Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

mailgun.com

Post reply on HN
Print view View original

91–100 of 279 posts

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#91

Post by mullingitover »

pests wrote: post #82
TheCycoONE wrote: post #25

DKIM, SPF, and DMARC are old hat and implemented by anyone serious for years. What's buried in this article is the required https://datatracker.ietf.org/doc/html/rfc8058 support for one-click unsubscribe posts. I don't see many messages in my inbox yet with that.

I've seen a perverse dark pattern on one click unsubscribe. The page you land at has a button that lets you resubscribe! It looks non-obvious you've already unsubscribed and it looks like the regular two-click flow needing to enter your email address to confirm. Very sneaky.

If unsubscribing requires even two clicks I always flag it as spam. The rule is one-click to unsubscribe and I ruthlessly enforce it. Make it their problem.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#92

Post by LinAGKar »

cameldrv wrote: post #57
kragen wrote: post #52

Earlier quoted context omitted.

also it violates longstanding security measures against malicious prank unsubscribes; it means that if you forward an email list message to someone else, they can unsubscribe you without your consent as a prank

Requiring the user to login to unsubscribe also has the nice effect of requiring them to know the password, otherwise they have to go through the reset procedure. Of course you need to be really secure and do 2FA as well. Hey, if this reduces the number of people who successfully unsubscribe, don't blame me, I'm just over here trying to make sure things are secure!

Not only that, it also requires then to accept your EULA/Privacy Policy before you let them unsubscribe.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#93

Post by freddieleeman »

For those interested in testing their email for SPF, DKIM, and DMARC compliance or eager to learn about these mechanisms that enhance email security and prevent spoofing, check out https://learnDMARC.com. This is a site I developed to promote adoption and share knowledge. It includes a challenging quiz, tough even for professionals. I'd be keen to know your scores on the first attempt – honesty counts!

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#94

Post by mook »

dexwiz wrote: post #63
hsbauauvhabzb wrote: post #62

Please describe ‘easily unsubscribe’ - subjective terms like this don’t work when you’re dealing with the profit focused marking department of scumcorp. I don’t want to log into your service or explain why I want to unsubscribe or chose which mailing lists I want to unsubscribe from (read: All of them) nor do I want to deal with your dark patterns such as colouring the ‘cancel my request to unsubscribe’ button green…

Senders will need to implement a single-click unsubscribe link within emails if they haven’t already, to allow recipients to easily opt out. It does in the article. The industry has clear definitions for things like one click unsubscribe versus two click confirmation.

My bank sends (non-transactional) email to me with an unsubscribe link, then magically I get sent more even after going through the whole thing (to the screen where they confirm everything has been unsubscribed).

It's hard to confirm externally that things worked.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#95

Post by ksjskskskkk »

freddieleeman wrote: post #93

For those interested in testing their email for SPF, DKIM, and DMARC compliance or eager to learn about these mechanisms that enhance email security and prevent spoofing, check out https://learnDMARC.com . This is a site I developed to promote adoption and share knowledge. It includes a challenging quiz, tough even for professionals. I'd be keen to know your scores on the first attempt – honesty counts!

harder part is knowing the hacks from your dns provider that prevents things from working right.

I've spent two weeks on a domain with limited registrar options because their dns manager lied about supporting larger public keys in txt records.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#96

Post by hannob »

kaetemi wrote: post #35

Is there any service that can process DMARC report e-mails? Those mails with zips with indecipherable XMLs inside them are a bit useless. Something that takes the junk, gives a nice human readable dashboard, and informs me if something is wrong, would be nice.

Not a service, but I can offer an opensource script to give a basic summary: https://github.com/hannob/rpter

If there's demand, I could start a SaaS business for it :-)

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#97

Post by swiftcoder »

pixelesque wrote: post #53
Analemma_ wrote: post #26

Earlier quoted context omitted.

That's very odd to me. Where are you located? I'm in the United States and virtually all my newsletter/marketing emails have one-click unsubscribe these days. The only ones which don't are from foreign companies, e.g. I bought a day planner from Hobonichi and found they put their unsubscribe behind a login, to my irritation.

A lot of the spam from the US I get (I'm in NZ), for things like US Political fundraisers for politicians, to car dealerships in the US in various states have links to click, but you often then seem to have to enter your email address when I do click them before submitting the form.

My favoutite thing is when the unsubscibe page itself blocks my country due to GDPR...

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#98

Post by modernerd »

darylteo wrote: post #83
max_ wrote: post #79

I use cloudflare's email remailer. i.e emails are mailed from from & to my Gmail via cloudflare. Using a custom email domain. Does this mean that my emails will no longer be sent?

I think you can set a ARC header for forwarders.

I think they set it automatically, at least based on https://blog.cloudflare.com/email-routing-subdomains

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#99

Post by sbuk »

1over137 wrote: post #19
stefan_ wrote: post #15

Earlier quoted context omitted.

Indeed, self-hosted email is commonly rejected despite doing all these things. Google et al have successfully turned email into the domain of a few SaaS, and at half of them blatant spammers can message millions with no record of consent with the most obvious scams and have it delivered into the inbox. Hell, most spam these days I get from hacked Gmail accounts. The game is rigged, as they say.

I often see this repeated, but in my experience self-hosted email works just fine as long as your IP has a good reputation, and isn't on some crappy bulk VPS.

I have a mail server on Hetzner and one on Vultr, neither have problems delivering to any service. That said, both domains are fully and correctly configured. Banners match rDNS, DMARC aligns, I’ve even configured MTA-STS. The IPs aren’t particularly warm either.

Re: Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

#100

Post by pests »

mullingitover wrote: post #91
pests wrote: post #82

Earlier quoted context omitted.

I've seen a perverse dark pattern on one click unsubscribe. The page you land at has a button that lets you resubscribe! It looks non-obvious you've already unsubscribed and it looks like the regular two-click flow needing to enter your email address to confirm. Very sneaky.

If unsubscribing requires even two clicks I always flag it as spam. The rule is one-click to unsubscribe and I ruthlessly enforce it. Make it their problem.

I tried that once with Nextdoor. They will group their mailings into different lists. The unsubscribe button only removes you from that list. To disable them all is 30+ clicks on the site once logged in. It's horrible.
Post reply on HN