Ham or Spam? Gmail Not to Be Trusted for Important Mail

From what I've seen while debugging such issues the problems were always from misconfigured outgoing servers and their dns, so I would be very interested in knowing why this has happened.

ps. You might consider enabling comments on your blog so there is a place for such discussions.

To put it into perspective, don't complain about the car, the road, weather, or the cop when you get ticketed for hitting a parked car in the rain while speeding.

Email is highly complex, and GMail are one of the few that are doing it right! (and per RFC's instead of making their own standards like some other unnamed companies do :)

I believe it is just a well meaning extension of Gmail's spam filter but it has real anti-competitive results. I had to take the pragmatic course of action but I now view email as inherently unreliable.

If any Google employees are here, consider adding the rule "if email address in (list of emails addresses sent to) then NOT SPAM". It would make a lot of people's lives easier.

This blog post is extremely worthless. The 'root cause' he mentions at the end isn't discussed at all.

I do occasionally check my spam folder and there's always a few false positives - but usually nothing critical (although admittedly I might have missed some that were and never known it)

So - day to day - I currently regard Gmail as 'good enough' but some of that is down to blind trust with little verification.

Can anyone else share their experiences - positive as well as negative?

Like Jacques I've run my own mail server for decades, from sendmail, to qmail, to postfix there hasn't been all that much to worry about other than dealing with folks who would try to break into your system through bugs, or exploit your server to send spam.

But Google is such a tempting target for spammers, probably carrying a notable fraction of all the worlds email. Once you get "inside" you can deliver your spam to millions, if not billions if you're careful. So I understand their problem.

That said, it would seem possible to set up a system for "whitelisting" yourself with Google, something like Clear for travellers, an API key perhaps. But that would actually increase the cost of running gmail and that would cause it to lose even more money and well that is something Google can ill afford these days. And I realize that Google is unable to post strict rules "if you do this we will accept your email" because, well spammers would do all those things.

We are but collateral damage of the battle amongst those who would exploit the network for gain.

One one of the sysadmin professional organization mailing lists, email from one of the people speaking for the organization started to be marked as spam because the person had DMARC instructions on their domain, but messages remailed from the mailing list server weren't authorized. In this case, Google's mail servers were acting as instructed. I sent the person copies of the headers showing why Google's mail servers were taking this action, as, apparently, did a number of other people. The person became irritated and decided that people who use Google's mail servers needed to fix their own problems.

If your DMARC configuration is causing your messages to be marked as spam, you really should look into that.

If you appear to speak for a sysadmin professional organization, and your DMARC config causes your email to be marked as spam, you really need to fix that, and consider that blaming the recipient mail servers does not do good things for your credibility.

Of course, there are plenty of things that can go wrong other than DMARC, and some of those might well be Google's fault. You can typically track down the reasoning for a Google mail server spam decision from the headers of the delivered message.

Google is pretty efficient at eliminating phishing scams. But sure enough I found an email from my actual bank, offering me a credit card, tagged as phishing. Then again, when I looked at the sender domain I was half convinced this was as accurate as its categorisation of all the other phishing attempts

(Dear Santander. If I have to Google the yoursantander.co.uk domain because I'm not confident it's actually yours, you probably shouldn't be using it to try to get me to sign up for credit cards. If the top result is a three year old open letter written by someone else complaining about the same negligent approach to internet security...)

Similarly, there's an Amazon deal email in there, but there's also an explanation on the top that it's "failed amazon.co.uk's required tests for authentication", which might well not be Google's screwup

I was less impressed when Gmail filtered an innocuous email from my dad...

Two reasons.

1) Email is not built with security in mind. Don't suggest SSL as it only protects (somewhat) while in transit and not at rest. You can also bet that not every recipient you send to is using an SSL-enabled POP3/IMAP connection to check mail, so you can't control that end of the conversation.

2) It has no delivery assurance and wasn't built with that in mind. You can never be sure if it arrived, or will be read (by an actual person).

That said, if you need to transmit important documents, use FAX (if the destination has their own (not shared) FAX. Or simply drop it off.

If you need delivery assurance, pick up the phone and ask if they got it, or send if via courier with signature request on delivery.

To stop the trapped emails ending up in the spam folder, I had to create a custom filter: simply marking mails as 'not spam' in the spam folder does not do the job.

And the filtered mails now have a yellow banner plastered across them saying "This message was not sent to Spam because of a filter you created."

I'm going back to Mutt and my ISP's mail server.

One of the more annoying nuisances hitting me personally is from a YC startup, Zenefits. I really dislike them and their moronic hey-buddy spam and that I can't reasonably blackhole the originating network for a while.