It is sad because I think it isn't just gullible people generally, but those who did not grow up with computers and won't understand that "This is your bank informing you of a security breach" is bogus are unfairly hit.
Other thing is that the cost of sending massive numbers of emails is basically nothing so why not? If only 100 people out of an email list of 100M click through, that might pay you for this month.
Also FWIW, people to whom I send email regularly tell me that their email systems mis-classify my emails as spam. I've spoken with several networking specialists, and they all shrug their shoulders and say: "It's the server level spam filtering ... it's not very good." GMail in particular is known to be aggressively negative towards email originating from anywhere other than another GMail account.
So in answer to your no doubt intended to be rhetorical question, I use spam filtering in my email system, not on the server.
This just isn't correct. Gmail does indeed have a HUGE market share at around 20-30% depending on source but with every business using mail for notification and business communication you will note that an even smaller minority of mail comes from other gmail accounts. If Gmail actually worked like that it would have ceased to work entirely and lost most of its users. If I understand correctly the actual issue is all the major players vs very small players like people running their own server.
In that scenario the users whether it be on yahoo, google, msn what have you get 99.999% of their intended email while the person running their own email server will have a much larger miss rate a bigger problem and one that can't be solved on the client side at all.
From the perspective of the end user who is neither aware nor concerned about small servers issues server side filtering works very well. Looking at my spam folder it seems to be filled not with nigerian scams which don't even make it to my spam folder but with emails from people who have send me emails which have some degree of legitimacy but which I have repeatedly deleted unread like political emails requesting contributions. From my perspective it works great.
Please: I've experimented with this for over two decades, and continue to do so. I know that lots of people say that server-side filtering is fine. My direct personal experience is that for me it is not fine, including the spam filtering provided by Google's email service. I do not deny that for other people it's fine, I'm just saying ... don't deny my experience.
I regularly have emails to my GMail from colleagues end up in the spam folder. Perhaps as many as 5 or 10 per week, enough that I have to trawl through the spam folder every few days to make sure I've not missed something important.
Similarly, reasonably often when people reply to me, often after being prompted with a second email, or even a phone call, people tell me that emails from my "other" ISP to their GMail provided mailboxes have ended up in the spam folder.
It happens in waves ... it can be fine for months, and I start to think it's all good and I can trust it, and then there's a spate of emails going to spam when they really shouldn't. It's simply unreliable.
So for incoming email I do my own filtering. I can do nothing about my outgoing emails ending up in someone else's GMail spam folder except to be aware that it happens, and to keep track of when I'm expecting a reply. With some colleagues I've gone to a "positive acknowledge" system to preempt what have been expensive problems in the past.
* What's your DKIM/SPF/DMARC setup like? That all needs to be on point to get delivery to gmail to be reliable.
* Are you using a provider like Sendgrid, Mailchimp, etc. to send mail? Are you on a plan that gives you a dedicated IP address or is it part of their shared pool? The "it happens in waves" sounds a lot like a common problem with the shared pools where spammers send a bunch of mail through a service, the IP gets blacklisted, and it takes them a couple days to notice and remove it from the pool.
* do you have any "noisy" alerts or similar going out to people? Not necessarily spam, but eg, sometimes users getting frequent notifications, daily summaries, etc. will sometimes just flag them as "spam" rather bother to turn them off or manage them properly. At some point, that trains Gmail's filters to increase the spam likelihood on your entire domain.
* No, I'm sending email from my domain on my domain host. That has a single IP address shared among all their customers, but it's a very small ISP, and there are no spammers, and the IP address is not on any blocklists.
* No, I send standard email "by hand", and I know that people are not marking them as spam.
It's nice to see you go through these things because these are exactly the things I've gone through several times, so it serves to confirm that I've addressed the right things.
You say:
> ... look at the SPF/DKIM/DMARC related DNS entries with dig ...
I don't know how to do that.
> ... verify that they are correct.
I wouldn't know what it means for them to be correct.
