Re: [mailop] Reject vs spam folders

[Renaud Allard via mailop]

On 9/16/22 22:01, Gellner, Oliver wrote:



Am 16.09.2022 um 08:26 schrieb Renaud Allard via mailop :

When I was using spam folders, for every mail going into that folder, the 
sender was getting a 5XX answer telling that the message might not be read as 
it was sent into the spam folder.


Interesting approach. With which MTA / spamfilter did you set up this behaviour?


It was set up with exim.


smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Ángel via mailop]

On 2022-09-16 at 20:47 +, Gellner, Oliver wrote:
> I can’t provide real research and I believe as well that 99% is
> exaggerated, but in my experience it’s more likely that a given
> random person is NOT regularly checking his spam folder than he is
> checking it. That‘s why I only vaguely wrote „vast majority“.
> 
> Some years ago an important email was sent to several hundred
> employees. The email was classified as spam and routed into the
> respective spam folders. One day later, about 10% of the recipients
> had moved the email out of their spam folder. Of course the others
> could have read it in the spam folder (and left it there), but it
> seems unlikely that a large amount of users checked their spam
> folder, found the legitimate email, read it, but let it sit in the
> spam folder.  Based on the feedback of the sender a lot of recipients
> weren’t aware about the contents of this email.
> 
> I can’t say whether 10%, 20% or 30% are regularly checking their spam
> folder, but based on my experience it’s the minority.

I think there are multiple types of users. Assuming a "spam folder
style" of tagging spam:
- Some users will check it at least once a day.
- Some will check it regularly but far in between, maybe once a month 
- Some will only look there when really expecting a message not 
- Some will never look there, at all

I would expect different proportions between personal and business
mailboxes. And in the later case if you knew the positions, that
(should) be a factor as well: sales (or, as mentioned, a recruiter)
_should_ check for misclassified mails pretty often, whereas some other
roles  don't even need email access from outside the company.

The type of client used is probably also correlated to the frequency of
checking the spam folder: POP3 users will tend to be in the bottom
places, webmail and other MUA will probably vary, in how they present
the spam folder (assuming it's subscribed!), if there a count is being
included, if the user has custom folders which require scrolling to
view the spam folder…


Maybe some of the big players on the list could share some stats about
the percentage of people of each "kind" they see. I'm sure [some of
them] will be tracking this.


Regards


___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Gellner, Oliver via mailop]

Am 15.09.2022 um 22:51 schrieb Matthew V via mailop :

I'd love to know the research on this... 99% seems a bit far fetched.

Homer Simpson once said, “Oh, people can come up with statistics to prove 
anything, Kent. Forty per cent of all people know that.”

~MV

On 2022-09-15 4:30 p.m., Jaroslaw Rafa via mailop wrote:
the reality is that 99% of users don't check
their spam folders at all, so directing a message to spam folder effectively
equals blackholing.

I can’t provide real research and I believe as well that 99% is exaggerated, 
but in my experience it’s more likely that a given random person is NOT 
regularly checking his spam folder than he is checking it. That‘s why I only 
vaguely wrote „vast majority“.

Some years ago an important email was sent to several hundred employees. The 
email was classified as spam and routed into the respective spam folders. One 
day later, about 10% of the recipients had moved the email out of their spam 
folder. Of course the others could have read it in the spam folder (and left it 
there), but it seems unlikely that a large amount of users checked their spam 
folder, found the legitimate email, read it, but let it sit in the spam folder. 
 Based on the feedback of the sender a lot of recipients weren’t aware about 
the contents of this email.

I can’t say whether 10%, 20% or 30% are regularly checking their spam folder, 
but based on my experience it’s the minority.

—
BR Oliver

dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Gellner, Oliver via mailop]

> Am 16.09.2022 um 19:22 schrieb Grant Taylor via mailop :
> The mailing list is the terminus of the message that I'm typing.  The mailing 
> list is also a origination point of a new message substantively based on the 
> contents of my message.  But it is not my email.  As such, I fully believe 
> that the emails that the mailing list sends should be wholly from the mailing 
> list, perhaps with my name in the human friendly part of the from address 
> while the actual email address reflects the mailop mailing list.

Yes! I should save this somewhere since it explains how I believe mailing lists 
should work better than I could have written it myself.

NB this is also how this very mailing list works.

—
BR Oliver


dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Gellner, Oliver via mailop]

> Am 16.09.2022 um 08:26 schrieb Renaud Allard via mailop :
>
> When I was using spam folders, for every mail going into that folder, the 
> sender was getting a 5XX answer telling that the message might not be read as 
> it was sent into the spam folder.

Interesting approach. With which MTA / spamfilter did you set up this behaviour?

—
BR Oliver


dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Grant Taylor via mailop]

On 9/16/22 11:42 AM, Jaroslaw Rafa via mailop wrote:
Well, when I'm sending the mail, I can never be sure which route 
it will take. What I know is that in *first step* the mail will be 
sent from X, Y or Z. But there's always the possibility that the 
mail I send to addre...@domain1.com will be forwarded from there 
to addre...@domain2.net. I can't know that.


