Hacker News Reader

Comment by tux2bsd | Hacker News Reader

> the letsencrypt emails don't have an Unsubscribe

Yes and that is really stupid, especially from a group of people who are otherwise very clever.

I keep getting emails from them addressed to PERSON+ORG@MY_PERSONAL_DOMAIN. I've never heard of the person nor their org. I don't know why Let's Encrypt has their email the way they do. But I can't unsubscribe, nor do I want to invest the effort to track this person down.

As far as I recall, Let's Encrypt doesn't verify control of an email address before using it, so anyone can sign up with your personal domain. If you can, I'd set that address to be undeliverable in your MX, so their outgoing service will bounce it. Or mark as spam, because outside of sending verification mails, sending mail to unverified addresses is spam.

A while back I set a catchall address forwarding to my day to day gmail account, as part of a transition away from using my personal domain. TBH the only reason I noticed this. I've also been amused at some of the spam I receive now, messages to random nonexistent accounts telling them they need to log into DOMAIN.

Except that it does, just not via email. You have to unsubscribe the same way you subscribed.

That’s not enough. CAN-SPAM is nearly 20-years-old now, it’s not even a GDPR matter. The rule is pretty clear in having to provide an unsubscribe link in every email.

It’s really quite annoying that companies have taken this “you can’t unsubscribe from service emails” approach and I wish this act would get a refresh 20 years later.

CAN-SPAM explicitly exempts "transactional or relationship messages". This email would qualify.

Newsletters or notifications?

Irrelevant. Think of it this way, Let's Encrypt could be emailing a dead person and you can't tell them to fuck off.

Reply on news.ycombinator.com