As a further example, in trying to use postmark's service I get this:
In order for us to send you email digests,
you must set up a DMARC policy associated
with your domain. This allows us to collect
reports from the major ISPs about your DMARC
alignment.
Add this TXT record to your domain’s DNS at
_dmarc.solipsys.co.uk. with the following
data:
...
I really appreciate your feedback, and I'm passing it on to the people I pay to do this for me. The thing is, that's my ISP, and you tell me I shouldn't trust them.
> ... now you need to understand a lot about DNS and those mail related standards and do a significant amount of work to stay on top of the configuration to have a snowball's chance in hell of your mail getting through.
That's exactly what I pay someone else to do, and they are doing it correctly (as best I can tell).
So ... I just have to live with it. As far as I can tell, short of simply giving up entirely and using Google, I've done everything I can.
Is solipsys.co.uk your domain (from an earlier comment)? If so, I can see right away that there's no DMARC entry for it. That means that it's vulnerable to spoofing (I or any attacker could easily send an email to someone making it look like it came from your domain, eg, as part of a phishing attack). Gmail definitely penalizes domains without DMARC, making emails more likely to be classified as spam.
I am, for many reasons, so thank you for understanding that.
> If you want to keep believing that your ISP knows better than them, then I guess you're going to.
It's not that I believe my ISP knows better than Google, it's that I believe they are doing what they have been told is necessary.
> ... solipsys.co.uk ... no DMARC entry for it.
I will raise a ticket and get it dealt with, and as a part of that I can get the entire issue looked at more closely.
Thank you.
Based on what you've said here I don't know what you mean by "self-hosting". I have a package that I purchase from a company that provides me with my email and web hosting. I pay them, I configure my web client to connect using the details they provided, they deal with the configuration.
They are qualified in this field, they have certifications.
Everyone here seems to be using terms that obviously mean something to them than is different to what the terms imply to me. I have machines that connect to my email, hosted by the ISP with whom I have the contract. To me, that doesn't mean "self-hosted" ... I don't do any configuration of DKIM/SPF/DMARC/etc. That's all done by the people I pay.
So ... I really don't know what you're talking about. I suspect you know too much to be able to communicate effectively with me, who knows nothing. It's plausible that the field of discourse is simply too technical.
I have/work with three different companies ... two of them use Google based email systems, one (my own) does the filtering "in house". One of the G-based systems performs well, the other has multiple false positives every day.
I'm sure it performs well for the majority of people ... it's likely that the emails I send and receive are atypical, and Google performs badly because they are not "normal".
Everyone has to decide where that trade-off lies. In my context, I simply cannot trust Google, or any other server-side filtering, for important email. As others have said, it simply means the spam folder is a second inbox.
As I say to my clients about so many things: take advice, understand the trade-offs, make a decision, deal with the consequences.
After all the marginal cost of sending out extra emails is basically free. It's not as if he needs to only select the most gullible people to save on costs.
At least, that was the impression I got from an old lady who lived near me, who managed to shout down a stream of people telling her that her 'secret agent boyfriend from plymouth' she was sending all her money to wasn't real.
I think there's a bit of a parallel to cults like scientology - the more incrementally ridiculous you make the story, the higher the feeling of shame is when you have to own up to being fooled, making some people go in deeper rather than back out.
Thank you!
A lot of people think it's laughable that anyone would fall for "simple obvious scams" but I've met a good handful of older family and their more elderly friends who either fell to a scam or were only stopped once someone at a store questioned them as to why they were buying lots of gift cards all at once. In some cases scammers will work on people over a long period of time to gain their trust.
I've had people in my close family fall into debts to those folks, they target the weakest and literally go heaps and bounds to extract as much as they can from their 'mugus'.
Not fun at all :S
"Why do Nigerian Scammers Say They are from Nigeria?"
This approach suggests an answer to the question in the title. Far-fetched tales of West African riches strike most as comical. Our analysis suggests that is an advantage to the attacker, not a disadvantage. Since his attack has a low density of victims the Nigerian scammer has an over-riding need to reduce false positives. By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.
https://www.microsoft.com/en-us/research/wp-content/uploads/...