Hacker News Reader

Comment by wyldfire | Hacker News Reader

> This is also a problem with Square, and Stripe, and Paypal ... it's an unsolvable fraud/scammer problem.

It's compounded by the fact that Google has the primary element of your 21st century identity: your email address.

I recommend anyone who likes Gmail to use your own domain name@example.com and just forward all messages to your Gmail address. Only give out your own example.com email and set it as the reply to.

Even the cheap budget registrars offer email forwarding for free and I have never had any trouble.

This gives you the benefits of free Gmail without handing your entire life over to them. At least with a tld there is some due process and rules to protect you.

You’ll find that if you do this, you start getting emails directly to your gmail anyway. I never give out my gmail address, but I use gmail and they happily report my gmail address when they send email as my “real” account. (Both email addresses are included in emails I send.) And upstream they are happy to respond to that gmail account when people hit the reply button.

So I have tons of people who would essentially seem my contact as a black hole if I abandoned my gmail address at this point, because Google seems to have deliberately crafted their clients to prefer the gmail address rather than the “real” address. Essentially treating the gmail address as if it’s a reply-to.

It's because of Google's use of 'From' and 'Sender' headers in gmail. If you setup an SMTP server to send your emails from for your @example.com address then Google won't mess around and the emails appear to actually come from the email address you want out there, not your @gmail.com.

Or just pay Fastmail $30 a year for such an important 21st century utility such that e-mail is.

I don't use gmail for anything else except throwaway accounts. Who wants to run an SMTP server.

Crazy how many people don’t view email as a critical part of life infrastructure worth paying for.

You can actually set up gmail to send through an external server? I had no idea they’d support that. Running an SMTP server is absolutely not something I’m willing to do, though. Aside from the general setup/maintenance hassle, all the big companies are aggressive at blocking spam and private SMTP servers are just tough to keep unblocked these days (or so I read).

If you have GSuite you can, but I doubt it is possible for individual accounts. [1,2]

You can however send email to google's SMTP server, using an ordinary gmail account [3]. This is how email clients (Eudora, Apple Mail, sendmail) work. The only trick is that they force it to be authenticated and encrypted.

I believe (but have not verified recently) that if you send an email with an email address/domain other than of the authorising account, it will be delivered, even lacking all SPF etc. But, it will block for anything above small quantities of mail, and unless you set up DMARC for your domain, it will still get dropped or marked as spam. [4]

Running an SMTP server for yourself is actually fairly simple (okay, assuming a deep background in linux, but very educational). The real drama is DNS/DMARC/SPF/DKIM and users ruining your reputation.

[1] https://www.datto.com/resource-downloads/SettingUpExternalMa... [2] https://support.google.com/a/answer/178333?hl=en [3] https://www.digitalocean.com/community/tutorials/how-to-use-... [4] https://kinsta.com/knowledgebase/free-smtp-server/

It is, I do -- inbound email forwarded to gmail, outbound from gmail goes out through my server and while it's obvious it's from gmail, it doesn't actually include my gmail address anywhere.

Sending from Google's servers using my address would cause SPF and DMARC failures, so if you want to do that then they'd have to make sure it's clear that the mail is actually from gmail.

Last time I tried this they forcibly rewrite the sender as your gmail account.

This happens because you use Google's own SMTP. If you configure an external SMTP (e.g. Amazon SES) then the gmail webapp won't tell your gmail address to third parties.

DNS aren't too reliable. Stealing your own domain is easier than stealing google's own domain. If you use that e-mail for primary ID, getting even temporary control on your domain allows stealing all your accounts.

I wouldn't advise doing this. Forwarding all your email from one provider to another doesn't really work in today's Internet.

The problem is that from gmail's point of view your registrar is now sending it a lot of spam. So it'll block the registrar or filter it more aggressively.

Also if you get email from a 3rd party who uses domain-keys, spf, etc (eg just about everyone) then those emails will be failing all the checks when gmail receives them.

You misunderstand jjeaff. He suggests making the MX of yourdomain.tld point to Gmail's MTAs. This is what he means by "forwarding email". This is the best-practice way to do it and works perfectly well.

This is inaccurate.

I have namecheap forward all of my email from *@my-domain-name.com to my.name@gmail.com. Works no problem, has for several years. Prepared for the eventual switch to FastMail when they support multi-label messages.

The only messages that end up in my spam folder are spam for knock off online pharmacies.

Hmm [goes off and does more research].

Okay, it appears this is so common that gmail has some guidelines that if people follow they are are usually okay:

https://support.google.com/mail/answer/175365?hl=en

It does look like namecheap filters spam aggressively so possibly that helps.

In general be careful for the reasons I mention. But it looks like if you follow the guidelines with gmail then you'll be good.

Sorry for the inaccurate information.

I've been doing this for years without any trouble.

Agree, and I've been doing this for about a decade with very little problem. (Google do add both a Sender and From, with the Sender being your GMail-address. But that has not been a problem.)

Are there actually rules and due process? I was under the impression that it's just a convention that the registrar won't seize your domain unless they really, really dislike you.

edit: I shouldn't be oblique in my comments. I'm of course referring to the whole Daily Stormer fiasco.

It becomes a legal and business decision for the registrar.

Most serve at the pleasure of a formal contract with their TLD control entity (e.g. ICANN).

Ultimately, if you were to sue them, there's a root document of legal responsibilities and behavior to point to.

In contrast to whatever emphemeral TOS bullshit Google feels like tossing out. And furthermore, unlike Google, they can't really just ignore you.

Or, to put it another way, VISA, American Airlines, Coke, etc also have an interest in maintaining legal ownership of domains. They could care less about Google accounts.

> Ultimately, if you were to sue them, there's a root document of legal responsibilities and behavior to point to.

But actually if you were to sue them, wouldn't the case be dismissed for lack of standing? If you're not a party to the dispute you can't sue (or rather, you can't sue and actually have your case proceed). You'd probably need to convince ICANN that they need to sue, which is already a much trickier position.

I'm increasingly convinced it's your cell phone number (i.e., all the IM services using SMS authentication). And when you're using Google Fi, they have that too.

Reply on news.ycombinator.com