Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thank you for this insight, I agree with almost all of it.

As an e-mail services provider, I cannot or should inspect what my customers are sending. I can suspend them due to complaints of abuse but the damage is already done.

Same goes for tracking. I still say, block domain names, not IPs..



> As an e-mail services provider, I cannot or should inspect what my customers are sending. I can suspend them due to complaints of abuse but the damage is already done.

As an ESP, since you are letting customers send through your IP space, then a bad-apple can hurt the delivery of your other clients.

This is one of the big jobs that an ESP has. MailChimp, for example, has invested a ton of effort into detecting bad-apples as early as possible. (There are some really neat big-data techniques.) This is also why SES requires that you start with a smaller quota and build-up.

Some techniques:

* manually reviewing new clients before they send

* giving a new client a limited sending quota, so they build reputation with you over some time

* detect clients/campaigns with high complaints, high bounces, or low opens and take compliance action

* detect a partially-sent campaign with a high bounce rate and suspend it

* don't give any client an unlimited sending quota, so they can't hurt you too badly

> I still say, block domain names, not IPs..

There's a minimum amount of mail volume required to build a reputation. Many of your clients might not have this so they benefit from being lumped-in on an IP reputation.

I don't think IP blocking will ever go away, as it's an effective technique. The threat of an IP block also places some reasonable pressure on ESPs to police their client base.


I'm not sure you understand how IP blocking works and why it would be impossible to block domain names the same way.


EDIT: "I'm not sure you understand how IP blocking works and why it would be impossible to block domain names the same way."

If you mean that on the same server the e-mail IP and server hostname will be the same for all the domains, then yes I understand.

But filtering can be changed to achieve domain level validation, not IP. It is done already on our servers.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: