Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

blog.google

Post reply on HN
Print view View original

81–90 of 420 posts

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#81

Post by jsnell »

TylerE wrote: post #70
pirsquare wrote: post #51

Earlier quoted context omitted.

Why would you allow users to unsub from transactional emails?

The problem comes, as I know very well, is that when you have a common sounding email, all kinds of people use it for all kinds of things. I get dozens of transactional emails a week from stores multiple states away. A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam.

> A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam.

That doesn't really make sense? If you used an address on your own domain, other people would be pretty unlikely to enter that email address instead of their own. The problem with misaddressed email should be limited to domains with really high username density; nobody else than the Gmails and Outlooks of the world need to solve the problem because nobody else also has the problem.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#82

Post by exabrial »

EvanAnderson wrote: post #34

Hijacking the thread: I do some "bulk" sending for a 501(c)3 I volunteer for. I include unsubscribe links that go to a form with a submit button (because I want the unsubscribe to be a POST request). Each link has a random opaque identifier in the query string. Something like: hxxp://example.com/unsubscribe?id=abcd1234 A couple years ago I noticed that MSFT IPs hitting my unsubscribe links with invalid identifiers on…

In a previous life, we prevented the GET url problem by having a javascript POST and forward to a secondary URL.

This allows everything to be "one click" (which honestly is a good thing) but prevents crawlers from accidentally triggering the unsubscribe.

Not sure this still works today and obviously this is not legal advice.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#83

Post by Semaphor »

The only spam I get on my old Gmail account, is some democratic party people who think opt in is for chumps. So whenever I check that account, I click report spam for all their spam mails. Maybe their successor won't be such an ass. One of them recently lost his election and I was very happy about that.

Edit: no idea why I only get democratic spam, maybe people with my name in the USA too dumb to enter their actual email don't like republicans. But I have no acceptance for spammers, no matter their politics.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#84

Post by cuu508 »

pirsquare wrote: post #49

This is the direct link to the guidelines. https://support.google.com/mail/answer/81126 Strange there's no mentioned about transactional emails. Since we wouldn't include unsubscribe link for transactional emails.

Depends. I suppose it would not make sense to have "unsubscribe" for "reset password" notifications, but for "there's a new event in your account, come log in to see it" type notifications it would.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#85

Post by mauriciob »

pirsquare wrote: post #51
albertgoeswoof wrote: post #26

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical. At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders. We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce). However I am curious how…

Why would you allow users to unsub from transactional emails?

Wrong address is one reason. For example, I receive transactional emails from a US-based ISP for someone else and the only way to unsubscribe is calling their customer service line. I’m not even in the same country.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#86

Post by TylerE »

jsnell wrote: post #81
TylerE wrote: post #70

Earlier quoted context omitted.

The problem comes, as I know very well, is that when you have a common sounding email, all kinds of people use it for all kinds of things. I get dozens of transactional emails a week from stores multiple states away. A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam.

> A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam. That doesn't really make sense? If you used an address on your own domain, other people would be pretty unlikely to enter that email address instead of their own. The problem with misaddressed email should be limited to domains with really high username density; nobody else than the Gmails and Outlooks of the world nee…

Becaus having used an address personally and professionally for close to 20 years, I can’t really abandon it, and I honestly get way too much important stuff to only go I. There once a month or so. If I forward all emails to the new address, I get buried under the avalanche.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#87

Post by jabart »

Right now google allows the SPF domain, and/or the DKIM signing domain to be different than the From domain, not just a subdomain but an entire different domain. From an ESP perspective, will this drop shared SPF(Return-Path) domains? I'm assuming DKIM has to match, just not sure about the return-path side. It's a bit vague in the support article.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#88

Post by kvakerok »

rbut wrote: post #63
pirsquare wrote: post #51

Earlier quoted context omitted.

Why would you allow users to unsub from transactional emails?

I'm having the same thoughts. On one of my SaaS apps workers receive details on their shifts via email. If I allow them to one-click unsubscribe, I know there will be many who do so accidentally, with no idea how to resubscribe. Currently they need to sign in and manage their contact methods in settings (email, SMS, etc). Thus they know how to re-enable it if they disable it. I can see many support requests from mana…

You can simply put two buttons on the email, one for unsubscribe, one for re-subscribe. If they unsub by accident they can simply pull the last email and re-sub. It's not rocket science.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#89

Post by butlike »

theglenn88_ wrote: post #36
jedberg wrote: post #32

It's not clear to me how this is any different than before? Most of my spam that I actually see already has all those things (valid DKIM, one-click unsubscribe link, and a rate limit per sender). If you really want to fix email spam, create a micro-payments system. One cent for every email you send, the user has two options after they open the email: mark it as spam and keep the penny, mark it as legit and give the p…

If I had a penny for every legitimate email I marked as spam, I’d be a billionaire. Jokes aside, why wouldn’t you just farm pennies by marking all emails as spam? You could say, “well you could detect people that abuse the system” - and now the mouse is chasing the cat.

You bring up a vaid case. People farming pennies could be an issue, but on the other hand, farming pennies is a more noble cause, and one that ostensibly seems far easier to catch. I'd rather do a lookup to find the outliers who are harvesting pennies than to try and cat-and-mouse spammers who are masquerading as legitimate senders.

Re: Gmail, Yahoo announce new 2024 authentication requirements for bulk senders

#90

Post by partiallypro »

asddubs wrote: post #25
teruakohatu wrote: post #3

Most of the spam I get in gmail apparently comes from other gmail accounts. Presumably google already filtered out senders pretending to be gmail, so I am not sure what a big improvement this will be for the average user.

I've gotten a few emails from my own gmail account, spoofed, which inexplicably did not land in the spam folder. This happened to me on multiple different gmail accounts, too.

This happens to me all the time, I honestly am not sure this measure is going to solve much.
Post reply on HN