Most of the Amazon SES IP blacklisted by SpamCannibal

https://forums.aws.amazon.com/thread.jspa?messageID=538207

by abhisekumar • 12 years ago

101 168 12 years ago

forums.aws.amazon.com

austerity• 12 years ago

IP blacklists are a waste of everyone's time.

mike-cardwell2• 12 years ago

IP blacklists are the reason Email still works.

__david__4• 12 years ago

For lazy sysadmins, maybe. I don't use any blacklists, only spamassassin and the spam for me and my users is perfectly manageable.

fixermark• 12 years ago

Possibly, but if Amazon isn't doing enough to secure SES against abuse by spammers(1), it's not unfair for entities intended to guard against spam to treat it as a spam source. This is one of the risks of letting third-parties run software on one's systems.

(1) keeping in mind that the definitions of "spam" can be quite subjective

cpncrunch• 12 years ago

Amazon SES definitely does have a spam problem, and the issue is that they don't bother doing anything about abuse reports. I've reported a spammer (who scraped our email address) to them, but the spams kept coming. Other people have reported the same thing.

If you're running a bulk mailing server you simply must respond to abuse reports, otherwise your service will get blacklisted and be essentially useless. Other providers such as mailchimp are much more proactive about getting rid of spammers.

lazyant4• 12 years ago

Not my time and my clients'.

By appending in the Posfix configuration file line smtpd_recipient_restrictions = ... spamcop and spamhaus , spam decreases in like 95% without even touching your server further (spamassassin I'm looking at you).

I you add greylisting you get rid virtually of all of spam.

giulianob• 12 years ago

Yes but if everyone using SES is getting blacklisted then you will also have a lot of legit emails being blocked.

eli7• 12 years ago

How much good mail gets mistakenly canned? I'd rather sift through a little spam than lose something I wanted.

claudius• 12 years ago

I you add greylisting you get rid virtually of all of spam.

I don’t really like greylisting, as it takes longer for email to get through. What did help without any perceivable loss whatsoever is being extensively strict about SMTP specifications (e.g. proper hostnames in EHLO) and things like PTR records. I really like watching these ‘5xx: Client <something> rejected’ flying by in my mail.info :)

ScottWhigham4• 12 years ago

This sort of vague comment with no substance is just opinion stated as fact. If you have more information - hell, even a more expressed opinion, I'd be interested. As expressed, however, it's a garbage comment that waste's everyone's time. Why bother?

pconf2• 12 years ago

This sort of vague comment

Not sure about "vague comment"s but anyone who has run an email server, used an rbl/rhsbl, and followed the logs <http://www.postconf.com/docs/spamrep/> would say the same. Having done so for years and run reports on dozens of servers daily it is clear that blacklists are the most effective form of spam blocking, by at least an order of magnitude.

kordless• 12 years ago

The SES team knows about the spam cannibal listings and is in contact with them, they say it's unlikely your open rate drop from 25% to 0.15% is caused by the SC listing.

SpamCannibal can cause the originating mail server to get caught in a 'tarpit' by slowing it down. Given the AWS CUSTOMER was sending a significant amount of measurable email to a given destination server (which was running SpamCannibal) it's possible the sending servers are being slowed down. In that particular scenario, that would affect open rate over a short period of time.

sjwright• 12 years ago

Let people run rampant on your IP range, and this is what happens.

I run a fairly large website, and I block all traffic from the likes of Amazon AWS because it's full of dodgy bastards who think they're entitled to run however many HTTP requests they like. Webmasters, look at your web logs. Don't be surprised if the majority of hits are coming from bots pretending to be web browsers.

guac• 12 years ago

SES uses different IP ranges than those used by EC2.

sp332• 12 years ago

It's the same idea though. Web sites might block crawlers in EC2, and mail servers might block emails from SES.

bowlofpetunias3• 12 years ago

I'm surprised you're pointing the finger at AWS.

As far as I can tell, 90% of all that crap still comes from the shitty cheap home user ISP networks and el-cheapo web-hosting services.

