Hacker News Reader

Comment by nemomarx | Hacker News Reader

A webforum I know has a rule against marking email notifications they send at spam (You can opt out of receiving them through the site, they just don't want you doing it on the email client end) to avoid this happening to them. For a small org, it's kind of a real risk?

I'm not sure how larger orgs mitigate it.

View on HN

I run a small org (freelancer) and I have a super advanced bullet proof set of solutions against this. Any 1 of those should do the trick (I do all of these):

1. Don't trick people into signing up for mailinglists.

2. Don't spam.

3. Don't use mailinglists.

My small business is fine.

Not against a targeted attack like the one described.

A clickfarm marking password reset emails as spam could create real harm.

Even a malicious individual doing this to 2-3 fair transactional emails could cause damage for a small business with low volume.

The attack described could not work with a strict DMARC policy.

However of course, most small companies have no idea how to do SPF/DKIM/DMARC.

Could you explain how DMARC would prevent this?

If I attempted to create dozens of accounts on a website, trigger password resets emails, and report them as spam, where would DMARC prevent me?

Nobody is spoofing anything, DMARC won't help. This is marking legitimate emails as spam at scale to trigger actual spam controls against the legitimate organization.

They pay 3rd parties to handle relay duties. A large chunk of reliable delivery is based on those received headers, aka what systems your mail is relayed through.

Lol wait, that sounds like e-mail deliverability is almost set up like cartels.

Cartel is maybe overly pejorative, but it's definitely based on relationships.

Postmasters at large ESPs and inbox providers can and will text each other to resolve issues.

This is pretty much how the internet works as well (BGP, etc). It's opaque, but open.

But is the Internet really as centralized as Email has become? I was living under the impression that Internet backbone providers where more diversified than that.

With BGP, you are usually only peering with a couple entities unless you are yourself in the "big boys club". It's a relationship business, but you only need a relationship with the handful of engineers who are on the other side of your own links.

Mass sending is controlled by sendgrid and the likes of that.

Sendgrid is no silver bullet for deliverability. They have many IP addresses listed in blocklists. https://check.spamhaus.org/sbl/listings/sendgrid.com/

Curiously my domain shows as zero but it's part of at least one RBL.

Is there any way for them to enforce that

I run webforums, and this is enforced trivially.

I don't send marketing, I only send transactional emails. Notifications are opt-in, and transactional. Logins / signups are done via sending a TOTP to the email, these too are transactional.

If someone marks notifications of new posts in a subscribed thread as spam... fine, but this is self-solving, as this person will trigger no more email ever reaching them for that email address, meaning they also cannot now sign in to the website, and therefore cannot subscribe to more email updates, or visit things to refresh "last viewed", and so would never be notified again.

Emailing a TOTP as a login has increased deliverability by self-selecting the removal of those who hit the spam button. Deliverability of email from the webforums is over 99%.

Reporting email as spam, effectively bans oneself from the website. I didn't even need to do anything.

When you report something as spam to Google they only claim they "might" cause later emails from the same sender to go to your spam folder; regardless, those emails going to one's spam folder doesn't mean they don't get them at all, it just means they have to look at their spam folder to log in.

When you use services like Sendgrid, having a spam report will automatically prevent future emails being deliverable, third parties and intermediaries do this precisely to protect their email reputation.

Marking spam may not be immediately be a death knell within Gmail, Hotmail, etc, but because of the potential impact from being marked as spam, virtually everything treats it like a death knell.

This is fine for me, my service is entirely opt-in, and if someone hits the spam button it risks impacting other users who _want_ the email, so I am not bothered that this person effectively unsubbed themselves and killed their account.

Surely it's not that trivial given

- Gmail might be able to detect what's important and not mark it as spam

- If it gets marked as spam anyway, the user can just open the spam folder to use it

- Even if you have high deliverability, that might not translate to it actually getting into the inbox

I can only share my own numbers: 90K sent, 97.12% delivered, 103.11% clicked (presumably some clicked more than once? or some older emails still being clicked?)

I do not track "opened" / "viewed" as that is not important to me, these are transactional emails, logins or "someone has replied to your conversation".

am I understanding this correctly: When you mark a single email as spam, you will never receive another mail from that sender?

Reply on news.ycombinator.com