On Fri, May 5, 2017 at 10:24 AM, Rob McEwen <r...@invaluement.com> wrote:
> On 5/5/2017 1:07 PM, valdis.kletni...@vt.edu wrote: > >> Don't your own logs have enough info in them for that? See what addresses >> you receive @gmail.com mail from, and @google-hosted-stuff.com.... >> > > Good idea. If I don't get a more definitive/official answer, I'll do that. > > It isn't quite as easy as it sounds because it isn't immediately obvious > *which* FROM address are using google. (they don't contain the word > "Google" in them, like your example above) But this isn't rocket science > either... just some extra MX lookups and/or filtering by IP space. > > Still, if the two are currently merged, my follow-up to a > definitive/official answer is going to be "please consider separating the > two". I'm sort of fascinated by the answer, either way. > > If they are merged, I think this is sort of like when a mixed-quality ESP > puts very their most reputable senders on the SAME shared IPs as egregious > spammers. (which is very bad form--using good customers as "human shields") > > But I'm hoping that isn't the case! Google runs multiple outbound pools, but mail is not separated by GSuite vs Gmail. It turns out, GSuite customers are not universally non-spammy, nor are they any less likely to get hijacked or phished, or have their machines compromised. I think all of the ISP GSuite customers are gone, but there are plenty of student accounts or small businesses who don't know that spam is spam, or plenty of sales/marketing folks at larger customers who think they know better (we even have this issue for google.com). We use different pools per service, and different pools for suspicious outbound mail. Our inbound systems can certainly tell the difference between our outbound IPs, generating reputations that align to our expectations, so I presume that others can as well. The different customers are differentiated by DK and SPF auth domains, perhaps that would be a better choice for adapting your spam filters than IP address. Brandon
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