Never seen much bot traffic from AWS.

(The bot that is currently pissing me off is Netcraft. The practice of just "guessing" domains and then firing http-requests at them is annoying.)

_asciiker_4• 12 years ago

I have been managing email servers for over 10 years, and it has gotten to the point that I feel like blocking some of the most common ISPs. Seriously.

I am following all the best practises, hell, I even advocate them. It is just that these days it seems not to matter if you have SPF, Sender ID, DomainKey and DKIM, PTR, proper MX and even a normal to good IP reputation. There is still no guarantee what you will be able to reach the inbox of the likes of Gmail, Yahoo, Hotmail, etc.

I have been filling out huge forms for each and every major ISP for the past year because one or two users mark a newsletter as SPAM.

Conclusion: There is no common standard because every major ISP can set their own standards. This will eventually force everyone to use the same services worldwide.

Where's the freedom of choice here?

dminor• 12 years ago

Yeah, we just completed a switch to MailChimp after years of sending out our email ourselves. It's just too much hassle now for a smaller organization.

kaoD10• 12 years ago

one or two users mark a newsletter as SPAM.

I'm one of them. Those newsletters are spam. I would never sign up for a newsletter and somehow I'm getting those too. If my intent was not to get the newsletter, it's unsolicited mail by definition, i.e. spam.

Stop spamming me and I'll stop flagging you. Period.

How not to be flagged as spam:

- There should be a checkbox clearly visible and it shouldn't be pre-checked.

- Your "kind" product reminders are obnoxious too and I'll flag them as spam as well. Did I ask you to remind me of your product? Nope. Unsolicited then.

- If you ToS say I agree to receive mail, guess what? I don't agree, I just want to try your product. I'll flag you in a breeze.

- Social reminders like Twitter's trending around me or people I might know? SPAM! I don't care if I can disable these, I didn't enable them.

- You want to offer me discounts but I didn't ask for them? Flagged!

- I submitted a paper to a conference and it got published? Dozens of "calls for papers" in my inbox. Flagged, flagged, flagged, flagged!

- Calling it a newsletter or adding a tiny "unsubscribe" link won't hide the fact that it's still spam. I didn't click subscribe, I shouldn't have to unsubscribe.

EDIT: Woah, this seems controversial. Lots of up- and down-votes.

Dear product owners, downvoting me here won't change the fact that me (and your fellow users) will still flag the shit out of your unsolicited mail. I guess it pays if you keep doing it, but you should direct your energy far from that downvote button and closer to "ways not to annoy my users".

_asciiker_4• 12 years ago

You have all the right to mark it as SPAM of course. What I'm trying to get across here is that IP blocking is a bad solution. There are many cases where several domains share the same IP, specially with the shortage. So if domainA.com sends spam, why should domainB.com mail delivery on the same IP suffer from it?

pavel_lishin2• 12 years ago

I always click the "unsubscribe" link, first. If I get anything else after that, then I mark it as spam. (I don't buy into the 30-business-days bullshit, it's 2014.)

I also have catch-all addresses at my domain, so I register for things as SERVICE@mydomain, so I know exactly where spam is coming from.

Except I've been doing this for years, and 90% of garbage still just comes to my plain ol' gmail address that I've been using for over a decade, which suggests that businesses finally have wised up to the fact that sending garbage to everyone who puts their email address into a form is a bad, bad idea.

dredmorbius4• 12 years ago

This.

More frequently, I've been taking to /dev/nulling entire domains for crap. Usually recruiters (no, I'm not interested in your underwater basketweaving SEO marketing position in south-west Obscuristan, it's well outside my search and skill parameters).

I haven't got around to writing a good set of whitelisting scripts, but that's next.

Figuring out if I've subscribed to something, and/or how to MAKE IT STAHHHP really isn't worth my time.

DerpDerpDerp4• 12 years ago

If you ToS say I agree to receive mail, guess what? I don't agree, I just want to try your product. I'll flag you in a breeze.

No. You literally did agree.

