Based upon the amount of spam I receive from Yahoo! mail systems, I'm not confident in their ability to detect "attacks by suspected state-sponsored actors" as they apparently don't even have the ability to detect phished/compromised accounts.
Receiving SPF, DKIM validated spam from Yahoo's email systems, then discovering there's absolutely no way in hell to kick it back to them, sours one rather rapidly.
Trying to send mail to Yahoo has been roughly equally annoying for about as long.
-- The Yahoo! Mail TeamThey also host a spam FAQ which has a link to a form to submit spam reports: https://help.yahoo.com/kb/SLN3402.html
This goes back years, I've not tried recently, status may have changed. But again, the long, long term experience has been pretty sour.
> Submit your report using our "Got Spam?" form if your email provider doesn't offer a spam reporting feature.
The "Got Spam?" link takes you to a form where you can supply the headers and content of the spam message sent from Yahoo.
The web-form workflow breaks in many ways: console tools (which I use for email), mobile, and more.
The fact that I can simply "bounce" the whole message at Yahoo's spamtraps, if they had such a thing, and they can sort the message's legitimacy and structure themselves, but they don't allow this, speaks volumes.
And again, this shit for a decade or more.
Now, if Yahoo wanted to creat CLI tools to incorporate into mailflows for those of us who know what we're doing to slot into their systems, great.
But ultimately, their problems aren't mine, I've washed my hands.
My experience with Yahoo mail is that there are tons of false positives on spam, and that none of the headers matter much... preference is given to a small number of whitelisted sending companies.
Anyways...
> "Yahoo doesn't consider a properly DKIM or Domainkeys email something that should not just end up in the spam folder"
Nor should they. There's plenty of actual spam that passes SPF and DKIM checks -- which brings us back to my original point (the amount of spam that I receive from Yahoo!). A message should not be treated as non-spam just because it passes those checks -- they are merely one factor to consider.
Of course not as the only criterion. But the messages in question were not spam, they were legitimate emails with DKIM, Domainkeys, SPF, long term non-spam IP address, etc.