Hacker News Reader

Most enterprise-level email marketing software will allow (or even require) senders to have subdomains that then get used for things like click tracking links.

Mailchimp is pretty far from enterprise and is heavily geared towards small businesses and click tracking links aren't that big of an issue for small businesses.

They're a big security issue for users regardless of MailChimp's customer base. It's an area that MailChimp could assist with by encouraging their clients to clean up click tracking links.

"click tracking links aren't that big of an issue for small businesses"

False. Source: Work with small business owners daily. Email click tracking has been a feature they use for years, and now rely on to help guide content decisions.

Sorry, I wasn't clear with what I meant. Click tracking is important to anyone doing email marketing. What's less important for small businesses is branded link-tracking domains.

You're right! I take it back, thanks for the follow up. To make this comment useful...

For small biz the order of priority usually goes:

1. collect email addresses

2. start a newsletter

3. publish regularly

4. start to look at open and click rates to get a better understanding of your audience

5. use that data to influence content and send rate and acquisition methods

Unfortunately most don't get past 1/2 :(

Part of this is on them, another for example is in enterprises with Outlook Safe Links. Personally, I think the net benefit for at least Safe Link is great as they can protect against phishing, but on the other hand I wish I could just see the original URL. I feel like whatever functionality fixes this problem could be used in that same realm too.

I feel your pain - it's challenging to have users be vigilant by checking URLs when these things happen.

Solution:

- generate an unique UTM (or something like that) identifier (UUID)

- add identifiers to the links

- let mailchimp customers connect their Google Analytics with mailchimp

- pull in data from GA to mailchimp to generate click reports

That involves their customers - remember, small business owners - to set up GA and copy a load of gobbledygook through loads of forms and charts and whatnot. How's that helping their business?

No, simplifying their links would work. Use an url shortener, e.g. https://business-name.mailchimp.com/campaign-name-abc123.

What? Are you saying that small businesses wouldn't already be using GA? It's far, far easier to set up and use than MailChimp, for a start!

It doesn't address the original problem: you want users that receive a mail claiming to come from A.com not to click on a link to B.com.

The only advantage that routing clicks through MailChimp has, is clicktracking. Clicktracking can easily - trivially - be handled serverside. Just embed per-recipient unique ids in the url.

If MC is worried about customers lying about #clicks, they coukd easily make all urls point to A.com/mailchimp?mailid=xxx&linknum=yyy.

That forces A.com to run the one thing MC sends them to sort out the clicks... which of course does the clicktracking and hides the useful info from their customers.

It would be interesting if they could work with Cloudflare, AWS, big small business web hosting providers, etc. and other people in line in processing the click to make special casing the clicktracking URL easy.

Have you ever gotten an email from Synchrony Bank (the Amazon credit card)? Everything about it looks like phishing designed to steal your Amazon ID and login. But nope, it's real. Way to go guys.

Synchrony Bank is the shittiest banking vendor I have ever encountered; cancelled my Amazon Store Card because of how horrible they are. (also the Amazon Prime Chase card gives the same 5% benefit)

That's going to take a lot of processing power to be able to handle their amount of customers on a single domain. Even loadbalanced behind the domain to multiple servers, even running kafka, probably could bottleneck it through a single domain. Regardless, even if you did A.com, you have to redirect the customer to whatever actual link they originally wanted to go too from MailChimp's server, instead of the customers server.

Sorry for not being clear. My idea was a small file on A.com/mailchimp that takes the arguments and passes them on to mailchimp's servers (possibly already spreading, e.g. mailing1.a.com.mailchimp.com/clicktrack?click=...) This would redirect to A.com's targeted link.

The processing power would still be needed on mailchimp's side. All the customer (A.com) does, is add a tiny redirecting script on their site.

It's similar to how one fingerprinter for android works.Get your client to forward you the user details. User only sees the client (so nothing suspicious, no 3rd party to be blocked), while encryption ensures that your client has to forward you the data - they cannot parse it themselves.

It's really not a problem to handle any number of users on a single domain, you can load balance, serve from different geos, etc.

Case in point: google.com

The real reason they don't do this is because it's a more involved set-up from the customer's side. As people mentioned, enterprise-oriented mail services will do this kind of thing but MailChimp is a long tail solution.

That'd involve subdomain delegation to Mailchimp, or some kind of server-side thing installed on a customer's site - not possible for a lot of small businesses (and a lot of large ones, too).