That you don't like that it's a package deal, and you're exchanging getting their sales email for trying their product just makes you an asshole, but it doesn't make their message spam.

You established a business relationship with them, in which they told you ahead of time they'd do follow-up contact, and then you have the gall to complain about it in a way that damages the reputation of people who relay the messages you agreed to receive.

Way to make the world a worse place.

saurik3• 12 years ago

It is users such as yourself that make spam filters have the kinds of silly false positives being discussed in this thread: as a user (not as a product owner; I am a product owner, but I don't send e-mail, so I have no "skin in the game": so, you can claim all you want that the people downvoting you are all product owners, but some of us really do just feel you are abusing a shared system to carry on some kind of personal vendetta) it really sucks that I can't trust spam filters to not filter valid e-mail out of my inbox because people like you are so trigger-happy (and in some cases, simply vindictive) with the spam button... it is my sincere hope that services like Gmail are at least sometimes smart enough to realize "this person is just being annoying" and makes your spam votes meaningless :/.

logicallee6• 12 years ago

Your comment is insane! "If your ToS say I agree to receive mail, guess what? I don't agree, I just want to try your product. I'll flag you in a breeze."

So you don't agree to the terms you just read before giving out your email address. That's insane! It's like smiling and saying to a guy, "Here's my number", and not saying: "But if you call me, for any reason, I will report you for harrassment", without any indication that this is how you feel. Absolutely insane.

Why would you give out your email address with that attitude? "Here is my email address, but the only thing you should use it for is to let me ruin your communications with others who agree to the same thing I just agreed to, if I receive anything I might conceivably have given it to you for."

If you don't want to get ANYTHING, EVER, then what is the purpose of giving out a means to communicate with you??? What did you think you are doing by giving out an email address??

It's just so bizarre. Do the world a favor and register an email address for what you consider spam, which is everything.

Then never look at it again, while that email address gets invitations and calls to publish in journals, updates on the product offerings you are interested in, informative newsletters, free money on things that you're already spending on, and so forth... while you get nothing.

Boy you sure are showing them though!

eli7• 12 years ago

I can tell you from experience that some small percentage of people will mark your message as spam even if they specifically requested it -- heck, even if they want to continue receiving it in the future.

I routinely deal with people complaining about not getting a newsletter they requested after they marked it as spam (once they do that, we are required by agreement with the ISP to not send them any more messages ever).

jt21903• 12 years ago

I downvoted this message because it assumed that _asciiker_ was a bad actor who wanted to deliver spam, rather than assume that the he was perhaps misinformed about the best way to avoid delivering unwanted messages. It ignored the context of the original post (someone managing email servers for an ISP) and assumed that he was creating the spam messages directly. It took what could have been a reasonable thread about managing email and polarized it into a pro/anti spam thread.

(edit: Replaced "parent poster" with username of poster, to avoid confusion.)

newaccountfool• 12 years ago

If you accept the terms without reading them (Not un ticking the newsletter button) then its your fault and you should be penalized for wrongly marking email as spam when you didn't even read the signup form to realise you were agreeing to receive emails.

Its people like you that make it so hard to send emails to people, even when they agree to receive emails.

Aldo_MX• 12 years ago

I always try to unsubscribe first, and only when unsubscribing does nothing, then I proceed to mark the mail as spam.

snowwrestler• 12 years ago

You are getting down voted (rightly so IMO) because you posted an irrelevant personal rant in reply to someone who had the temerity to describe a challenge in the modern email system.

You have no idea if the parent sends out a single unsolicited email. All you saw was "newsletter" and you flew off the handle.

Not that you're alone; this happens in every single HN thread about email marketing, and is in my opinion one of the worst killers of signal to noise ratio on HN. We love to talk about "growth hacking" but every mention of email marketing is a race for HN comments denouncing all email as spam.

The fact of the matter is that even the most carefully run, innocuous, double opt-in email newsletter is occasionally reported as spam. I think it is because paranoid tech folks have spent years telling people to never use an unsubscribe link because it just makes the spam worse.

