Comment by petercooper | Hacker News Reader

Comment by petercooper | Hacker News Reader

It's amazing how little sender reputation can count for with Gmail in the face of other features, however. I have a good reputation as a sender but also send almost a million mails a month and I spend a lot of time investigating oddities in Gmail deliverability.

All of my mails are newsletters containing 10-30 links, and more than once I've found the mere inclusion of a single link to a certain domain can get something into spam versus a version without that link, often with no clear reason why (domains that are particularly new are one marker, though). Or.. how about using a Unicode 'tick' symbol in a mail? That can get a reputable sender into Spam versus a version without the same single character (all double tested against a clean, new Gmail account) :-) Or how about if you have a link title that includes both ALL CAPS words and ! anywhere? Your risk goes up a good bit, but just go with one of them, you're fine..

I now have a playbook based around numerous findings like this, some based on gut feelings looking at the results and some truly proven, and even with my solid reputation as a sender, I'm having to negotiate a lot content-wise each week. But do I like it? Yeah, in a way, because it's also what stops everyone else being a success at it.. Gmail sets the bar high! :-)

(Oh, a bonus one.. include a graphic over a certain size? Your chance of ending up in the Promotions folder just leapt up. Remove it, you're good. It doesn't seem to be swayed much by actual content. So I've stopped using images where at all possible now and open rates stay up because of it.)

I think the author has developed too much the kind of thinking he needed to fight spam at regular e-mail companies.

I think there could be multiple, relatively easy methods to avoid encrypted spam.

Someone here already suggested the first email being a "poke". And only if you send a poke back, would that user be allowed to send you an e-mail.

The user could also have some description about him, from his profile, appear when you hover over his profile image or whatever. If you receive an e-mail say from a company you're expecting to receive email from, then you could poke back, so they can send you that email. I mean there should be ways to make it easy for people to know who's a total stranger that could be a spammer, or someone trying to reach out to them for good reasons.

Then you could also have the emails under different labels by default. All the trusted e-mails would come to the regular Inbox, while the rest will go under a different label.

As you said, the email provider could also see the user's reputation over time, and if he's a spammer or not.

And these are just some easy solutions we can come up with almost immediately. I'm sure there can be others with a little bit more thought put into it. I certainly don't see encrypted email as some kind of "doomsday scenario" like the author predicts in the post.

This mechanism would cause so much phishing that a whole new type of war would begin based on it.

Actually the "poke" method would work and I suggested it on a different thread on that mailing list. It's the S/MIME model although these days you'd just stick an ECC key into a header and sign it with DKIM, then upgrade the clients. Doesn't have to be technically complicated.

There are at least three major downsides:

1) You still leak lots of metadata and the full data of the poke including most obviously the subject line.

2) Do users understand that their spangly new "encrypted mail" actually fails to protect a lot of important data? What if they (gasp) came to rely on it? I'd want to see usability studies showing a clear understanding of what is protected and what isn't.

3) You break other features that rely on the server being able to see content, like search, and the ads that pay for all of this.

Google does a little of this already although the mechanism is not as direct as your version. E-mail from certain senders gains "importance" based on your interactions with that sender, such as if you'd first sent a mail to that address, if you'd ever replied to that address, if you open a certain amount of mail from that address, etc. Mail from senders considered "important" is then more likely to hit your inbox.

It seems to work reasonably well, although there are some interesting ways you can game it. One I learnt from the Internet marketing world was some list builders (using legit methods, but perhaps promoting things that often get caught by spam filters) hire people or implement techniques to encourage new list signups to reply to mails sent from the same address as the list by asking them questions, etc.

How are pokes different to regular challenge response whitelists, and how does poking avoid the problems of CR?

Gmail deliverability and rendering is the new IE6.

I'd say GMail deliverability is the new SEO - as long as you're honest, kind, and don't try to cheat/abuse people, you'll be fine.

Can you share that playbook? In particular the truly proven findings?

You think spammers aren't going to read it too?

I suspect that spammers already have their own.

My real suggestion is that you share this play book and the spammers stop doing those things, making it worthless.

I need to codify it as it's just notes and numbers scattered across experiments for now, but it's something I plan to do as I want to blog about each example (along with all of the other weird things I've learnt in the e-mail business so far).

I realized I should add a note, however, that everything I've said only applies to bulk e-mail (and sent through systems with a reputation for such) and not transactional or manual e-mail which suffers from fewer oddities for obvious reasons.

make it an ebook and you might get some money out of it ;)

Reply on news.ycombinator.com