Re: Email Reputation. (Was: inconsistent behavior of " to separate arguments)

[Ralph Corderoy]

Hi Ingo,

> > Adding SPF can normally be done without much disruption and will
> > help the reputation of emails from usta.de.
> > https://en.wikipedia.org/wiki/Sender_Policy_Framework
>
> It's a feature that you can use varying mail servers to submit email
> messages, not a bug.

And SPF doesn't prevent that.

> SPF is a misguided idea that breaks email interoperability.

No, it declares in DNS for a domain the servers which handover email
from that domain along with an indication of whether it's a `hard' or
`soft' failure if an email comes from a server not listed.  It doesn't
affect the `interoperability' of email systems at all.  The recipient is
allowed to use the lack of SPF, or the SPF declaration, when they rank
the email's ham-iness.

> The usta.de domain has hundreds of active users.  How should the
> usta.de mail administrators know which mail servers all those users
> want to use?

usta.de could tell their users to hand emails from usta.de to one of
their servers for delivery to increase the email's reputation and the
reputation of usta.de as a whole.  Yes, this does mean emails which are
typically unencrypted would pass through their hands on being sent.
Then again, most people top-post replies, quoting all the original text,
and send that back to the usta.de so they would often see the text then
anyway.

I tried some British, French, and German universities off the top of my
head.  All publish SPF records.

    $ dig +short ic.ac.uk. txt | grep spf
    "v=spf1 include:_spf.imperial.ac.uk ~all"
    $ dig +short ox.ac.uk. txt | grep spf
    "v=spf1 redirect=_spf.ox.ac.uk"
    $ dig +short cam.ac.uk. txt | grep spf
    "v=spf1 include:mx.cam.ac.uk include:spf.protection.outlook.com ?all"
    $ dig +short sorbonne-universite.fr. txt | grep spf
    "v=spf1 include:spf1.acces-neovote.com include:lip6.fr
    include:spf.oximailing.com include:_spf.activetrail.com
    include:spf.cap-collectif.com include:spf1.sorbonne-universite.fr
    ?ALL"
    $ dig +short uni-bonn.de. txt | grep spf
    "v=spf1 ip4:131.220.15.112 ip4:131.220.15.113 ip4:131.220.15.212
    ip4:131.220.15.213 ip4:131.220.116.75 ?all"

As does kit.de which I think is associated with usta.de.

    $ dig +short kit.de. txt | grep spf
    "v=spf1 mx a ip4:91.203.200.33 include:_spf.strato.com
    include:spf.protection.outlook.com include:servers.mcsv.net -all"
    $

> While many of those users are located at the University of Karlsruhe,
> not all are, and even for those here in Karlsruhe, it is a feature
> that you can use your usta.de sender address even when using a foreign
> SMTP server for sending mail.

Perhaps rather than a feature it is just how things used to be before
spam became a problem and domain reputation was part of the recipient's
judgement and usta.de never moved with the times.

> What would you think if you put a paper letter into a pillar box in
> Edinburgh and the letter got shredded instead of delivered merely
> because you wrote a London sender address on the envelope instead of a
> sender address located in Edinburgh?

I'd think the SNP have recently nationalised the Scottish postal system
so pillar-box collections are still functioning for the moment.  ;-)

> I think people who value receiving legitimate email just don't use
> Google mail.

I don't use it.  I prefer to receive all mail.  Until a few months ago,
my MX supplier did just that.  They have recently started rejecting some
emails at the SMTP stage which is annoying.  I know this because some of
those emails are from me at various Internet servers!

> Google is obviouly attempting vendor lockin on the email ecosystem in
> general.

You've wandered off the topic of SPF which isn't a Google invention.
Many organisations, large ones right down to an individual and his Exim
server, use SPF to help judge incoming email.  It's one tool against the
modern annoyance of spam.

> By deliberately making email from non-gmail (including non-commercial
> and academic domains) unreliable, they try to coax as many people as
> they can into using their commercial services.

I just think their code is poor.  The bulk of the DKIM signed-and-valid
spam I receive is from gmail.com, say ten a day.  All sent off by me to
the black-hole which is abuse@gmail.com.  I might get one spam from
outlook.com a week, in comparison.  The emails from Gmail are obviously
spam but if Gmail can't spot they're sending spam then I don't expect
them to do well on the receiving side either.  I think Gmail have long
rested on their laurels, though that does allow competitors like
https://www.hey.com to appear.

> I usually ignore Google mail users who whine that the service provider
> they picked doesn't work for them, but since you ask so explicitly,
> maybe it's worth explaining again.

I'm not a Gmail user, and I didn't whine.  I pointed out a deficiency in
what I assumed was a small one-man domain name's set-up.  :-)

-- 
Cheers, Ralph.