You can also have a bad actor at domain1.com spoofing email to 
addre...@domain2.net pretending to be you.


Hence I fall back on /I/ /only/ /authorize/ X, Y, and Z to send email 
fro my domain.  I'm very well aware that domain1.com is not in the X, Y, 
nor Z list.  As such, domain1.com is /NOT/ /authorized/ to send email as 
my domain.


And as you surely know, forwarding breaks SPF. You can argue about 
rewriting the envelope-from, but this doesn't matter because standard 
forwarding as it is configured in MTAs doesn't do this and you have 
to use special tools.


The standard configuration of the MTA software doesn't take a lot of 
things into account which have changed since the venerable .forward was 
new; reverse DNS, SPF, DKIM, DMARC, spam, viruses, etc.  It's not 1995 
any more and it's time to let go of some simpler minded ides from 25+ 
years ago.


SRS is an option.  I use SRS to successfully forward email to Gmail. 
Other systems have .forward or .procmailrc forwarding that generates a 
new message with the original message as an attachment.  There are options.


But domain1.com is /NOT/ /authorized/ to send email as my domain.

And I don't agree with those who say we should give up forwarding and 
instead use fetching mail via POP or IMAP by the "target" server from 
the "source" one.


Note well how I'm /not/ giving up on forwarding.  I've just changed how 
I forward to keep up with contemporary SMTP ecosystem.


This is a crazy concept that might appear only as a poor workaround 
for mailbox providers that didn't give the users an option to forward 
mails. Forwarding is much simpler and more flexible (eg. you can set 
up a filter to forward only selected messages) and is compatible 
with the whole concept of email, which works on "push" and not 
"pull" principle.  Not mentioning the fact that you have to store 
credentials for your "source" account on the "target" server, which 
may be a security concern.

I agree with all of that.

You can even forward different message to different places.  ;-)

So I can never be sure what IP addressess will my emails be actually 
sent from.


I disagree.  Unless your out-bound MTA is on a dynamic IP and even then, 
I maintain you should know what IP address(es) will /originate/ your 
messages.


Therefore, for me "-all" doesn't make sense; the most we can say is 
"~all", but even this can be doubtful; what is "actually true", 
and what the sender knows for sure, is "?all" - nothing more.


It becomes a question of who do you authorize to (re)send email claiming 
to be from you?  --  It seems as if you personally have chosen to say 
that you allow some other people to send email claiming to be from you. 
That's /you/ /choice/ /to/ /make/.  I respect that.  I also respectfully 
disagree with the choice that you have made.  But again, /it's/ /your/ 
choice/.


There is one and only one case where "-all" is actually meaningful: 
when it is the only token in the SPF record, that is, the domain 
declares that it doesn't send mail at all.


That's your opinion.  An opinion that I obviously disagree with.

P.S. Yes, I'm fully aware that there are other protection mechanism like 
DKIM and DMARC / ARC.  But I believe in a belt and suspenders approach 
where I close and latch every single picket fence gate that I can.




--
Grant. . . .
unix || die



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Alessandro Vesely via mailop]

On Thu 15/Sep/2022 22:58:12 +0200 Jaroslaw Rafa wrote:

Dnia 15.09.2022 o godz. 22:51:29 Cyril - ImprovMX via mailop pisze:

So basically, what would be interesting to have is both : land the email in
the spam folder but notify the sender about if, maybe via an ARF report ?
That way, the event organizer or the one applying for a job would be able
to notify the recipient about the email being in spam.


That would be probably the best solution.



+1, that's what I do.  Except the report is plain text.  It just says spam was 
received from that IP:port at what time.  If they reply, I send the header (and 
that's what the spam folder is for.)


Oh, the report is not going to be sent to the sender.  Use RDAP abuse contact.


Best
Ale
--




___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jaroslaw Rafa via mailop]

Dnia 16.09.2022 o godz. 11:15:41 Grant Taylor via mailop pisze:
> 
> I may be naive in my belief, but I do believe that you know how you operate
> your email better than I do, and that if you tell me that you only send
> email from X, Y, and Z, and that anything else is not from you, well, I'm
> going to believe you.

Well, when I'm sending the mail, I can never be sure which route it will
take. What I know is that in *first step* the mail will be sent from X, Y or
Z. But there's always the possibility that the mail I send to
addre...@domain1.com will be forwarded from there to addre...@domain2.net. I
can't know that. And as you surely know, forwarding breaks SPF. You can
argue about rewriting the envelope-from, but this doesn't matter because
standard forwarding as it is configured in MTAs doesn't do this and you have
to use special tools.

And I don't agree with those who say we should give up forwarding and
instead use fetching mail via POP or IMAP by the "target" server from the
"source" one. This is a crazy concept that might appear only as a poor
workaround for mailbox providers that didn't give the users an option to
forward mails. Forwarding is much simpler and more flexible (eg. you can set
up a filter to forward only selected messages) and is compatible with the
whole concept of email, which works on "push" and not "pull" principle.
Not mentioning the fact that you have to store credentials for your "source"
account on the "target" server, which may be a security concern.