But if it's an email you actually signed up for, the unsubscribe link is the correct and appropriate way to unsubscribe.

richardw• 12 years ago

And now I have to check my spam folder to discover messages I signed up for. And I still get real spam because gmail's tools are diluted.

I think spam reporting is made too easy. I also hate over-sharing sites but not as much as I hate true spam. Unsub should be one click, spam reporting should be four clicks. Or hopefully gmail gives you an internal "spam report reliability" score so it knows you're a more trigger happy than I am.

And no, I've never sent a product mass mail out ever.

pja• 12 years ago

Just to illustrate a typical modern 'social' website email experience: I just signed up to MeetUp. Here's what I apparently signed up for just by giving them an email address so I could get information about a local event that someone has invited me to:

* Meetup Messenger A fun, informative newsletter to Organizers and anyone interested in running a Meetup

* Meetup HQ Announcements Get promotional emails from Meetup HQ

* Weekly Personal Calendar A once-weekly email of your Meetups and top Meetups in your area

* New Meetup Group Announcements Get email alerts about new Meetup Groups that match your interests

* Meetup Surveys An occasional email survey asking your opinion about new or existing features, your Meetup Group(s), Meetup sponsorships, and other requests for feedback.

* Greetings Send me an email when somebody posts a Greeting

So that's a minimum of a weekly email that I don't care about, plus promotional emails that I definitely don't care about: Joy unconfined. No mention of all these is made during the signup process that I can recall. Logging in with Facebook instead and letting them mine my FB friends graph instead is looking tempting frankly.

I can totally understand some people responding to this kind of 'dark pattern' email signup by block marking everything that isn't directly relevant to what they signed up for in the first place as spam. Marking it as spam means they never have to look at it ever again & is practically effortless on their part.

Sure, they could log back into the website in question (if they can find the password / can be bothered to log into Facebook) and faff around looking for the email subscription settings, but marking it as spam in GMail is quicker & easier: it's win all round from the user's point of view.

lazyant4• 12 years ago

Yes, I found the same problem with email, it's not getting spam (relatively easy to deal with) but deliverability, that's why at the end we need to use a 3rd party service like sendgrid, mailgun, mailchimp etc

davideous3• 12 years ago

The freedom of choice is actually in the hands of the end-users.

The end-users choose which email providers (Yahoo, Gmail, Hotmail) they want to use. The email providers are motivated to provide a good user experience, which includes blocking unwanted email because they make their money through user engagement.

The key to delivering into the inbox is sending mail that your recipients both want and expect. Provide a good user experience, and you'll build a good reputation. Push the limits (for example, use a "pre checked" checkbox on an order confirmation page to put people on your sales mailing list) and you'll be putting out email delivery fires all of the time.

Most of the things that you describe (SPF, SenderID, DKIM, PTR, MX) are all technical requirements, which are just the baseline for delivery. These are required, but any sender of unsolicited email can configure them. They don't earn you access to the inbox. Just like properly formatted HTML does not earn you great SEO results.

I like to break email delivery down into four areas:

* who -- send to people who requested your email and are expecting it

* what -- send something of value to these people

* technical foundation -- (SPF, SenderID, DKIM, Feedback Loops, etc.) required, but having it does not give you any points

* monitoring -- (open ratio, complaint ratio, ISP response codes) you need to know when something goes wrong

(My company, www.drh.net, has been providing email server software, services, and deliverability consulting for over 10 years.)

---

[edit; added the below]

Another way the freedom-of-choice is in the hands of the end users is this: the big ISPs (yahoo, gmail, hotmail) make most of their filtering decisions based off of end-user behavioral data.

For example:

* what percentage of your email is opened

* what percentage of your email is complained about (the "this is spam" button)

* what percentage of your email is deleted without reading

* how long is your email read

* how much is forwarded

* how much is replied to

* what percentage of your email that was placed in the Spam folder when seen by the user received a click on the "this is not Spam" button.

