Hacker News Reader

Comment by linsomniac | Hacker News Reader

Google, especially Google Corp, is very much that way too. One of my users is currently getting a fair bit of spam because a spammer figured out that if they send a message with envelope sender @google.com, rcpt @gmail.com, google.com MX will accept it, then bounce it with NoSuchUser and gmail will accept it. I spent an hour yesterday looking for a way to contact Google about it, but couldn't find anything. Made harder because most things assume you are talking about gmail or youtube, not google.com itself.

It's pretty shameful that these large companies have no real way to contact them.

View on HN

> It's pretty shameful that these large companies have no real way to contact them.

Along the same lines, I think organizations shouldn't be allowed to send out email but not receive email at the same address, e.g. noreply@. That's just hostile in general.

I fully agree that it is shameful that we can't contact these companies, but suppose you want to send 2fa tokens as a startup. Should you not be allowed to offer 2fa through email unless you're at a scale where you can answer every reply email?

So your startup is also ignoring info@ and postmaster@ and ...

> Should you not be allowed to [send email at all, for any reason] unless you're at a scale where you can answer every reply email?

Hell yeah. Don't threaten me with a good time.

Philosophically I don't disagree, but in reality the likely effect of a rule like this would be even greater empowerment to the incumbents, which are mostly huge tech companies. Maybe it doesn't matter since the vast majority of startups don't mind be equally abusive, and often have an exit strategy in mind of getting acquired by huge tech, so hell it might even be a net positive in some ways. However, this would also have the net effect of ensuring that ethical startups seeking to disrupt gross entrenched practices would be dead before they can even start. Given the direciton the tech cos have already long demonstrated they want to go, that strikes me as a much bigger evil than not having access to customer support

You would impose the rule after a certain threshold.

It could even be quite high, like $100 million or $1 billion in annual revenue.

If you do that, its incredibly easy to get around instructions by contracting out to a tiny "company" that's actually just shell corporation #6485 and say they sent it.

You definitely shouldn't be accepting payments without a way for someone to get in touch to say "hey you're overcharging me / double charging me / I want my money back"

If your service is free than I don't think anyone is entitled to customer support, since there aren't really customers in the first place

On this we totally agree, but I don't see that distinction made in GP or GGP comments so just wanted to note that this isn't a full reinforcement of GGP comment

2FA via E-Mail is not 2FA.

Sure, I don't disagree, but that seems an entirely different discussion. If it bothers your OCD, replace 2FA tokens with "confirm your email address" or some other thing. If you don't think there are ever any good reasons for sending a customer email, then we'd have to step back and argue that first before we could get to my question in the GP post

Why do they need to know if the email address is valid if they’re never going to accept email from me in the first place?

I've been slowly migrating logins off of a @gmail.com email and onto an email at a domain that I own/control for this reason. It's tedious and feels a little like an overreaction (presumably the odds of this happening to individual users are pretty low). On the other hand, the thought of some faceless fraud algorithm deciding that I should no longer have access to the credentials I use to log in to my bank, investment accounts, DMV, etc and having no real recourse beyond posting on HN and hoping that a sympathetic employee reads is pretty scary.

(I didn't want to actually host my own mail stack, so I just have a custom domain set up with fastmail and point the MX to them. Their UI is great and a breath of fresh air compared to gmail. I guess they could in theory decide to lock me out randomly too, though I trust them to have actual customer support and can just point the MX somewhere else in the worst case)

> I didn't want to actually host my own mail stack

Is there a way to only host the receive portion?

I'm happy to pay someone to handle all the idiocy around sending email and getting it through Google and Microsoft, but I'd really like to hold my emails myself.

Two email addrs, with your TX email having a Reply-To header pointing to the RX one?

No, that will get marked as spam super fast.

That has not been my experience, but one data point is not statistical data

I use AWS SES. You pay 0.01 cent per e-mail.

If you have your own domain, you can do whatever you want (including splitting sending and receiving).

You could use a desktop e-mail client like Thunderbird and include its data in your backups and maybe occasionally export it somewhere in a standard exchange format for e-mail folders. You can even re-upload such local data to another e-email provider if you switch.

All of that seems easier than setting up a server to keep your e-mails.