So I can never be sure what IP addressess will my emails be actually sent
from. Therefore, for me "-all" doesn't make sense; the most we can say is
"~all", but even this can be doubtful; what is "actually true", and what the
sender knows for sure, is "?all" - nothing more.

There is one and only one case where "-all" is actually meaningful: when it
is the only token in the SPF record, that is, the domain declares that it
doesn't send mail at all.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Grant Taylor via mailop]

On 9/16/22 10:57 AM, John Levine via mailop wrote:
Nope.  SPF is somewhat useful as a signal that "this is real" but it 
is not useful, and -all is particularly not useful, as a signal that 
something is fake.*


I understand why you say that and acknowledge that a lot of people say 
the same thing.


However, as someone that has advocated for and has used SPF records that 
end in -all for more than a decade, I have to question the veracity of 
the sentiment behind your (and other's) statement(s) to that effect.


Maybe I live in / am exposed to too small of a world to sufficiently 
appreciate things the way that some people do.



There are way too many ways to send real mail that SPF cannot handle.


Again, I question the veracity of that.  Rather I think that there are 
ways to deal with it and that not everybody does sufficiently deal with it.


I may be naive in my belief, but I do believe that you know how you 
operate your email better than I do, and that if you tell me that you 
only send email from X, Y, and Z, and that anything else is not from 
you, well, I'm going to believe you.


As for all the nominally outsourced marketing, well I think that's 
misconfigured way too often.


That's one of the reasons we have DKIM and DMARC, and we all know 
how much pain they have caused for mailing list mail that recipients 
actively want.


That gets into a different disagreement.  I'm sending this message to 
the mailop mailing list.  I'm not sending it to you John L, or any other 
subscriber in particular.  I view the mailing list as a terminal point. 
The email, as an SMTP envelope and contents, is between my MUA and the 
mailing list MUA.  The mailing list is the terminus of the message that 
I'm typing.  The mailing list is also a origination point of a new 
message substantively based on the contents of my message.  But it is 
not my email.  As such, I fully believe that the emails that the mailing 
list sends should be wholly from the mailing list, perhaps with my name 
in the human friendly part of the from address while the actual email 
address reflects the mailop mailing list.  --  I say this to say that in 
my head, SPF, DKIM, and DMARC are all perfectly compatible with how I 
believe things should work.  Anything that falls short is a 
misconfiguration /in/ /my/ /opinion/.




--
Grant. . . .
unix || die



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[John Levine via mailop]

It appears that Grant Taylor via mailop  said:
>-=-=-=-=-=-
>-=-=-=-=-=-
>
>On Sep 15, 2022, at 9:57 PM, Cyril - ImprovMX via mailop
>> As someone whose addresses is regular forged in spam: NO.
>
>On 9/16/22 7:18 AM, Bill Cole via mailop wrote:
>> +1
>
>I thought that we were to a point that SPF was mitigating a lot of 
>out-and-out forgeries.  At least between purported senders that publish 
>sufficiently strict SFP records and recipients that honor said SPF records.

Nope.  SPF is somewhat useful as a signal that "this is real" but it is not
useful, and -all is particularly not useful, as a signal that something is
fake.*

There are way too many ways to send real mail that SPF cannot handle.  That's
one of the reasons we have DKIM and DMARC, and we all know how much pain they
have caused for mailing list mail that recipients actively want.

R's,
John

* - 0ther than a single -all meaning you send no mail at all, but that's a 
corner case.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Grant Taylor via mailop]

On Sep 15, 2022, at 9:57 PM, Cyril - ImprovMX via mailop

As someone whose addresses is regular forged in spam: NO.


On 9/16/22 7:18 AM, Bill Cole via mailop wrote:

+1


I thought that we were to a point that SPF was mitigating a lot of 
out-and-out forgeries.  At least between purported senders that publish 
sufficiently strict SFP records and recipients that honor said SPF records.


Don't do reporting without a *trustworthy* explicit request to do so 
from the owner of the address being reported to. ARF reports to randomly 
forged putative senders is not going to go well.


I wonder if there's room to leverage ~> extend DSN's NOTIFY to add an 
ARF option wherein this is a flag to the last responsible mail server to 
conditionally send an ARF if the message is not accepted / delivered 
normally.  Wherein the condition would look up information on the 
purported sending address / domain to see if it should send an ARF and 
the details therefor.




--
Grant. . . .
unix || die



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Bill Cole via mailop]

On 2022-09-16 at 01:58:07 UTC-0400 (Fri, 16 Sep 2022 06:58:07 +0100)
Laura Atkins via mailop 
is rumored to have said:


Sent from my iPhone

On Sep 15, 2022, at 9:57 PM, Cyril - ImprovMX via mailop 
 wrote:



So basically, what would be interesting to have is both : land the 
email in the spam folder but notify the sender about if, maybe via an 
ARF report ?


