #8

These are usually domains that belong to a disposable email service, be it public or private. I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. We use the domains found at https://www.stopforumspam.com/downloads amongst other sources of data. Works pret…

Why does your API want the full email address? That becomes a privacy liability as surely the domain alone is enough.

Could be for aliases. foo+bar@gmail.com routes to foo@gmail.com, but you may prefer to only allow a single account for foo@.

Re: Spam domains that plague my email

#45

Post by 8organicbits »

jstanley wrote: post #23
nubela wrote: post #8

These are usually domains that belong to a disposable email service, be it public or private. I maintain a 100% free API [1] to check if an email belongs to a disposable email service. We dogfood the same API endpoint to prevent users who abuse disposable emails to create fake accounts for free trial credits. We use the domains found at https://www.stopforumspam.com/downloads amongst other sources of data. Works pret…

What exactly is "fake" about an account one creates with a disposable email address?

I suspect "fake" is the wrong word, maybe "very low reputation" is better. The parent post discusses avoiding giving unlimited free trials to people who just keep creating new accounts. You'll want to restrict that, especially if each trial costs a non-trivial amount of money. Efficiently detecting such abuse allows the company to offer generous free trials.

A side effect is that a small number of people who use disposable email addresses to manage the spam they receive will also be blocked (see other comments). A business looking at this issue may find it hard to prioritize, the group is small, and they can choose to use a non-disposable address if they want to continue.

Re: Spam domains that plague my email

#46

Post by johnklos »

chmike wrote: post #36
inferiorhuman wrote: post #7

Earlier quoted context omitted.

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

Spammers use vpn nowadays. This make these spammhaus like services useless. They change IPs every week. Most mail protection models against spam don't work. I have an idea of a method that could help reduce spam and undesirable mails. It would be free for non-spammers and spammers would pay. The problem is that I'm not sure if people would be ready to adopt it. There is also many different ways to execute, and I'm no…

People don't set up email servers on VPN endpoints. That's not how email works.

Re: Spam domains that plague my email

#47

Post by chaoz_ »

Beltalowda wrote: post #43
chaoz_ wrote: post #29

Earlier quoted context omitted.

SpamAssasin does ok only on subset of spam emails.. The problem is that underlying model is not capable to differentiate fake email from your boss (unless it's really simple) VS many other external emails you get. I guess you would still want that 2nd level of protection for your ORG with sensitive data even if some "please buy X" - spam emails are still getting in. Ofc Google is also not ideal :)

> The problem is that underlying model is not capable to differentiate fake email from your boss (unless it's really simple) VS many other external emails you get. But that's not really "spam", right? That's targetted phishing, which is quite a different thing.

If "spam == mail that user did not expect/want to receive", then phishing emails are also unwanted :)

It's all up to definitions, but yeah the two categories are different in nature.

Re: Spam domains that plague my email

#48

Post by rsstack »

krageon wrote: post #21
2143 wrote: post #10

Earlier quoted context omitted.

Create a custom filter in Gmail to delete it; let it bypass the inbox and go straight to trash. (There's a "Filter messages like these" option somewhere)

Your fix is essentially "roll your own spam filter"

What's the other fix? Complain on Hacker News?

Yes, if something is bothering you enough - fix it on your own.

Re: Spam domains that plague my email

#49

Post by sylware »

chmike wrote: post #36
inferiorhuman wrote: post #7

Earlier quoted context omitted.

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

Spammers use vpn nowadays. This make these spammhaus like services useless. They change IPs every week. Most mail protection models against spam don't work. I have an idea of a method that could help reduce spam and undesirable mails. It would be free for non-spammers and spammers would pay. The problem is that I'm not sure if people would be ready to adopt it. There is also many different ways to execute, and I'm no…

spammhaus is blocking self-hosted smtp servers.

Have a look at grey listing.

Re: Spam domains that plague my email

#50

Post by sylware »

djbusby wrote: post #41
inferiorhuman wrote: post #7

Earlier quoted context omitted.

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

I've used Postgrey, for Postfix, and it's greatly reduced my spam. However, first emails from new folk are delayed a bit. https://postgrey.schweikert.ch/

grey listing seems to be the only reasonable way to keep the Email in the "free world" (namely where spammers are allowed to do their "thing").

But gmail will do everything to take over the Email using the "spammers" as an excuse.

Post reply on HN