Email is an open system, right? Anyone can send a message to anyone… unless they are on Gmail! School Interviews uses two email servers t…
And this is happening after SPF, DKIM and DMARC provided a solution to the spam problem.
Any mail system can remove practically all spam by insisting messages conform to those three standards
But that is not true at all. Spammers can easily send mail with all proper SPF, DKIM and DMARC records and signatures. A lot of spam is and will be sent like that. Those extensions do not make spam impossible, they just make it easier to track and block.
But this does not change the point of the article – in this case it is a specific domain sending very specific non-spam messages. SPF/DKIM/DMARC prove it is not someone else – GMail has no ground for blocking these (unless were are not told something).
And GMail has been breaking mail for years now. E.g. I hate them for breaking message threading by ignoring threading headers and forcing own view on how messages should be grouped.
How does one send a spam email that passes SPF and DKIM if one doesn’t have access to the DKIM private key, or the DNS server to edit the SPF or DKIM records?
- Open a Gmail account, send spam.
- Buy a domain, setup SPF and DKIM, send spam.
- Hack an SMTP server, send spam.
I have the same problem, emails delayed by hours…
Confirmation emails when they create a booking being marked as spam but is that the only email they send out. Do they send out unsolicited ones to folks like me who mark them as spam? Are bots making booking and using my email. Its great they are doing everything right but im skeptical that something else they are doing is not causing the issue. I get plenty of good email in my gmail spam but the ones that do I can bet get marked as spam for good reason. Like from my alma matter which Im sure has a good and trusted endpoint but they can be a bit annoying with their emails and some folks likely mark them as spam. I don’t but I could see them getting a reputation of sorts.
For anyone interested: https://www.youtube.com/watch?v=mrGfahzt-4Q
This gets little in depth on this issues.
God damn it Google!
Anyone know a decent alternative at a reasonable price though? What if I have an @gmail today, and I want to move my storage elsewhere and have that just forward?
I switched to ProtonMail and have really enjoyed it. I was using my own domain with Gmail so my email address didn’t even change.
For those considering Proton Mail: There is one great benefit or disadvantage, depending on how you see it. As all traffic is encrypted, Proton Mail does not support standard IMAP or POP3. It’s therefore best used with the official Proton Mail app rather than third party apps. On desktop, you can use your favourite email client (Thunderbird et al) only if you install a “bridge” which decrypts incoming emails before forwarding them to the client: this bridge is, in turn, only available to paying subscribers.
That said, it’s a great service, and the fact that they have a viable business model which doesn’t depend on selling out their users might be a good thing.
IMAP supports TLS, what’s Proton’s excuse for enforcing their own delivery protocol?
They’re not using a different protocol for delivery, they still use IMAP and SMTP, but other mail clients can’t decrypt the message content from Proton because they don’t have the keys (and nor do Proton). Proton do supply a “bridge” app if you want to use your Proton mail with a desktop email client, which handles the decryption between your computer and Proton by accessing the Proton encryption keys on your computer.
TLS is like a padlock on a box, and you have the key. Encrypted content is if the letter in the box is also written in code, needing another key to translate into plain language.
Proton doesn’t use IMAP. Your inbox isn’t quite like other internet mailboxes. You can’t access it with TLS. You access it via normal TCP/IP traffic. The contents are encrypted and can only be decrypted on your device. This is why IMAP doesn’t work. The Bridge acts as a Proton client, decrypts the data and then acts as a local IMAP server so you can connect to it via another IMAP client. Proton cannot read your email at any other time other than ephemerally at the moment it receives the email, which it then encrypts one way into your inbox. It cannot decrypt it. Only your devices can. Your devices get the private key from Proton’s servers, but they’re encrypted with your account password. So you grab the encrypted key and decrypt it locally on your device. It’s not the most secure, but it’s the most secure you can do without having to manage your own keys. It should be noted that you can possibly lose access to your email. This would require losing access to your physical devices and losing your password at the same time. As long as you have a device that has your key, you can restore access to your account which allows it to update the encryption on the key, etc. If you lose your physical devices and lose your password, you can only restore access to your account, but not any of your email up until that point.