As someone whose addresses is regular forged in spam: NO.


+1

Don't do reporting without a *trustworthy* explicit request to do so 
from the owner of the address being reported to. ARF reports to randomly 
forged putative senders is not going to go well.




--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Cyril - ImprovMX via mailop]

> Speaking as a spammer, allow me to offer my deepest thanks for your help
> at tuning my techniques to evade your filters.

The other options are :

   - Refusing the email (which is the same to you as you'll know it's
   because it's spam)
   - Accept the email and put it in the Spam folder, blackholing the email


There is clearly no solution to this problem. Either solution brings its
set of problems.
Maybe spam folder is the best solution there is.

Le jeu. 15 sept. 2022 à 23:43, John Levine  a écrit :

> It appears that Cyril - ImprovMX via mailop  said:
> >-=-=-=-=-=-
> >-=-=-=-=-=-
> >
> >So basically, what would be interesting to have is both : land the email
> in
> >the spam folder but notify the sender about if, maybe via an ARF report ?
>
> Speaking as a spammer, allow me to offer my deepest thanks for your help
> at tuning my techniques to evade your filters.
>
> R's,
> John
>
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Renaud Allard via mailop]

On 9/15/22 22:51, Cyril - ImprovMX via mailop wrote:
So basically, what would be interesting to have is both : land the email 
in the spam folder but notify the sender about if, maybe via an ARF report ?
That way, the event organizer or the one applying for a job would be 
able to notify the recipient about the email being in spam.




When I was using spam folders, for every mail going into that folder, 
the sender was getting a 5XX answer telling that the message might not 
be read as it was sent into the spam folder.
This is also probably against best practices, but at least the sender 
was warned.


smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Laura Atkins via mailop]

Sent from my iPhone

> On Sep 15, 2022, at 9:57 PM, Cyril - ImprovMX via mailop  
> wrote:
> 
> 
> So basically, what would be interesting to have is both : land the email in 
> the spam folder but notify the sender about if, maybe via an ARF report ?

As someone whose addresses is regular forged in spam: NO. 

Laura

> That way, the event organizer or the one applying for a job would be able to 
> notify the recipient about the email being in spam.
> 
>> Le jeu. 15 sept. 2022 à 22:33, Jaroslaw Rafa via mailop  
>> a écrit :
>> Dnia 15.09.2022 o godz. 11:32:41 Jay Hennigan via mailop pisze:
>> > 
>> > If recipients at least periodically scan the contents of the spam folder 
>> > and
>> > mark wanted mail, this avoids the need for the sender to communicate
>> > out-of-band to deliver the original (and likely future) messages as would 
>> > be
>> > the case with a rejection.
>> 
>> I understand that was the whole assumption behind the concept of spam
>> folders. If it actually worked this way, spam folders wouldn't be any issue.
>> But this assumption failed: the reality is that 99% of users don't check
>> their spam folders at all, so directing a message to spam folder effectively
>> equals blackholing. The sender needs to communicate out-of-band anyway to
>> ask the recipient to check their spam folder.
>> 
>> Spam folder can work if the user is setting it up him/herself. That is, the
>> provider's antispam system only tags the message as spam (in subject or
>> another header) and the user must manually set up a filter to move tagged
>> messages into spam folder. Because they set it up themselves, chances are
>> they will look into it from time to time. If this is something that is
>> preconfigured for them by the provider, they usually don't look anywhere else
>> except the main inbox.
>> 
>> Of course, training the filter by moving the messages in and out of spam
>> folder will be harder to implement by the provider in this setup, but it is
>> still possible to do.
>> -- 
>> Regards,
>>Jaroslaw Rafa
>>r...@rafa.eu.org
>> --
>> "In a million years, when kids go to school, they're gonna know: once there
>> was a Hushpuppy, and she lived with her daddy in the Bathtub."
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://list.mailop.org/listinfo/mailop
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Paul Smith via mailop]

On 15/09/2022 22:51, Jaroslaw Rafa via mailop wrote:

I already described what I think is best. Only *mark* messages as spam and
let the users decide if they want *themselves* filter the marked messages
into the spam folder. Don't *preconfigure* such filtering for them.


OK. I'm sorry for casting aspersions.

I agree with the option to mark messages as spam - but if it's the 
default, then you can guarantee that as soon as someone receives around 
10 spam messages a day, they will implement a filter to move/delete 
them. At which point, the only advantage of not having the junk folder 
as the default is that someone's YouTube tutorial video has got a few 
million more views, but you've also got lots of users who're slightly 
annoyed at having to watch the video, or an IT team who are very annoyed 
at having to implement filters on hundreds of users' PCs.


Unfortunately, there is no good answer that will apply to all users, 
giving a user various choices is the best we can do.


Paul


--


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jaroslaw Rafa via mailop]

Dnia 15.09.2022 o godz. 17:42:47 John Levine via mailop pisze:
> 
> Speaking as a spammer, allow me to offer my deepest thanks for your help
> at tuning my techniques to evade your filters.

