Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Spam domains that plague my email

gist.github.com

Post reply on HN
Print view View original

51–60 of 68 posts

Re: Spam domains that plague my email

#51

Post by sylware »

shapefrog wrote: post #24
inferiorhuman wrote: post #7

Earlier quoted context omitted.

When I self-hosted email I used Spamhaus to as a block list and Spam Assassin to filter the rest. Gmail users made up the biggest chunk of spam that got through but it was never from Google/Gmail domains, it was almost always from a Gmail user with a custom domain.

I wonder if SPF / DKIM / DMARC have improved this. Google domains doesnt make it quite as easy as other hosting providers, and to be honest if they were super serious about email abuse they should encourage every domain to use it.

SPF does not protect you from a pown smtp server (neither DKIM/DMARC, then SPF is "enough" for self-hosted smtp servers, and does force you to use DNS (the SMTP protocol works without DNS).

Re: Spam domains that plague my email

#52

Post by uallo »

8organicbits wrote: post #45
jstanley wrote: post #23

Earlier quoted context omitted.

What exactly is "fake" about an account one creates with a disposable email address?

I suspect "fake" is the wrong word, maybe "very low reputation" is better. The parent post discusses avoiding giving unlimited free trials to people who just keep creating new accounts. You'll want to restrict that, especially if each trial costs a non-trivial amount of money. Efficiently detecting such abuse allows the company to offer generous free trials. A side effect is that a small number of people who use disp…

The group of people that go through the hassle of signing up and setting up everything again to avoid paying is probably equally small. If the account setup is so frictionless that a lot of people do it again and again, you should work on adding benefits to loyal accounts instead of banning new users.

Re: Spam domains that plague my email

#53

Post by prvit »

lwf wrote: post #4

Surprised to not see gmail.com in the list[1]. [1]: https://drewdevault.com/2021/02/25/Gmail-is-a-huge-source-of... , https://news.ycombinator.com/item?id=26265329

Despite the title, the article you linked has nothing whatsoever to do with spam coming from Gmail.

Re: Spam domains that plague my email

#54

Post by prawn »

2143 wrote: post #10
prawn wrote: post #9

Earlier quoted context omitted.

I mark email from someone spam over and over, and it can still get past Gmail. It's infuriating.

Create a custom filter in Gmail to delete it; let it bypass the inbox and go straight to trash. (There's a "Filter messages like these" option somewhere)

I'm aware, but I would've thought that marking something as spam would stop more almost-identical messages from the exact same email address. Having to create a custom filter for all the individual spammers that make it through is frustrating.

Re: Spam domains that plague my email

#55

Post by TheNewsIsHere »

Beltalowda wrote: post #26
chaoz_ wrote: post #16

Earlier quoted context omitted.

I've done some experiments with Gmail/Outlook/other spam detection clients on different types of spam/phishing etc. There's always someone who claims simple naive bayes algo would do better than Google. I'm not able to share the research data, but Gmail filter is a lot better than everything else you see on the market, especially when it's not a newsletter-like advertisement spam, but an actual phishing attack on Org…

Anecdotally, I have to say I rarely have issues with FastMail's spam filtering, which uses SpamAssassin (not sure what their setup is exactly of course). I rarely get spam in my inbox (maybe an email or two a month), and it almost never marks things as false positives (last one was years ago).

My experience mirrors yours. Fastmail’s filtering is at least as good as Google’s for my inboxes, but Google and the other big players don’t seem to have spam filtering better than Fastmail’s on balance. Casually controlling for things like inbox age, I still get a bit more spam in my Google inboxes than in my Fastmail inboxes.

Once you’ve warmed up/activated the personal mail filter in Fastmail, it seems to work better than anyone else’s.

Re: Spam domains that plague my email

#56

Post by 2Gkashmiri »

chaoz_ wrote: post #16
NikhilVerma wrote: post #2

I am seeing Google constantly fail to catch obvious spam emails. At this point I suspect there is some institutional error on their part, where bad actors inside the org are allowing certain domains to simply not be spam filtered.

I've done some experiments with Gmail/Outlook/other spam detection clients on different types of spam/phishing etc. There's always someone who claims simple naive bayes algo would do better than Google. I'm not able to share the research data, but Gmail filter is a lot better than everything else you see on the market, especially when it's not a newsletter-like advertisement spam, but an actual phishing attack on Org…

how do mail delivery services work with this in protecting users from spam because their aim is to reach the inbox for their customers, spammers included

Re: Spam domains that plague my email

#57

Post by WorldMaker »

xmodem wrote: post #31
shapefrog wrote: post #24

Earlier quoted context omitted.

I wonder if SPF / DKIM / DMARC have improved this. Google domains doesnt make it quite as easy as other hosting providers, and to be honest if they were super serious about email abuse they should encourage every domain to use it.

There is a marketing company that is constantly adding me to new spammy lists they are creating. They are using AWS SES / SendGrid / other reputable providers. The emails all pass SPF/DKIM/DMARC and filing abuse reports seems to get me taken off the list I complained about but I quickly get added to a different one. I am this close to auto-blocking anything from these large providers and switching to allow-listing th…

I feel this. Because of a Google Group I briefly followed one of my email addresses got incorrectly associated with my Kickstarter account on some marketing list somewhere and gets added to so much "legitimate" marketing lists for fly-by-night Kickstarters. It's really frustrating and the accident of it being a "wrong" email at least makes it somewhat easier to manage (though I worry if I ignore that mailbox too much I may miss the rare once in a few years important email to it).

For a while MailChimp was the only one of the major/reputable providers I trusted the Unsubscribe button on because they had a "I did not sign up for this button" that supposedly dinged the mailing list owner's reputation with them, but more than that would supposedly make it a bit tougher for the next mailing list to just dump that email in without a verification step or a cool off period.

That button disappeared recently and I guess MailChimp no longer cares either. Shame.

Re: Spam domains that plague my email

#58

Post by 8organicbits »

uallo wrote: post #52
8organicbits wrote: post #45

Earlier quoted context omitted.

I suspect "fake" is the wrong word, maybe "very low reputation" is better. The parent post discusses avoiding giving unlimited free trials to people who just keep creating new accounts. You'll want to restrict that, especially if each trial costs a non-trivial amount of money. Efficiently detecting such abuse allows the company to offer generous free trials. A side effect is that a small number of people who use disp…

The group of people that go through the hassle of signing up and setting up everything again to avoid paying is probably equally small. If the account setup is so frictionless that a lot of people do it again and again, you should work on adding benefits to loyal accounts instead of banning new users.

You can actually check how many users it impacts by watching how the bounce rate changes after a user with a disposable email address is told their address isn't accepted. Adjust course based on your metrics.

Re: Spam domains that plague my email

#60

Post by chmike »

johnklos wrote: post #46
chmike wrote: post #36

Earlier quoted context omitted.

Spammers use vpn nowadays. This make these spammhaus like services useless. They change IPs every week. Most mail protection models against spam don't work. I have an idea of a method that could help reduce spam and undesirable mails. It would be free for non-spammers and spammers would pay. The problem is that I'm not sure if people would be ready to adopt it. There is also many different ways to execute, and I'm no…

People don't set up email servers on VPN endpoints. That's not how email works.

You don't need a mail server to send mail. One can send mails through a VPN as client.
Post reply on HN