Proton is end-to-end encrypted - they don’t have the keys themselves. With TLS, encryption is between you and the server, but the information can be decrypted on the server side.
At least that’s my understanding of it. If you want Proton’s own words, they wrote an explanation on their website. :)
Any advice or hints on how to switch over? I wanted to do it years ago but I dread having to change my main mail address on everything, from apps, tools and games to bills or RL document-related stuff, it sounds like a horrible mess and ton of work
My recommendation (assuming you have a normal @gmail addy and not a custom domain like I had) would be to use email forwarding. So you can leave your Gmail as is, but set it up (in the settings) to automatically forward all your email to your new protonmail address. Then you can gradually change the important contacts/sites to your new email at your leisure.
I do highly recommend buying a domain and setting up your own email address though, it gives you a lot more portability going forward. You can actually do a lot with your own domain, and it helps you maintain trust better.
Anyway, enough preaching lol, protonmail also maintains a guide to help people switch: https://proton.me/easyswitch
If you’re recommending setting up a forward/IMAP collection from a Gmail account, don’t forget to mention deleting the messages from the server as well! Emails left on a server for more than 30 days are considered “abandoned property” for the purposes of warrantless search.
Do you have a source for this?
The most I could find is that the Electronic Communications Privacy Act allows for warrants to be issued for emails less than 180 days old. I’ve found vague references and snippets from articles no longer available that seem to claim some acts that have passed since then allow for simple subpoenas instead of full on warrants for said emails, but 180 days is the only threshold I’ve found and again, it’s for less than 180 days that’s at danger.
I don’t know if this fits your needs, but check out setting up a mailinabox instance.
My recommendation for everyone is to use Fastmail and a custom domain.
Fastmail is extremely reliable, and since they charge money they also offer customer support. A few years ago I lost a lot of emails due to a client bug, and Fastmail support was very helpful recovering them from backup.
Use a custom domain so you can change providers in the future so you’re not locked into your provider and can change if you aren’t happy with them anymore.
I’m also using fastmail and I’m happy with them. Their native android email client is a little clunky but I still use it and I have the option to use other mail clients too.
I feel like step 1 is just buying a domain so you can have control over your e-mail address, and then you can switch providers whenever you want (or host it yourself).
If you already pay for extra iCloud storage you can use a custom domain for e-mail with iCloud for $1/mo (which many people are already paying for). Apple’s still a pretty big e-mail provider, so maybe that doesn’t address all of your concerns, but it’s a really cheap way to use a custom domain that more people should take advantage of imo.
I host my own e-mail and it’s pretty care free these days (I don’t send bulk e-mails, though, so I don’t contend with rate limits at all). Honestly, more people should do it instead of buying into all of the fearmongering about e-mail… It’s a little tricky to set up right, but the impossibleness of the situation is somewhat exaggerated. The best defense for self-hosted e-mail is if more people actually do it… Otherwise you’re just capitulating to the large (and slightly less large) mail providers.
+1 on having your own domain. I was using gmail for a long time, and recently switched to my hosting provider’s included-with-purchase email. Having my own domain made the move transparent to everyone, and relatively painless.
What a surprise! (no)
And this is how you kill an open standard. Good resource to share with people cheering for Meta to adapt ActivityPub etc.
In this position I would already be putting warning on the order page to say to explain to Google/Microsoft users that they will receive a confirmation email, but that their email provider may delay the email to up to 12 hours before they can see it in their inbox.
It would be informative to customers, avoid some support calls, and would give credit where credit is due.
I doubt that this is a problem with just Gmail though…
I’d presume someone like EU would be interested in this.
Anyone got a different site covering this? This site’s HTTPS certificate is invalid or sth which doesn’t inspire confidence
Valid cert.
It’s hosted on blogspot, it’s a google issued certificate, to me seems valid
Meanwhile I get spammed 100s daily from asian job posting systems that I mark as spam/unsubscribed and they still come through. Apparently it’s all a scam to show need for H1B visas?
The term you’re looking for is ‘Horizontal Conduct’ and it’s illegal. The hard part of course is making that claim against the team of lawyers that Google would be able to field.
Google is evil.