I knew that someone would bring up that argument ;)
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jaroslaw Rafa via mailop]

Dnia 15.09.2022 o godz. 22:34:50 Paul Smith via mailop pisze:
> 
> Arguing that "a rejection is better" makes sense *when the sender is human,
> technically competent and understands how email works*. Most senders don't
> fall into that category.

It's not me who argued that rejection is better. Rejection is equally bad
from my point of view, maybe even worse.

I already described what I think is best. Only *mark* messages as spam and
let the users decide if they want *themselves* filter the marked messages
into the spam folder. Don't *preconfigure* such filtering for them.

If someone creates a mail account, he/she won't be receiving spam right
away. At some point in time after setting up the account he/she will start
to receive spam, and one can expect that the amount of spam will gradually
increase. Then at some moment the user may decide to filter out the spam
into the spam folder.

I think (I may be wrong, of course - but if that won't work then nothing
will :() that there is bigger chance that the user will look into the spam
folder in case when he/she configured filtering messages into that folder
him/herself, than in the case when such filtering is preconfigured by the
mail provider and the user may even not be aware at all (and usually isn't)
of the purpose of the spam folder and why he/she should look into it. In the
former case the filtering happens visibly to the user and the user is aware
that it happens; in the latter, the filtering is "invisible" to the user and
may be totally unaware about it.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[John Levine via mailop]

It appears that Cyril - ImprovMX via mailop  said:
>-=-=-=-=-=-
>-=-=-=-=-=-
>
>So basically, what would be interesting to have is both : land the email in
>the spam folder but notify the sender about if, maybe via an ARF report ?

Speaking as a spammer, allow me to offer my deepest thanks for your help
at tuning my techniques to evade your filters.

R's,
John
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Paul Smith via mailop]

On 15/09/2022 21:30, Jaroslaw Rafa via mailop wrote:


folders. If it actually worked this way, spam folders wouldn't be any issue.
But this assumption failed: the reality is that 99% of users don't check
their spam folders at all, so directing a message to spam folder effectively
equals blackholing. The sender needs to communicate out-of-band anyway to
ask the recipient to check their spam folder.


Similarly, it can be argued that "99%" of senders don't check NDRs or 
don't use them to try to contact the recipient another way, so rejecting 
a message is functionally equivalent to blackholing as far as the 
recipient is concerned.


Arguing that "a rejection is better" makes sense *when the sender is 
human, technically competent and understands how email works*. Most 
senders don't fall into that category.


It may be argued that the sender knowing a message was rejected is 
better than them not knowing. But, for the recipient, a spam folder is 
much more useful than a rejection for messages sent by those "99%" of 
senders.


If someone asks for a password reset email, there are two options:
- the website pops up saying "we've sent you a message. If you don't 
receive it, check your spam folder". There's a reasonable chance of 
resetting your password today.


- the website pops up saying "we've sent you a message. If you don't 
receive it, open a ticket with whoever administers your email (which may 
be a faceless person at a service provider) and ask them to whitelist 
mail from our domain, wait 2 days for them to respond. Hopefully, they 
will approve that whitelisting, but if they don't, then tough. If they 
do approve it, then request a password reset email again. We hope your 
requirements weren't urgent. Have a nice day!"


Which do you think users would prefer?

Paul


--


Paul Smith Computer Services
Tel: 01484 855800
Vat No: GB 685 6987 53

Sign up for news & updates at http://www.pscs.co.uk/go/subscribe
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Grant Taylor via mailop]

On 9/15/22 2:51 PM, Cyril - ImprovMX via mailop wrote:
So basically, what would be interesting to have is both : land the email 
in the spam folder but notify the sender about if, maybe via an ARF report ?


I think this would be a slippery slope and leak information, akin to 
"your password is wrong" vs "your username or your password" is wrong.


I could see some benefit for enabling ARF (like) reports when there is 
evidence of bi-directional communications between two emailing parties. 
E.g. the candidate sent their application and a recruiter replied asking 
for more details.  This bidirectional pairing could serve as an 
indication that it's probably safe to send an ARF (like) report to the 
candidate without revealing too much information.


Maybe an algorithm as simple as up to one ARF to a sender per outbound 
message to them.  But, as they say, "there be dragons", related to many 
technical / procedural / policy details.




--
Grant. . . .
unix || die



smime.p7s
Description: S/MIME Cryptographic Signature
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jaroslaw Rafa via mailop]

Dnia 15.09.2022 o godz. 22:51:29 Cyril - ImprovMX via mailop pisze:
> So basically, what would be interesting to have is both : land the email in
> the spam folder but notify the sender about if, maybe via an ARF report ?
> That way, the event organizer or the one applying for a job would be able
> to notify the recipient about the email being in spam.

That would be probably the best solution.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Cyril - ImprovMX via mailop]

So basically, what would be interesting to have is both : land the email in
the spam folder but notify the sender about if, maybe via an ARF report ?
That way, the event organizer or the one applying for a job would be able
to notify the recipient about the email being in spam.

