Ask HN: Has Gmail spam blocking taken a sudden nosedive?
I woke up this morning to find five obviously spam emails in my Gmail inbox. In the preceding decade of using Gmail, I don't believe even a single one has made it past the spam filter, so I'm quite curious what could be causing the sudden influx. These aren't some cleverly crafted ones either, subject lines include:
𝐘𝐨𝐮𝐫'𝐥𝐨𝐚𝐧-𝐢𝐧𝐯𝐢𝐭𝐚𝐭𝐢𝐨𝐧_for_up to$𝟓𝟎,𝟎𝟎𝟎'. (sent from noreplay.loanpro@gmail.com)
Roundup-Lawsuit..See if YouQualify LRT. (sent from emily.roundpro@gmail.com)
Welcome-To_CarShield (sent from thanhngan1878@gmail.com)
42 comments
[ 3.3 ms ] story [ 102 ms ] threadPersonalLoanforYou (sent from Personal Loan Pro <pedrojoilmaantonio@gmail.com)
𝐃𝐨𝐧'𝐭 𝐥𝐞𝐭 𝐡𝐢𝐠𝐡_𝐈𝐧𝐭𝐞𝐫𝐞𝐬𝐭 𝐃𝐞𝐛𝐭 𝐑𝐮𝐧𝐔𝐩 𝐓𝐡𝐞 𝐬𝐜𝐨𝐫𝐞 (sent from Personal Loan <xarthostalorr@gmail.com>)
The common thread appears to be that they are sent from gmail addresses. It could be that they are using a tool like Gmass (https://www.gmass.co/) that lets you send bulk email from Gmail by batching them in groups of 500 per day. Mail originating from Gmail must have a lower spam flag rate.
I cannot conceive of any legit use case that would result in that pattern, which it appears both O365 and Gmail are fine with.
Not only can Google require it, they already have done something similar with Chrome ratcheting warnings to force HTTPS on the web in just a few years.
Either you've gotten lucky or not as much e-mail verifies as you think. A lot of very legitimate e-mail is without DKIM, I'd say it's approx 50:50.
> Not only can Google require it, they already have done something similar with Chrome ratcheting warnings to force HTTPS on the web in just a few years.
They only have Gmail, not a near-monopoly of the e-mail market.
Personal communications come from users of legitimate email services with DKIM. Legitimate commercial email comes from mail servers with DKIM for deliverability. Theonly email I get that doesn't verify is spam. I doubt my experience is out of the ordinary for US users.
> They only have Gmail, not a near-monopoly of the e-mail market.
They have effectively similar dominance in email because nearly 100% of mail servers have to send to Gmail users, just as nearly 100% of web servers have to serve Chrome users.
It's absolutely ordinary, but so is the opposite. Considering that DMARC is either-and, a lot of companies only employ SPF to reduce access and burden of updating DNS for DKIM keys for large amounts of senders.
Generally it seems like a few more things can get through, compared to 10+ years ago. I'm thinking just bugs sneaking in the codebase over a long period of time.
I get plenty of Russian spam because I visited Russia and connected to the free wifi of the airport. Apparently the list of people connecting to wifi (or someone who they're reselling their data to) is easily hackable.
Somehow they evaded Google for a long time. For a period they were pretty successful with Google Drive / Google Calendar invitations containing spam, but Google blocked them - then I got a string of emails. After a bit of flagging I stopped seeing them.
I also get some false positives flagged as spam so I started keeping my spam folder clean, so I can inspect what spam I receive and whether it's spam or just a service Google doesn't like.
I interact with people at Yandex and their emails often end up in spam, no idea why. They're perfectly legit mails.
Some forums also are regularly ending up in spam.
If you had used the Gmail '+' trick on the address you used, you could have proven whether this was the case. If so, stopping any more of it would also be as easy as setting up a filter to delete all inbound email to that '+' variation.
Then suddenly in maybe mid-December, an absolute flood started. I started getting at least 100 messages every day in Spam. Many of them were similar to each other, and nearly all of them were obvious spam like you say.
In the last week or two, the volume has decreased again to maybe 10-25 per day. I don't know if the spammers slowed down or Google tweaked something.
---
Also, does Gmail route some spam to /dev/null and other spam to Spam? I somehow have the impression that it does.
That is, rather than doing a basic 2-way categorization (non-spam -> Inbox, spam -> Spam), it could be doing a 3-way categorization (non-spam -> Inbox, confidently spam -> Spam, undoubtedly spam -> /dev/null).
If so, I wonder if the issue could be with the confidently vs. undoubtedly categorization rather than necessarily an increase in total spam.
Very likely. O365 does and I'm quite certain many others as well.
They might be accepting mail that never shows up in your account as well, I don't know for sure.
> Our team is working on this issue. Meanwhile, have a look at this article to mark the emails as spam in Gmail
https://twitter.com/gmail/status/1480816476458262530
I do know I now get 3-4 obvious spam mails landing in my actual inbox. This started maybe three months ago.
Never happened before.
Currently, the block button parks the emails in the spam folder. And I wake up every day to 3 emails from Chopra.com, and 5 from ICICI, in my spam folder. Even though it's the spam folder, it's still draining.
𝐘𝐨𝐮𝐫'𝐥𝐨𝐚𝐧-𝐢𝐧𝐯𝐢𝐭𝐚𝐭𝐢𝐨𝐧
https://qaz.wtf/u/convert.cgi
𝕾𝖕𝖍𝖎𝖓𝖝 𝖔𝖋 𝖇𝖑𝖆𝖈𝖐 𝖖𝖚𝖆𝖗𝖙𝖟, 𝖏𝖚𝖉𝖌𝖊 𝖒𝖞 𝖛𝖔𝖜.
I cut a support ticket to the university IT team, asking if they had turned off spam filters or something. It just seemed very unlikely Gmail would not detect them as spam. I think it's gotten better recently, but I don't open that account a lot since I avoid Google like the plague.
EDIT: to add to that, many of them had subjects that started with a green heart emoji. I was super disappointed that Gmail didn't let me create a filter based on that to at least delete them.
My email is an 20 year old alias @verizon.net address accessed using AOL Mail web site and Yahoo servers.
I can’t imagine how these are slipping through, particularly with the consistent random characters at end of the subject line.
What gives??