Why is creating a single arbitrary DNS record not possible (or even difficult)? SMB’s already have to do this when validating ownership of their domain for e.g. Google services, SSL certs, etc.

I don't know, so please correct me if I'm wrong. But isn't DNS record creation now handled automatically, and in the background, with the standard one-stop-shop site systems like Wix, Weebly, and SquareSpace?

If so, and they decided to further support integration with senders like MailChimp by auto-creating subdomains as needed, and it worked perfectly, that would make it all easier. But anything less than perfect, and users (ie small business owners) would be hopelessly lost.

If the one-stop-shop handles your domain registration, then yes.

Regardless, whoever handles the registration should have an interface to add records. For example, you'll need to add MX records to use Google or Office365 for your mail service. You'd also need to add TXT/CNAME records to prove ownership of the domain for Google Webmaster Tools, etc.

Here's Google's documentation for Wix users: https://support.google.com/a/answer/6149037?hl=en

[Edit] Just read the Wix instructions. Looks like they made it easy and offered presets for Google Suite users. They could do the same for Mailchimp. But they do allow arbitrary records. https://support.wix.com/en/article/adding-dns-records-in-you...

I'm a techie and I'm not even 100% sure how to create a single arbitrary DNS record.

So I'm not sure regular people would even have a clue on how to do that.

Mailchimp doesn't have to make this a requirement. They can offer it as an option for businesses who are concerned about making their mail not appear phishy, and have the competence to create DNS records.

If you create the record, they'd make the links use your domain: https://mail.your.biz/destination?unique=123abc

If you don't, they can do what they do today: https://something2-x1-really-sketchy01.mailchimp.com/m0re-sk...

Also, there is precedent for service vendors telling companies how to configure the appropriate DNS records (with a variation for each common domain registrar). Example: https://support.google.com/a/answer/33353?hl=en

solving that issue (providing human readable click tracking links for potentially millions of emails) would be at best very complicated. How much do you think companies would pay for it? I think they might like it but not pay much for it.

Do you have have a suggestion as to how to fix it because everything I am thinking becomes horribly complicated?

Making a small business seem less janky and more like a big business is something that small businesses pay for OFTEN.

But that’s not what this would accomplish. Nobody would actually notice this change.

(Which is why it is a mostly pointless suggestion.)

Looking at the link destination is pretty much Anti-Phishing 101. Sure, many users don’t inherently care about this, but enterprises are trying hard to change that. Mailchimp and similar platforms totally undermine those efforts.

So do link shorteners. I don't think you can really know what link you're going to in general until it's in the address bar on the actually opened page.

At the same time google and apple do everything they can to deemphasize the url in the browser, which doesn’t help less sophisticated users learn to watch and understand what they click on.

As someone pointed out at the time, https://news.ycombinator.com/item?id=17976934 Google's efforts can be seen as motivated by an interest in security.

If you were designing DNS and URLs from scratch to minimize phishing, you would treat "www.example.com" and "example.com" identically.

While I agree these links look dumb (to those who take the time look), I'm quite happy as a user I can see I'm very indentifiably (?) being tracked. Also your solution you could do yourself by providing traceable links for every campaign, and not using mailchimp's stuff?

What you are suggesting is actually quite complex. Mailchimp would have to install a bunch of stuff on customers servers (which are probably run by a third party) and/or control some of their customers subdomains.

Maybe you just need to invest some money in better spam filters, and user education.

This year the Canada Revenue Service is running an ad campaign saying they aren't calling/emailing Canadians and demanding they go buy gift cards at Rexall/Shoppers Drug Mart/Sobeys in order to not go to jail for tax fraud.

Better user education is a non-starter.

I'm sorry but there is no level of user education that will protect a large organisation from phishing links. The attack surface is way too large and safety depends on how the user is feeling on any given day when a random email turns up. There are no high reliability systems that require manual user interaction on a frequent basis especially on low-effort low-concentration tasks.

I agree about the insufficiency of user-education.

I think we need go further: what we need to do is kill the idea that email is an good vector for notifications inside of big organizations (or maybe even outside of them). I should have a dedicated app with a whitelist based system that official notifications go through. This could be not only a security improvement, but also a stab at better UX, better productivity, and avoiding notification fatigue.

> emails.ecommercesite.example/products/brown-boots/buytoday/4918ac7

Wouldn't a CNAME cover it? It's the way that gmail.example.com gets routed to google's servers.