Le jeu. 15 sept. 2022 à 22:33, Jaroslaw Rafa via mailop 
a écrit :

> Dnia 15.09.2022 o godz. 11:32:41 Jay Hennigan via mailop pisze:
> >
> > If recipients at least periodically scan the contents of the spam folder
> and
> > mark wanted mail, this avoids the need for the sender to communicate
> > out-of-band to deliver the original (and likely future) messages as
> would be
> > the case with a rejection.
>
> I understand that was the whole assumption behind the concept of spam
> folders. If it actually worked this way, spam folders wouldn't be any
> issue.
> But this assumption failed: the reality is that 99% of users don't check
> their spam folders at all, so directing a message to spam folder
> effectively
> equals blackholing. The sender needs to communicate out-of-band anyway to
> ask the recipient to check their spam folder.
>
> Spam folder can work if the user is setting it up him/herself. That is, the
> provider's antispam system only tags the message as spam (in subject or
> another header) and the user must manually set up a filter to move tagged
> messages into spam folder. Because they set it up themselves, chances are
> they will look into it from time to time. If this is something that is
> preconfigured for them by the provider, they usually don't look anywhere
> else
> except the main inbox.
>
> Of course, training the filter by moving the messages in and out of spam
> folder will be harder to implement by the provider in this setup, but it is
> still possible to do.
> --
> Regards,
>Jaroslaw Rafa
>r...@rafa.eu.org
> --
> "In a million years, when kids go to school, they're gonna know: once there
> was a Hushpuppy, and she lived with her daddy in the Bathtub."
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Matthew V via mailop]

I'd love to know the research on this... 99% seems a bit far fetched.

Homer Simpson once said, “Oh, people can come up with statistics to 
prove anything, Kent. Forty per cent of all people know that.”


~MV

On 2022-09-15 4:30 p.m., Jaroslaw Rafa via mailop wrote:

the reality is that 99% of users don't check
their spam folders at all, so directing a message to spam folder effectively
equals blackholing.

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jaroslaw Rafa via mailop]

Dnia 15.09.2022 o godz. 11:32:41 Jay Hennigan via mailop pisze:
> 
> If recipients at least periodically scan the contents of the spam folder and
> mark wanted mail, this avoids the need for the sender to communicate
> out-of-band to deliver the original (and likely future) messages as would be
> the case with a rejection.

I understand that was the whole assumption behind the concept of spam
folders. If it actually worked this way, spam folders wouldn't be any issue.
But this assumption failed: the reality is that 99% of users don't check
their spam folders at all, so directing a message to spam folder effectively
equals blackholing. The sender needs to communicate out-of-band anyway to
ask the recipient to check their spam folder.

Spam folder can work if the user is setting it up him/herself. That is, the
provider's antispam system only tags the message as spam (in subject or
another header) and the user must manually set up a filter to move tagged
messages into spam folder. Because they set it up themselves, chances are
they will look into it from time to time. If this is something that is
preconfigured for them by the provider, they usually don't look anywhere else
except the main inbox.

Of course, training the filter by moving the messages in and out of spam
folder will be harder to implement by the provider in this setup, but it is
still possible to do.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Gellner, Oliver via mailop]

> Am 15.09.2022 um 16:43 schrieb Jaroslaw Rafa via mailop :
>
> Dnia 15.09.2022 o godz. 16:06:22 Cyril - ImprovMX via mailop pisze:
>> If I'm missing an email, I can simply check the Spam folder, which will be
>> faster (and less tedious) than reaching out to the sender for him to send
>> another copy (hoping it wasn't an automated email, otherwise I'm good to
>> wait on the support team to respond in a few hours at best ...)
>
> The problem is when you don't know someone sent you an email, and the sender
> doesn't have any other contact with you.
>
> Suppose you are organizing some event. You advertise it somewhere and include
> your email address for people who want to contact you with regard to
> organizational matters (for example if they want to help organize the
> event). Then someone sends you an email on that topic, but that email goes
> to the spam folder and you never see it.

Or another real world example: Someone applys for a job. After checking the 
application, a recruiter sends out an email to eg request additional documents. 
The applicant swiftly replies and sends the documents, however his reply is 
classified as spam and ends up in the spam folder of the recruiter - unnoticed.
After some time passes, the applicant asks about the current state of his 
application, only to find out that the job has been given to someone else 
because the company never received a reply from him.

If the spam filtering system of this company instead rejected emails classified 
as spam, the applicant would have immediately received a NDR and would have 
reacted on this for sure.

There are use cases for spam folders, some of which have already been mentioned 
in this discussion, however the problem I see with them is that they make email 
unreliable, meaning that you can never be sure whether your communication 
partner received your email or not.

—
BR Oliver


dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jay Hennigan via mailop]

Interesting discussion. I use spam folders, and typically look at them 
daily as far as scanning sender and subject.


One advantage of spam folders is that they can be used to train the 
algorithm. If wanted mail is found and flagged as "Not Spam" then that 
sender will be marked as safe and future mail from that sender will be 
delivered normally.


