Dealing with compromised user accounts
M3AAWG is on a roll lately with published documents. They recently released the Compromised User ID Best Practices (pdf link).
M3AAWG is on a roll lately with published documents. They recently released the Compromised User ID Best Practices (pdf link).
Yes, it’s true. Gmail announced last Thursday at M3AAWG that they were piloting a new Feedback loop.
The Gmail FBL is currently for ESPs only. The announcement during MAAWG was that only MAAWG ESP members were eligible. They are requiring a DKIM signature for the FBL, but ESPs using individual customer d= values can get a FBL based on IPs. They are also not providing ANY information that reveals the complainer. Gmail’s intention is only to give ESPs feedback so that ESPs can prevent abuse. They are not giving feedback so complainers can be removed.
The email has a .csv attachment that has 3 columns: date, identifier and complaint rate.
The identifier is an ESP provided customer identifier. One of the ESPs I talked to said they were adding an X-header into their emails.
I’ve heard from beta testers that there is a minimum of 100 complaints before you’ll get any report.
Reports are sent daily if there is sufficient traffic to trigger them.
If you’re a MAAWG member, check the senders list for the signup URL.
Next week is M3AAWG 30 in San Francisco. We’ll be there and are very excited to see the familiar faces and meet new people.
I recently had someone ask me what would I recommend to someone going to their first M3AAWG conference. My recommendation to anyone in the sender or marketer space is to go to some of the talks that are not about email delivery. Go to the sessions that talk about malware or SMS or anything other than just email delivery. For anyone in the ISP space go to a session focused on mobile or email sending. Use this time to learn about something totally different than what you do every day.
Another question I get frequently from senders is if the people from the ISPs are open to sitting down and talking with senders about the senders’ email problems. Generally, the answer is no. Most of the time, the ISP has no knowledge of who you are and what mail you’re sending, so all they can say is “send me an email with the IPs and I’ll take a look at it.” That’s it.
We’ll be in the city starting Monday afternoon, and I always enjoy meeting readers. Stop by and introduce yourself.
J.D. Falk was one of the first names I encountered when learning how to read headers and report spam back in the mid-90s. He was one of the folks leading the fight against spam and actively trying to improve the Internet. When I was hired by MAPS I got to work with J.D. and a number of other big-names. One of the things that really surprised me was that this “internet elder” I had imagined was younger than me and with much bluer hair.
After MAPS imploded, J.D. and I carved out separate careers. He went to work at a number of major mailbox providers and I started delivery consulting. Our paths crossed occasionally, usually at conferences, but we also were on a number of mailing lists together. I kept an eye on J.D and his impact on email delivery. In fact, J.D. was responsible for a lot of the modern anti-spam techniques implemented at ISPs.
Eventually, he moved to Return Path where he worked on their Receiver Support group; even as he continually argued against the false sender / receiver dichotomy that so many people endorse.
M3AAWG, with financial support from Return Path, created the J.D. Falk award to recognize people who work to create a better online world. Nominations for the 3rd annual J.D. Falk award are now open. The M3AAWG website has more details.