> > I didn't want to actually host my own mail stack > > Is there a way to only host the receive portion? > > I'm happy to pay someone to handle all the idiocy around sending email and getting it through Google and Microsoft, but I'd really like to hold my emails myself.

Sure. Set your MX to your own SMTP server but pay a mail delivery service to send your emails & use their SMTP servers as your outgoing server. You'll have to setup SPF & DKIM appropriately of course.

It's not trivial to do this, but it should be possible.

> Set your MX to your own SMTP server but pay a mail delivery service to send your emails

Is there a paid mail delivery service that doesn't get marked as spam instantaneously?

Or is there a way to do this through something like Fastmail?

FWIW I've been using a personal domain hosted at Dreamhost and their mail server for many years and have not had any issues with sending mail from my domain.

> Is there a way to only host the receive portion?

Sure. Set up your email server and have DNS of your domain point the MX record at it so you receive all email directly without any third party involvement. Then, set up outgoing email to forward to some third party which handles delivery for you. IIRC there are some free options even, if your outgoing volume is low.

That said, my email server handles incoming and outgoing email for a handful of domains for self and family, no problem.

What mail provider are you using?

Edit: NVM. I see Fastmail when I reread the comment.

I did the exact same thing last year. Ive beem very happy with fsstmail.

I too would like to make this move, but one of the considerations stopping me is the risk associated with payments

Google: anonymous inscrutable guillotine

Fastmail: payments fail and I do not notice for too long

Fastmail used to offer the option of depositing funds in advance. So I would always have at least a year worth of funds in the account. Unfortunately it's not possible anymore.

It's certainly my biggest worry about using them.

> It's pretty shameful that these large companies have no real way to contact them.

There was a thread on reddit from an escort who was on a podcast talking about how she was banned from instagram and facebook (for promoting her escorting!) and the only way she was able to get her account back was to seduce some high-level meta employees via linkedin, date them and then convince them to reinstate her accounts.

edit- not sure if this is the same girl but here is a similar article about this scenario: https://www.newsweek.com/onlyfans-star-slept-meta-employees-...

I saw these spam mails start showing up a few months ago, and I was like WOW how is google infra just letting nefarious actors use their own domain to bounce spam/fishing emails?

Amusingly Firebase auth (a Google product) has such a bad reputation with GMail that standard procedure is to bring your own mail service. Or your password-reset emails are binned.

Firebase technicians allegedly attempted to contact gmail support, but found that gmail did not have an inbound support contact and thus the firebase technicians were unable to rectify their issue.*

*This entire post is fabricated satire. Though, I would not be shocked if it were true.

IMO, a more likely theory is "somebody complained about this, it was close to being fixed, but legal intervened because of antitrust concerns (privileging Firebase)"

Even inside a big corporation, even as an employee, it's hard to figure out who to talk to about various issues. So as an outsider, it feels impossible.

For security reasons, corporations don't want staff talking directly with customers. So the corporation is a blackbox with very limited communication abilities; both internal and external. It does a lot of things which affect a lot of people but if you fall through some crack, there's nothing anyone can do about it.

It is pretty easy for gmail. There is a known (internal) contact page :)

Yes, but other corporations that offer public telecommunications services have tech support, however mediocre, even if you can’t just call and ask to speak to engineering.

As I recall that was even true of the free dialup ISPs (NetZero, Juno, etc.) back in the ‘90s.

Is that what that was? I had sent myself an email the day before it started happening to me, so I thought it was just the system glitching out. That’s such a nefarious scheme!

I would not be surprised to discover that much of the rest of the company is collapsing because of the amount of resources that have to be poured into AI. There's precedence for this: look at how many game studios have fallen to, "Let's make an MMO!". Even in cases where it succeeds (Square Enix) and becomes a money-printer, most of the rest of the business suffers; because it's the cash-cow, nothing - nothing - is more important than keeping it running (including the judicious production of the last half-dozen games in two of SE's flagship franchises). It's easy to imagine Google diverting and squeezing resources, trying to first catch up and then stay ahead in the LLM AI race, leading to terminal enshittification of Search, and then YouTube, and now Gmail.