If recipients at least periodically scan the contents of the spam folder 
and mark wanted mail, this avoids the need for the sender to communicate 
out-of-band to deliver the original (and likely future) messages as 
would be the case with a rejection.


--
Jay Hennigan - j...@west.net
Network Engineering - CCIE #7880
503 897-8550 - WB6RDV
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Jaroslaw Rafa via mailop]

Dnia 15.09.2022 o godz. 16:06:22 Cyril - ImprovMX via mailop pisze:
> If I'm missing an email, I can simply check the Spam folder, which will be
> faster (and less tedious) than reaching out to the sender for him to send
> another copy (hoping it wasn't an automated email, otherwise I'm good to
> wait on the support team to respond in a few hours at best ...)

The problem is when you don't know someone sent you an email, and the sender
doesn't have any other contact with you.

Suppose you are organizing some event. You advertise it somewhere and include
your email address for people who want to contact you with regard to
organizational matters (for example if they want to help organize the
event). Then someone sends you an email on that topic, but that email goes
to the spam folder and you never see it.

It's something that has actually happened to me (as a sender). It was the
first time I learned that Gmail started to put my messages into spam folder
(as this wasn't happening previously, I was communicating with people on
Gmail without any problems). I offered my help in some organizational
aspects, but never got any reply. Only when I finally arrived at the event,
I learned from the person who was the organizer that she didn't get my
email. As I didn't get a reject, I asked her to check the spam folder and
she told me that the mail was actually there. If she would have read my
mail, we could arrange for the event to be much better than it was.
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Cyril - ImprovMX via mailop]

>
> I can second this


It's really interesting to (try) to follow all the discussions about spam
folder and in general if the oligopoly have truly won or not.

In this case, I'm bringing my grain of salt regarding the utility of the
spam folders. I believe they have a real purpose.
The issue here is in naming more than anything else. What annoys most the
people here is the term, "spam";

Gmail, by default, offers a few tabs acting has folders: "Primary",
"Social", "Promotions", ...
The spam folder is no more than another folder, except it's placed
elsewhere.

On top of that, the idea of having a spam folder is to remove the noise in
your inbox by providing a "best guess" at what is spam.
But since it is automated and can not be guaranteed to be 100% spam, the
availability of the spam folder let the end user decide if the spam is
indeed spam, or not.

I believe that having a spam folder is useful to avoid having to first
filter all my emails by removing the junk ones first, before reading the
important one.
If I'm missing an email, I can simply check the Spam folder, which will be
faster (and less tedious) than reaching out to the sender for him to send
another copy (hoping it wasn't an automated email, otherwise I'm good to
wait on the support team to respond in a few hours at best ...)

As long as checking emails for spam will be automated, with a possibility
for false positives, the spam folder will remain the best solution from an
end-user point of view.



Le jeu. 15 sept. 2022 à 15:26, Gellner, Oliver via mailop 
a écrit :

> Hello,
>
> > Am 14.09.2022 um 16:55 schrieb Thomas Walter via mailop <
> mailop@mailop.org>:
> > 
> > First of all: I am fed up with telling people to look for missing emails
> in their spamfolders.
> >
> > If I have to check a spamfolder for false positives every day, I can
> just have them delivered to my inbox. The spamfolder does not have an
> advantage then.
> >
> > Your user's opinion on that will change as soon as someone missed a bid
> or contract, because it hid in the spam folder :).
>
> I can second this, at least for personal emails. In my experience
> automatically redirecting all suspected emails to a spam folder comes close
> to the frowned upon blackholing of emails: The email is successfully
> accepted but not delivered to any inbox and not read or even noticed by
> anyone. For the users I work with, the vast majority does not check their
> spam folder, either due to lack of knowledge or because they don’t feel
> like wading through a list with 99% spam content. Therefore if the false
> positive rate of the spam filter is not zero, emails are lost.
>
> On the other hand if emails categorized as spam are rejected, the sender
> gets notified - similar to an out of office notification and at least has
> the chance to act on it. While users do not understand the non delivery
> reports, let alone are able to fix them, most of them realize that
> something did not work as expected when a lenghty error notification shows
> up in their mailbox after pressing the send button.
>
> For transactional emails it is a different story, because most systems
> sending out automated emails seem to live in a phantasy world and do not
> handle the case that emails are undeliverable. If such emails are rejected,
> the sending party often simply ignores the error and nothing ever happens.
>
> —
> BR Oliver
>
> 
>
> dmTECH GmbH
> Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
> Telefon 0721 5592-2500 Telefax 0721 5592-2777
> dmt...@dm.de * www.dmTECH.de
> GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
> Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher
> 
> Datenschutzrechtliche Informationen
> Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser
> ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in
> Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder
> sich bei uns bewerben, verarbeiten wir personenbezogene Daten.
> Informationen unter anderem zu den konkreten Datenverarbeitungen,
> Löschfristen, Ihren Rechten sowie die Kontaktdaten unserer
> Datenschutzbeauftragten finden Sie hier<
> https://www.dm.de/datenschutzerklaerung-kommunikation-mit-externen-493832
> >.
> ___
> mailop mailing list
> mailop@mailop.org
> https://list.mailop.org/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Benoit Panizzon via mailop]

Hi

> > First of all: I am fed up with telling people to look for missing emails in 
> > their spamfolders.
> >
> > If I have to check a spamfolder for false positives every day, I can just 
> > have them delivered to my inbox. The spamfolder does not have an advantage 
> > then.
> >
> > Your user's opinion on that will change as soon as someone missed a bid or 
> > contract, because it hid in the spam folder :).  