This is the end-users voting on if they want your email or not. This isn't the entire email deliverability equation, but it's a huge part of it.

The ISPs treat this data so importantly because: (a) it's hard to game unlike content filtering, and (b) it directly correlates to good user experience which they want to provide.

[edit to make bulleted list look right]

jt21903• 12 years ago

  > Provide a good user experience, and you'll build a good
  > reputation. Push the limits (for example, use a "pre 
  > checked" checkbox on an order confirmation page to put 
  > people on your sales mailing list) and you'll be putting 
  > out email delivery fires all of the time.

Believe it or not, it's possible to be a good actor, follow all of the rules and best practices, and still get flagged as spam.

Mail recipients are not perfect. They forget that they signed up for things. They accidentally click the "spam" flag on their messages. They get lazy and instead of unsubscribing they click the spam flag.

The real culprit here is that email messages rely on blacklists and not whitelists, i.e. recipients are required to give all senders full access and then block them when they misbehave, instead of giving them no access and giving them more access as they build trust.

So: What would it take to implement email whitelists across the industry?

_asciiker_4• 12 years ago

Thank you for this insight, I agree with almost all of it.

As an e-mail services provider, I cannot or should inspect what my customers are sending. I can suspend them due to complaints of abuse but the damage is already done.

Same goes for tracking. I still say, block domain names, not IPs..

bradknowles• 12 years ago

Speaking as the former Sr. Internet Mail Administrator for AOL, there is none. When I was there, we actively worked very, very hard to make sure that we did everything we should do to keep our stupid AOL users from inappropriately hurting people who contact them -- Like marking that message from your own mother as spam? Really?

Problem is, there are plenty of large sites out there who aren't so conscientious, and you can keep up that level of commitment for only so long.

There is no one on this entire PLANET that hates spam more than I do, and for a time I could rightfully claim that there was no other single person on this planet who had done more to fight spam than I had. But even I have my limits. I haven't been active in CAUCE or any other anti-spam effort for many years, and I haven't even been an active mail system administrator for a few years.

As one of the members of the Postmaster Team for python.org (currently inactive), I have seriously hated some of the stupid shit that has been done by the likes of Google, hotmail, and Yahoo! I've been sorely tempted to just ban them outright, because of whatever might be their latest stupidity. But it hasn't happened -- At least, not yet.

ANTSANTS• 12 years ago

If you were to remake email from the ground up, how would you solve the spam problem while keeping it as decentralized of a system as it is now?

leccine5• 12 years ago

How about a PKI system were one or more authorities can sign keys and the email server admins can approve public keys based on its combined score coming from the authorities. Authorities could be universities, engineering organizations and other non-profit entities.

mpyne• 12 years ago

So now people have to register identities and can't use anonymous email addresses. And it wouldn't fix the issue anyways since spammers would just use botnets of legit sender addresses.

drpancake• 12 years ago

Require a small fee to send an email, e.g. $0.01. Small enough not to matter for legitimate users, large enough to make spam unprofitable.

Bitcoin or some other cryptocurrency would be ideal for facilitating micro-transactions like this. Interestingly, the Hashcash concept was originally designed to fight spam, and later became one of the important ideas that made the invention of Bitcoin possible: http://en.wikipedia.org/wiki/Hashcash

okasaki• 12 years ago

That wouldn't work for mailing lists.

gnopgnip• 12 years ago

How would a decentralized ledger handle the 100 billion emails sent a day?

dredmorbius4• 12 years ago

Engineering in a lot of reputation management and metrics would help.

There are some interesting (I'm not sure "compelling" or "strong" is necessarily the case) arguments to be made for enabling open relays and other forms of unauthenticated messaging. John Gilmore of EFF has fought that battle for a long time, and still runs an open relay on toad.com.

Signing and authentication measures (particularly on header data) have to be both standard and quick to process.

Methods which increase the costs of delivery -- pacing receipt rates from a given IP or block, can help. Being able to specify receipt priorities: high for IPs and ranges with which frequent legitimate business is transacted, very slow for most others, would also be useful. Along with a lot of built-in support for this.

Killing :80 and moving to entirely secured ports wouldn't be a bad move either.

phunehehe0• 12 years ago

Maybe you mean 25 or something else? Port 80 is for HTTP. And what does a secure port mean? If you want people to be able to talk through a port you have to open it. The number doesn't matter.

gabemart• 12 years ago

Any such discussion will be well informed by https://craphound.com/spamsolutions.txt

revelation• 12 years ago

Freenet has the Web of Trust:

https://wiki.freenetproject.org/Web_of_Trust

bcoates• 12 years ago

Separate authentication from message delivery. The problem with both spam and spam mitigation measures is that the message is considered as coming 'from' a sending system instead of the actual originator of the email.

Splitting these up converts one impossible problem into a tricky but mostly solved problem (delivery) and a hard problem that has to be addressed anyway (internet identity)

leccine5• 12 years ago

I believe in IP blacklisting. Why should my business be open to countries like North-Korea or Somali if I don't have anything to do with those? Spam comes from everywhere, but you can get rid of at least 50% by simply dropping traffic from certain countries, so the expensive score based spam filtering get cheaper. Unfortunately Amazon SES is the victim of cyber warfare and spammers.

jzwinck• 12 years ago

This sort of logic will hurt you with customers who are US persons living overseas. I cannot tell you how annoying it is when as a US citizen and taxpayer I am blocked from using US services because I am not physically in the US. In 2014, where we plug our computers in does not define who we are. Geolocation is not authentication.

leccine5• 12 years ago

It is a trade off. You can purchase a cheap VPN service from thousands of VPN providers and get routed through a US IP. For you, who wants to fill the tax return it is worth it, for those who want to spam the sh*t out of other companies it is not worth it. I think this system works perfectly...

MichaelGG2• 12 years ago

Not even just that, but where they ignore your Accept-Language and just make up a decision on what language you should be using. Google has no way to fully switch languages - even after going to Google.com and setting English, you'll see images have tooltips in your "local" language.

Google's Play app does the same thing for a bit of their content. Certain headers get localized, despite everything else in the app being English. Netflix has the same problem, and then to further add insult, they send you to non-English phone numbers for support.

The most annoying thing is that someone probably got a raise for these "features".

MBCook2• 12 years ago

Do you realize how inaccurate the country <-> IP lists are at this point? And it's only getting worse as people are trading IP4 addresses.

leccine5• 12 years ago

Do you realize how big % of the entire IPv4 range are you talking about? I do not think so...

eli7• 12 years ago

Do you get much spam from North Korea?

belorn• 12 years ago

Blacklists are general a very effective method in handling spam, but its kind of dangerous to use in a commercial setting. A few weeks ago SpamCop blocked gmail for a few days, causing some "mild" issues for companies that depend on email.

There is sadly not much options. Either I can accept more spam, or use blacklist and put the control of the filtering in the hands of a third-party with none of the responsibility attached.

adarsh_thampy• 12 years ago

I had had the same issue with amazon SES. While Spamhaus PBL is not necessarily a blocklist, due to the default configuration error, all the emails we send out (from other providers like mailchimp) ended up in spam. Finally, the issue got fixed by configuring reverse PTR.

mrsaint• 12 years ago

bl.spamcannibal.org is notorious for a higher error rate (false positives). It'd be crazy if a popular mail service provider like Yahoo categorized incoming mail based on results from Spam Cannibal. If I added them to my MTA, I'd rank them fairly slow to diminish the effect of their false positives. See here: http://dnsbl.inps.de/analyse.cgi?type=monthly&lang=en

And see here how to add them to your checks (and rank them accordingly) if you're using Postfix: http://www.postfix.org/POSTSCREEN_README.html

notacoward2• 12 years ago

I know there are legitimate uses for something like SES, but it has always seemed a bit like "Spam as a Service" to me. Ditto for every other service that's designed around mass email, no matter how much YC startups might depend on them to "improve their conversion rate" or whatever the buzzword is this week.

cperciva• 12 years ago

Spam as a Service

I'd call it "Sender Reputation Checking as a Service". Where said service is paid for by the sender, but provided to the email recipient. Anyone can send email directly; but knowing that email has been sent through SES and Amazon hasn't killed the account yet provides a greater degree of trustworthiness.

In a sense, it's like a bond rating service.

notacoward2• 12 years ago

...and we all know how well the bond rating services performed their function. Sorry, couldn't resist.

On a more serious note, it seems like the "greater degree of trustworthiness" is only very slightly greater. SES might be better than some server in a domain nobody ever heard of, but it's still not as good as a provider with a long history of responsible email use. Many people can and do block SES and its ilk, as is the subject of this story, because the aggregate amount of spam is so great even if the individual spammers are transient (like they care).

Amazon could raise the bar, thus raising their own reputation and thus making the service more valuable to those who can still afford/qualify to use it. It's probably just not worth their while to do so. I'm not even criticizing them for that. I'm just observing that online business has a shady side, and Amazon isn't afraid to partake.

lazylizard• 12 years ago

are people not relaying their newsletters/unsolicited mails/spam thru some antispam outgoing smtp gateway if they're concerned about being blocked? filter it yourself before people filter u?

mgkimsal2• 12 years ago

It might help the situation more if webmail providers provided actual 'unsubscribe' or 'hide' links in their UI instead of 'spam' being the only feedback mechanism users are offered.

"unsubscribe" links vary in position, language and visibility in various clients. Making something beyond "this is spam" part of most mail clients, perhaps with reporting back to the originating sender, would help.

skymt• 12 years ago

Gmail has done this since 2009, though it depends on good behavior from the sender.

http://gmailblog.blogspot.com/2009/07/unsubscribing-made-eas...

cones688• 12 years ago

It is also part of UK law for Marketing folk

PythonicAlpha2• 12 years ago

Problem here is that particularly such "unsubscribe" links where used in the past (and still are, I guess) to reassure spammers that somebody is there. Because one problem spammers have is the quality of the addresses they have. Many spammers use lists from dubious sources and a big number of addresses are invalid. So, if they get an "unsubscribe", they know which addresses are better and can deliver more spam to it ...

So many don't dare to use such links and rather click on spam.

The only solution could be some "trusted" functionality that goes via the own mail provider of the receiver. But of course the mail provider can not simply send information to the sender of the eMail .... So the thing gets complicated. As much I learned, for spam clicks there is something like that available ... some kind of trusted feedback chain that gives information to trusted senders, that some mails where labeled as spam. Thus those senders can (indirectly) adopt their eMail campaigns.

__david__4• 12 years ago

Many spammers use lists from dubious sources and a big number of addresses are invalid. So, if they get an "unsubscribe", they know which addresses are better and can deliver more spam to it ...

That's only true of the dubious "viagra" style spam, where they got your name from a list. I don't think those even bother with "unsubscribe" links any more. I only see unsubscribe links from places where I've had to give my email up to buy something or sign up to a site. Those are generally legit and most of the techy/startup web sites will unsubscribe you immediately.

The next tier are the sites that unsubscribe you but take more than a week and will keep spamming their dumb newsletter in the meantime.

The final ones are either broken by stupidity (it's amazing how many web developers cannot grasp that "+" is a legit email character), or willfulness and will keep spamming no matter what. I block these at the SMTP level with 503 messages (usually containing some personal insults and swearing) as soon as they "RCPT TO" the unique email address I gave them.

MitziMoto2• 12 years ago

Another problem is that in some mail clients like Outlook.com, the "spam" button is actually labeled "junk". People clicking "junk" probably think they're just deleting an email.

driverdan• 12 years ago

Considering Amazon themselves send spam this isn't surprising. They like to send out product spam under the guise of account notifications with no opt-out. The only way to remove yourself is to close your account. At the very least they do this to affiliates and to Student Prime members.

Most of the Amazon SES IP blacklisted by SpamCannibal

Related Stories