Hey I’ve been getting these sketchy Delivery Status Notification (Failure) emails too with my gmail handle but @google.com

“ The response was: The email account that you tried to reach does not exist. Please try double-checking the recipient's email address for typos or unnecessary spaces. For more information, go to https://support.google(.)com/mail/?p=NoSuchUser”

Then it has a phishing email copied below trying to look legitimate.

Can I create a filter to block this spam for good? It’s been happening for over a year now and makes me think one of my emails failed to send so I jump to open it ugh.

This has been going for months already, it will most likely never be fixed.

s/months/years

> It's pretty shameful that these large companies have no real way to contact them.

It's sadly all too common these days for companies to have no general customer support, only forums full of powerless volunteers. It's even started to become that phone support lines don't have anyone on the other end anymore; Microsoft for instance basically just has an LLM on the other end that waits for you to talk, then tells you to fuck off to the powerless support forum.

Customer service is for customers, not for products. You are the product.

Oh you sweet summer child, Google gives the cold shoulder to everyone, including paying customers.

for google you are just a paying product

See, I've been wondering about this. I would have thought paying gives you a better chance of contacting, unlike Meta Verified which is useless. Is that not the case?

I've been an App Engine user for 15 years. Last year I needed some help and I had to pay some small amount for support and get an engineer to actually look at my account and tell me how to do something.

I don't remember how much it was, not much. I subscribed to the support for one month, then canceled. I've paid them hundreds a month for years, so it feels kind of cheap of them, but I did manage to get the help I needed.

It really depends. Sales people will bend over backwards and will escalate things internally, but once they realize you “need” them (eg: for ads or due to lockin) they stop caring.

Used to work in marketing-adjacent teams and know this too well.

Paying for Google One gives you human support (or at least it did...) I'd imagine that being a paying customer also gives you various rights per local laws

Google One employees the stupidest human beings on the face of Earth. Two of the morons there tried convincing me that a backup of 10+ years of message history fit in < 2MB, rather than their backup being totally broken. They also lack object permanence and literally don't read messages.

If your goal is tech support, at least if you just light the money on fire you'll get warm.

Including governments (except maybe US gov? But even that is not sure).

I’ve always wondered if litigation avenues would be a viable approach, if not dangerous

If you don't mind having your account immediately terminated and blacklisted, then maybe

You are suggesting that google would immediately terminate and blacklist an account that is the subject of litigation?

I've been getting multiple of those a day too. It's pretty annoying. I'd love to treat them the way other junk mail gets treated but I don't want to inadvertently end up auto-binning legit mails from GMail or Google in the process.

It gives scammers more plausibility too. If the top hit in a web search is Google's support page, which gives no phone number, then scammers can get race to get the number two hit with their number...

I just got my first one of those @google.com bounces to my Gmail today.

I've been having the same issue

You should use this same technique to spam the CEO about your issue.

> It's pretty shameful that these large companies have no real way to contact them

This is by design in order to prevent any meaningful path to having to manage user complaints. Companies, broadly, used to have teams of customer support people and you could call and someone would answer to route your issue. That still exists in a lot of family run business (trash collection, home services like cleaning, custom parts etc…) but is frankly extremely rare for the majority of corporate interactions.

That’s not coming back because it’s clear that having a black hole for service saves money and doesn’t prevent repeat customers because there’s no real competition in any market, in a way that would bring customer support back.

It’s just gone.

https://support.google.com/mail/contact/abuse

If they can't figure out the problem from there with you description then they are just incompetent and you shouldn't be doing business with incompetent companies no matter how large or popular they are.

You should bring everything you rely on in house as much as possible if not possible then on business that has an incentive to work with you. If you can't afford to then question if your product is really providing value. Why anybody with greater memory than a goldfish would build on top of a google service is beyond me (probably just people falling for ads or propaganda) it's no different then building on known vulnerable software.

Fool me once, shame on you. Fool me 297 times (+ all the soft killed services without adequate support) , shame on me!

I've been receiving this also. Rather annoying!! I wonder if abuse@ or postmaster@ would be able to help... /s

I did send my details to both of those locations, just in case. No response so far. I also posted on the artist formerly known as twitter, and I know I have some friends there in Google infra, I was hoping they'd pick up on it without calling them out specifically, but I might target them more specifically. Thought it sounds like it might be a deliberate, unfortunate, choice. I just can't understand why they'd want that.

Reply on news.ycombinator.com