It looks like I missed the original email. Interesting topic we have
been pondering a lot a couple of years ago designing our ISP mail
platform.

I fully agree and that is the reason why our ISP email platform has no
spamfolder.

Basic principle of our solution: An email shall never disappear from
the users perspective.

An email delivered to the spamfolder, from the sender AND recipient
point of view, just disappears unnoticed until somebody is 'missing'
that email and actively looking for it. But then it might be too late
for an important email.

Furthermore, if you enable per domain (per organisation) catch-all
spamfolder where an admin is going (that won't be done) through those
emails to find false positive sent to anyone in that organisation, that
is a big NO NO from the privacy point of view.

We offer customer those settings if spam is detected:

* Reject (during SMTP handshake)
* Tag Subject
* Accept

So if an email is deemed spam and is a positive, the recipient is not
going to miss it or get bothered by having to look at it in the
spamfolder and the sender (probably a botnet anyway) is not going to
bother.

If this is a false positive, the sender, using a proper MTA which will
deliver an error message. The sender will know immediately this did not
work and take corrective actions.

And yes I can hear you shouting 'BUT!'

BUT if the email is tagged as spam in the subject, the recipient can
use that tag to filter them into a spamfolder with sieve or his mail
client => Customer Problem. Not caused by us as service provider.

BUT the sender will just ignore/delete the error message in case of a
false positive. => Again, sender problem, we did our best!

Mit freundlichen Grüssen

-Benoît Panizzon-
-- 
I m p r o W a r e   A G-Leiter Commerce Kunden
__

Zurlindenstrasse 29 Tel  +41 61 826 93 00
CH-4133 PrattelnFax  +41 61 826 93 01
Schweiz Web  http://www.imp.ch
__
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop

Re: [mailop] Reject vs spam folders

[Gellner, Oliver via mailop]

Hello,

> Am 14.09.2022 um 16:55 schrieb Thomas Walter via mailop :
> 
> First of all: I am fed up with telling people to look for missing emails in 
> their spamfolders.
>
> If I have to check a spamfolder for false positives every day, I can just 
> have them delivered to my inbox. The spamfolder does not have an advantage 
> then.
>
> Your user's opinion on that will change as soon as someone missed a bid or 
> contract, because it hid in the spam folder :).

I can second this, at least for personal emails. In my experience automatically 
redirecting all suspected emails to a spam folder comes close to the frowned 
upon blackholing of emails: The email is successfully accepted but not 
delivered to any inbox and not read or even noticed by anyone. For the users I 
work with, the vast majority does not check their spam folder, either due to 
lack of knowledge or because they don’t feel like wading through a list with 
99% spam content. Therefore if the false positive rate of the spam filter is 
not zero, emails are lost.

On the other hand if emails categorized as spam are rejected, the sender gets 
notified - similar to an out of office notification and at least has the chance 
to act on it. While users do not understand the non delivery reports, let alone 
are able to fix them, most of them realize that something did not work as 
expected when a lenghty error notification shows up in their mailbox after 
pressing the send button.

For transactional emails it is a different story, because most systems sending 
out automated emails seem to live in a phantasy world and do not handle the 
case that emails are undeliverable. If such emails are rejected, the sending 
party often simply ignores the error and nothing ever happens.

—
BR Oliver



dmTECH GmbH
Am dm-Platz 1, 76227 Karlsruhe * Postfach 10 02 34, 76232 Karlsruhe
Telefon 0721 5592-2500 Telefax 0721 5592-2777
dmt...@dm.de * www.dmTECH.de
GmbH: Sitz Karlsruhe, Registergericht Mannheim, HRB 104927
Geschäftsführer: Christoph Werner, Martin Dallmeier, Roman Melcher

Datenschutzrechtliche Informationen
Wenn Sie mit uns in Kontakt treten, beispielsweise wenn Sie an unser 
ServiceCenter Fragen haben, bei uns einkaufen oder unser dialogicum in 
Karlsruhe besuchen, mit uns in einer geschäftlichen Verbindung stehen oder sich 
bei uns bewerben, verarbeiten wir personenbezogene Daten. Informationen unter 
anderem zu den konkreten Datenverarbeitungen, Löschfristen, Ihren Rechten sowie 
die Kontaktdaten unserer Datenschutzbeauftragten finden Sie 
hier.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop