Hacker News Reader

Comment by albertgoeswoof | Hacker News Reader

This might be good news, but as it comes from Google and involves email centralisation, I’m sceptical.

At MailPace we already enforce DKIM, it’s pretty basic stuff. But list-unsubscribe is optional for our senders.

We can make this a requirement and manage lists for senders who don’t / can’t implement a webhook to handle it (we already default to blocking resends to emails that hard bounce).

However I am curious how Google will track this. Just because the header is set, it doesn’t mean it’ll do anything. In fact it can be used by spammers to identify legit email addresses and spam them separately.

View on HN

> Just because the header is set, it doesn’t mean it’ll do anything.

True, but I think when you're processing the volume of email that Gmail is, you'll have enough data to be able to infer whether the unsubscription was processed.

All it would take is one human to review the email, but sadly given Google's aversion to humans in the loop I predict it will be inferred by an algorithm and subject to false positives with no practical way to escalate for review.

I think it would be pretty challenging to have a human in the loop at that scale. Although certainly in would be nice if there was a way to escalate.

Side-note: for list-unsubscribe, do you determine the subscriber's identity that needs to be unsubscribed based on the sender or the receiver (like <guid>@unsubscribe.service.com)?

Reason I'm asking is Unsubscribe rarely works for me due to my catch-all not SENDING emails from the address it was received on. It sends it from my actual address. Very annoying.

The RFC https://www.ietf.org/rfc/rfc2369.txt Section 3.2 is not specific on this - but the examples only show the To address, and no unique identifier beyond that, so it might not work out well for you for mailto list-unsubscribes. It also prefers mailto over https.

If we build this as a mandatory feature at MailPace, we'll use an HTTPS webhook with a unique identifier for the email, so if you unsubscribe from a list sent via us, it will work for you.

I believe iOS & Outlook.com only support the mailto:.

Addy.io formerly AnonAddy does a good job at that. FastMail also.

> Just because the header is set, it doesn’t mean it’ll do anything

But they can track proxy metrics for this. For example people using GMail's builtin unsubscribe feature more than once with the same unsubscribe link for different emails is a pretty good indicator the unsubscribe did not work.

Yep, just another step towards “we only accept email from Yahoo and Microsoft and they only accept mail from us”.

I'm cautious as well. We all hate the spam and dark patterns, and Google is a relatively responsible citizen of the email world in my experience so I hope this will be a positive step.

However if email blocking becomes too aggressive then it can easily result in mails containing information that senders are literally required by law to provide to the recipient being silently dropped, which essentially means the mail service has caused the sender to unknowingly break the law. The penalties for not providing required information under consumer protection rules can be extremely serious in jurisdictions like the EU.

And Joe Random can be a real customer who you are really required to provide with information but can still hit the "this is spam" button if they don't particularly care or want to see it so reading too much into self-reported spam flags is a bit of a slippery slope. Combine that with mandating one-click unsubscribe but possibly without recognising types of emails that again the subscriber literally can't legally not send (at least not without sending the same information to the same recipient some other way instead) and there could be some real danger here.

Why is list-unsubscribe is optional for your senders?

It's transactional email - so generally speaking it's not a subscription list that recipients are on per se. This is in line with the CAN SPAM guidance (although that is a US law it's good guidance to follow globally).

Also it requires senders to actually implement it, which is not possible to confirm. Although we could add a catch all service that does this automatically, which I think we'll do.

As someone who gets tons of transactional email I didn't sign up for (wrong address), please do implement your catch-all service and make unsubscribe mechanisms mandatory. If I can't stop it, I mark it as the spam it is, which can't be great for deliverability.

Oh lordy this so much this. As a holder of a beloved 5 character gmail address that is a common first and last name let me tell you that the misdirected email I receive is insane and countless. Services with an reputable unsubscribe get unsubbed and then I moved on. Services with no way to unsubscribe get marked spam each and every single time. Services that do that are effectively dead to me because if they ever do send a legit email gmail will automatically flag and remove them for me and I can't help but believe (with some insider knowledge) that this also impacts deliverability to other gmail accounts.

There’s nothing to unsubscribe from if it’s transactional email. You aren’t on a mailing list. You can’t be removed from a non-existent list you aren’t on.

Are you asking to be blacklisted from all future transactional email from a particular service? That’s something very different to being unsubscribed. You’re asking to be added to a list, permanently.

Most of these transactional messages are associated with customer accounts. They absolutely can remove email addresses from those accounts. The problem isn't emailed receipts from typing in your email address at a brick and mortar checkout or "guest" checkout on an online store.

As I was writing this message, Florida Power and Light sent me yet another "transactional" message I can't unsubscribe from because they're under the mistaken impression I'm their customer.

"Transaction email" reminding you your subscription is up for renewal in 16,356 days (and repeat) including tons of ads for other products.

I get tons of messages from otherwise reputable companies (household names) that have no "unsubscribe" options because they consider the messages required for active account holders (and I'm not ready to close my account) but the messages certainly aren't triggered by a transaction that I'm party to. For example, banks will periodically inform me about how I should stay vigilant to avoid fraud, and all sorts of similar concepts. Any thoughts on whether this type of stuff violates CAN SPAM?

This is the definition of spam. Unsolicited email with no way to revoke consent. Your user’s recipients should be able to revoke consent whenever they feel like it. If they can’t reply to the email, or unsubscribe, and the only choice to revoke consent is to mark an email as spam … you are sending spam.

No, it is not. You're missing a few key qualifiers that will depend on the country but generally include the notion of "bulk" email (thus directly excluding transactional emails).

A couple examples of such nuancing qualifiers:

- "unless prior permission has been obtained or unless there is a pre-existing commercial relationship between the parties" (UK)

- "for the purposes of direct marketing" (EU)

You may read this table to get more examples of local definitions and the associated regulations, per country: https://en.m.wikipedia.org/wiki/Email_spam_legislation_by_co...

"thus directly excluding transactional emails"

I'm not excluding transactional emails because to someone who doesn't want your email ... it is not transactional.

You are making a bunch of leaps of logic:

1. The person you are emailing is the same person using your service.

2. The person you are emailing consents to you emailing them about your service.

Consent can be withdrawn at any time, it doesn't matter if it is "transactional" or not, "legally spam" or not. This is just basic human decency and if you cannot follow it ... then this is why we need laws, I guess.

> but as it comes from Google and involves email centralisation

That's my concern as well. Ah well, we'll just mark them as arc=pass and sit back and relax.

I'm wondering if they see enough gmail traffic receiving such an email that maybe they can infer how much funny business might be going on?

Why would you allow users to unsub from transactional emails?

Because you're not evil?

Because (according to this announcement) if you don't, Google will put you in the spam folder.

Edit: I suppose it does say "unsubscribe from commercial email in one click". But it's hard to say exactly what they mean. They also don't define Bulk Senders - is that the domain or the sending SMTP server?

They defined bulk senders in the 3rd paragraph: "bulk senders — those who send more than 5,000 messages to Gmail addresses in one day"

> is that the domain or the sending SMTP server?

Let's hope from what ever comes first, or people will start sending from 1.example.com, 2.example.com ...

I'm having the same thoughts.

On one of my SaaS apps workers receive details on their shifts via email. If I allow them to one-click unsubscribe, I know there will be many who do so accidentally, with no idea how to resubscribe.

Currently they need to sign in and manage their contact methods in settings (email, SMS, etc). Thus they know how to re-enable it if they disable it.

I can see many support requests from managers saying "X worker isn't getting emails". Sigh.

I suppose the best you can do is indicate how to re-subscribe in the unsubscribe confirmation email and say, “you should save this email! Here are alternate channels to receive your schedule if needed.”

Perhaps you could notify the manager when a user unsubscribes? Puts the ball in their court to notify the user (their employee) they aren’t going to get critical emails. Make sure any unsubscribes show up in a log available to your customer.

You can simply put two buttons on the email, one for unsubscribe, one for re-subscribe. If they unsub by accident they can simply pull the last email and re-sub. It's not rocket science.

AFAIK Google shows you an unsubscribe button/link separate to the email and performs the POST request to your server. There's no option to ask Gmail to show a resubscribe button/link.

Or, send an email saying

“Hey. You unsubscribed. Here’s a link to resubscribe if you happen to want to!”

Right after someone unsubs.

You could also send them a reminder a few days later, just to be sure that they meant it. And then perhaps every week or so for good measure.

And you could probably take the time to add your weekly special deals to that reminder email, in case they might see something they like or need.

That seems to be a bad idea. The new rules state that you need to process the unsubscription within 2 days. Sending an email a few days later sounds like a good way to make it on the naughty list.

Don't be absurd - those rules are for evil spammers, not for your marketing department.

There’s a far cry difference giving someone a subscription link at unsub time and spamming resub links.

It’s already pretty standard practice to send an email notifying that the unsub request was processed.

The problem comes, as I know very well, is that when you have a common sounding email, all kinds of people use it for all kinds of things. I get dozens of transactional emails a week from stores multiple states away.

A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam.

> A big part of why I’m stuck on/with gmail is that filtering redirects about 90% of those to spam.

That doesn't really make sense? If you used an address on your own domain, other people would be pretty unlikely to enter that email address instead of their own. The problem with misaddressed email should be limited to domains with really high username density; nobody else than the Gmails and Outlooks of the world need to solve the problem because nobody else also has the problem.

Becaus having used an address personally and professionally for close to 20 years, I can’t really abandon it, and I honestly get way too much important stuff to only go I. There once a month or so. If I forward all emails to the new address, I get buried under the avalanche.

Why limit yourself to only either forwarding emails or to "check for important emails" once per month?

For example, email clients generally allow you to use multiple accounts at the same time. Configure your client to read emails from both accounts at the same time, and any time an important email arrives at the legacy account try to update the sender.

(I mean, I'm sure that xkcd.com/1172 applies, but still this seems like an odd thing to be blocked by.)

Becaus I don’t care enough, really. Email is something I use because one is expected to( not because one wants to.

IMHO, that sounds like more effort than configuring Emacs to map a CPU temperature rise to a Ctrl keypress.

I'd rather begrudgingly keep taking advantage of Google's spam filter over adopting the added workflow branch that is perceivably likely to trail me for another decade-plus.

Ha, I knew it was gonna be the workflow one!

Transactional email intended for other people is exactly my problem.

My name is common in certain areas, and I consistently get transactional email from banks, telecoms, and insurance companies around the world.

These businesses do not verify that their customer’s email is truly their own prior to sending emails.

Framing custom domains as the solution to this problem is a bit rash, no?

I'm not framing it as a general solution. But the GP was already migrating to a different domain and claimed this was the main blocker.

Custom domains aren't a panacea, I own my last name as an email domain, but my last name is one letter different from a building supply company in my country . I regularly get purchase orders sent to me instead of them, so even in a small country with a custom domain you can't escape misaddressed email

Because its better than me just sending it to the spam box. Or worse, not interacting with your service.

At this point something as simple as ordering something online means I get 4-7 emails and then some growling "please rate us" shit. And if I am stupid enough to do so, but only rate it 4 our of 5, another "we are sorry, please tell us what we did wrong" email.

Wrong address is one reason. For example, I receive transactional emails from a US-based ISP for someone else and the only way to unsubscribe is calling their customer service line. I’m not even in the same country.

I get a number of these for some reason. If they don't let me unsubscribe, I just report it as spam. It's not perfect, but it's what little I can do.

I still have a quite short firstname@gmail.com address, and those emails were unbearable about 10 years ago. Several times, the only alternative was resetting the the password and taking over "someone else's" account to then change the email to a disposable provider like Mailinator.

Hostile? A bit, but after contacting services and complaining, nothing would get done anyway.

I ended up changing email providers because of that.

Exactly, seriously -- I get monthly+ e-mails from a gym and a car dealership and some golf course because somebody else put in my e-mail.

I contacted the customer support for all of them and they said they can't do anything about it. To change the customer's e-mail address, I need to prove I'm the customer, and obviously I have no idea who they are.

So I gave up and implemented a Gmail filter in the end, but I definitely wish that parallel with the traditional unsubscribe, there was a way to say "this isn't that person's e-mail". Where I don't have to prove I'm the person, I just have to demonstrate I receive the e-mails.

The best part is when they aren't in a language you understand, and the site doesn't have one available.

I have in the past had very good data on how often a russian guy got a haircut.

I have that friend that whenever I don't feel like putting my own email or phone number I just put his. You probably have that friend too, the other way around

Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself that you put down when you don't want to put your own email in? I just cannot fathom any reason for you doing this that isn't just malice. Surely nobody is just so _lazy_ that they intend to screw over their friends over a minute or two process making an account.

It's a prank. Meant to be funny. Best when signing up for something which might be construed as embarrassing.

I've also done this where I've donated $25 to U of California in the name of my friend who went to Stanford (rival universities). He's likely still getting calls.

The rival university one seems like a solid prank. The user I replied to did not make it sound like the intent was to be funny.

> whenever I don't feel like putting my own email or phone number I just put his

This sounds more like malice than well thought out humor. If I found out someone I knew and respected was using my primary contact information for spam emails at <insert random pet supply store or random restaurants' rewards programs here> I would definitely consider not talking to that person much any more. The rival university one however I would let slide because the intent from you is obviously different.

> Why don't people like you just spend exactly 2 minutes to create a bogus gmail (or etc) account for yourself

Have you tried doing this recently? Creating an email address has become a fairly draconian process.

Yeah, I just made a new google account today. It takes about 2 minutes. You need a birth date (easily lied about), a phone number (it's google, they have your phone number already, no reason to lie) where they will send you an 8 digit code for you to confirm, then type in your desired email address and your password. Hardly draconian. Viola, you have a gmail account. You can do more to ensure you're the only one that ever logs into it if you like, but chances are if you're setting this account up for the purpose we're talking about, you're just writing down the email address you set up and then forgetting everything else.

I'm not sure, are you implying that it is not worth doing this, and you would rather instead just pollute the inboxes of people that happen to know you? If so, would you like to be friends? I'd be happy to receive your junk emails if in exchange I can come by your place and just leave my trash in your front yard/driveway.

Phone number is draconian.

Google doesn't require a phone number if your ip / whatever they are doing to profile you has good reputation

Not that it’s really all that draconian anyway. Tying an address to some other piece of verifiable information is valuable when they probably have to respond to abuse complaints for thousands of gmail addresses every week.

If you want an account for legitimate mail, fastmail and gandi both make it trivial to add another email alias.

If you want an account for random garbage that demands an email address, use mailinator.

Why would you do that?

What is wrong with you?

These aren’t transactional. An email isn’t transactional just because the sender has a relationship with the recipient.

I think they mostly are -- they're all about reminders for upcoming appointments and vehicle checks (the dealership), confirmation of bill payment and notices of rate rises and holiday hours (the gym), and confirmations of tee time reservations or payments or something or other with the golf course.

What definition of transaction relates to a notice about holiday hours?

What's your point?

I'm not sending these.

This is not a spam problem but a security one. I received one guy (from the other side of the world) contracts and financial transactions. A mistake in domain name has resulted in his ?partner sending this information to me. Someone else could have used it. I think the process to handle these should a bit more different.

Something something the customer is always right?

So they don't start getting blocked as spam? For transactional emails deliverability is often CRITICAL.

Oddly, on the cash app thing, I have a very basic username and seem to constantly have folks sending me money, sometimes good amounts. I never use the app, and eventually I hope the money goes back if I don't collect it.

More annoying on email but much less than it used to be - I think more systems require email verification now so a bit less common to get the misdirected order emails etc.

But yes, if I can't unsubscribe - then I block and report spam - even if it looks like transactional email (some is a lead-in to a scam where they will refund you for the "bogus" purchase).

I got a really cool vanity email address, back in the early days of gmail. But the downside of that is 100s of goofball people around the world randomly guessing it when they want to put some bullshit value in a field on a web form. The worst was when my address got posted to to some indian jobs forum, under a title like "test job" - I got dozens of applications per hour for a few days. I had to make filters to block all email that included the words "bangalore", "delhi", or "hyderabad".

Anyway, the job applications have died down, but I still get plenty of others for people who are creating accounts. I unsubscribe when I can, and "mark spam" when I can't.

This sounds like the Steve Wozniak story from his college and early Apple days. He was apparently an inveterate prankster, especially phone related. After starting Apple and gaining some influence in the tech world, he managed to secure a mobile phone with the number (888)888-8888 - something he'd desired for years but could only realise once the 888 area (mobile) code came into use. Well his life became a living hell - he'd receive calls at all hours, usually with only rustling or scraping sounds, sometimes breathing and the occasional gurgle. The penny finally dropped when he heard a stern motherly voice in the background of one of these calls shouting: "Put down that phone, Jimmy!" He realised that babies all over America were picking up push button telephones and hammering the most obvious button - the one right in the middle of the bottom row... He had to change his number because there was no way around this DDOS prank by The Universe.

You wouldn’t, if they’re true transactional messages instead of poorly veiled marketing ones.

Think of it the same way Canada’s anti spam law (CASL) works. https://emailkarma.net/2016/09/qa-transactional-emails-unsub...

Perhaps I do not care to receive them? Why does a store allow me to say "no receipt please", but you think your transactional spam needs to reach me?

Because I don't need or want:

- confirmation of my order

- my order has been despatched

- my order is out for delivery

- my order has been delivered to locker

- reminder to collect from locker

- my order has been collected from locker

- feedback on customer support chat experience

- my return label has been generated

- reminder to return my item

- my refund is processing

That's Amazon, in case it's not obvious. I don't need any of that by email, I immediately archive it, and if I want to know I look in my account, not my email. I even have the app installed and notifying me with all of the same and more (I'm spared 'x stops away' by email).

You are evidently in a tiny tiny minority of people with very special needs. The vast majority of users want to get these notifications, and most want to have them sent by email because it is one of the most uniquitous channels along with SMS and allows the recipient to "keep living and check the message later on when the time is right" (contrary to a regular in-app notification).

The vast majority of Amazon customers do not have its app installed. And those who do have the app can disable Amazon emails or create filters in their own mailbox, it's not exactly difficult.

> And those who do have the app can disable Amazon emails

No you can't, that is the point that is being discussed.

I get most of those twice, because the carrier is _also_ sending me "we received a package for you", "it is out for delivery" etc.

Reply on news.ycombinator.com