Heads up: GMail regularly marking list messages as spam

Heads up: GMail regularly marking list messages as spam

[Mike Castle]

If you read the list via GMail, you may want to regularly check your
Spam label for messages from the git list.

I'm not sure what's up with that.  A handful of real spam had made it
through vger, but GMail seems to be hitting a fair number of false
positives lately.

Sometimes it is just one message in a patch set.  Others, it is whole
sets of patches.  I didn't check to see if there was anything in
common across the messages.  Maybe if anyone has a large batch, they
can check?

It would be interesting to see if this affects domain specific users
as well (e.g., Google itself).

Cheers,
mrc

RE: Heads up: GMail regularly marking list messages as spam

[rsbecker]

On Monday, August 12, 2024 11:10 AM, Mike Castle wrote:
>If you read the list via GMail, you may want to regularly check your Spam label for
>messages from the git list.
>
>I'm not sure what's up with that.  A handful of real spam had made it through vger,
>but GMail seems to be hitting a fair number of false positives lately.
>
>Sometimes it is just one message in a patch set.  Others, it is whole sets of patches.
>I didn't check to see if there was anything in common across the messages.  Maybe
>if anyone has a large batch, they can check?
>
>It would be interesting to see if this affects domain specific users as well (e.g.,
>Google itself).

What I think you will find is that some spammers use this mailing list to send spam.
Most of it gets blocked because it is in HTML or RTF. However, various honey-pots
and organizations like SpamCop detect the mailing list servers as the source of spam
so the servers get black-listed or marked as spam. Unless the servers themselves
filter out spam before redistributing it, this is going to keep happening.

Re: Heads up: GMail regularly marking list messages as spam

[Konstantin Ryabitsev]

On Mon, Aug 12, 2024 at 08:10:23AM GMT, Mike Castle wrote:
> If you read the list via GMail, you may want to regularly check your
> Spam label for messages from the git list.
> 
> I'm not sure what's up with that.  A handful of real spam had made it
> through vger, but GMail seems to be hitting a fair number of false
> positives lately.

Gmail is using internal spam training on all mail that it receives.
Unfortunately, mailing list traffic like that on the git list falls
way outside what is "normal," and this tends to trigger false-positives.

> Sometimes it is just one message in a patch set.  Others, it is whole
> sets of patches.  I didn't check to see if there was anything in
> common across the messages.  Maybe if anyone has a large batch, they
> can check?

Most of the time it's super unhelpful:

    Why is this message in spam?

    It is similar to messages that were identified as spam in the past.

Sometimes it's something specific:

    Why is this message in spam?

    Lots of messages from xxxxx.msg.chrl.nc.charter.net were identified as
    spam in the past.

This isn't really anything to do with vger.kernel.org -- we are complying with
all Gmail "bulk mail sender" requirements and we try our best to deny spammers
early. Unfortunately, my general recommendation is not to use Gmail for this
kind of work.

-K

Re: Heads up: GMail regularly marking list messages as spam

[brian m. carlson]

[-- Attachment #1: Type: text/plain, Size: 1434 bytes --]

On 2024-08-12 at 15:10:23, Mike Castle wrote:
> If you read the list via GMail, you may want to regularly check your
> Spam label for messages from the git list.
> 
> I'm not sure what's up with that.  A handful of real spam had made it
> through vger, but GMail seems to be hitting a fair number of false
> positives lately.
> 
> Sometimes it is just one message in a patch set.  Others, it is whole
> sets of patches.  I didn't check to see if there was anything in
> common across the messages.  Maybe if anyone has a large batch, they
> can check?
> 
> It would be interesting to see if this affects domain specific users
> as well (e.g., Google itself).

Gmail and Yahoo have both set up new requirements for senders[0].  This
requires that all senders have SPF and DKIM, and senders sending more
than 5000 messages per day have DMARC set up.  One-click unsubscribe in
RFC 8058 is also obligatory, as is TLS for sending messages.  These
changes came into effect in February 2024.

I don't believe vger uses DKIM (at least, it doesn't appear to add DKIM
headers) and doesn't support RFC 8058 one-click unsubscribe.  Perhaps
adding support for those, as well as any other relevant requirements,
would improve things.

[0] https://support.google.com/a/answer/81126?sjid=9729987135322685176-NC&visit_id=638590935924706038-3386441869&rd=1
-- 
brian m. carlson (they/them or he/him)
Toronto, Ontario, CA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 262 bytes --]

Re: Heads up: GMail regularly marking list messages as spam

[Konstantin Ryabitsev]

On Mon, Aug 12, 2024 at 09:16:56PM GMT, brian m. carlson wrote:
> Gmail and Yahoo have both set up new requirements for senders[0].  This
> requires that all senders have SPF and DKIM, and senders sending more
> than 5000 messages per day have DMARC set up.  One-click unsubscribe in
> RFC 8058 is also obligatory, as is TLS for sending messages.  These
> changes came into effect in February 2024.
> 
> I don't believe vger uses DKIM (at least, it doesn't appear to add DKIM
> headers) and doesn't support RFC 8058 one-click unsubscribe.  Perhaps
> adding support for those, as well as any other relevant requirements,
> would improve things.

These guidelines are only applicable if vger was the origin of the messages,
not a forwarder. For forwarders, it is only required to add ARC signatures:

https://support.google.com/mail/answer/175365?hl=en

The only thing we aren't doing is we're not adding X-Forwarded-To headers,
because mlmmj doesn't yet support it (should be in 1.5).

-K

Re: Heads up: GMail regularly marking list messages as spam

[brian m. carlson]

[-- Attachment #1: Type: text/plain, Size: 2126 bytes --]

On 2024-08-13 at 15:06:13, Konstantin Ryabitsev wrote:
> On Mon, Aug 12, 2024 at 09:16:56PM GMT, brian m. carlson wrote:
> > Gmail and Yahoo have both set up new requirements for senders[0].  This
> > requires that all senders have SPF and DKIM, and senders sending more
> > than 5000 messages per day have DMARC set up.  One-click unsubscribe in
> > RFC 8058 is also obligatory, as is TLS for sending messages.  These
> > changes came into effect in February 2024.
> > 
> > I don't believe vger uses DKIM (at least, it doesn't appear to add DKIM
> > headers) and doesn't support RFC 8058 one-click unsubscribe.  Perhaps
> > adding support for those, as well as any other relevant requirements,
> > would improve things.
> 
> These guidelines are only applicable if vger was the origin of the messages,
> not a forwarder. For forwarders, it is only required to add ARC signatures:
> 
> https://support.google.com/mail/answer/175365?hl=en

The article you linked still recommends DKIM.  In addition, the article
I linked doesn't appear to limit itself to non-mailing lists in any way.
It says, "email senders", and a mailing list sends emails.  In fact, it
explicitly mentions "[i]f you manage a forwarding service, including
mailing lists or inbound gateways," so it still appears to cover both
cases and apply to all senders, with only some additional requirements
applying to forwarding services.

In general, adding DKIM (whether or not ARC is supported) _will_
dramatically improve the deliverability of email in general, so it's a
win overall.  Adding one-click unsubscribe would also probably keep some
of those unsubscribe messages from hitting the list since people could
automatically use the functionality of their mail client to unsubscribe.

And from a personal point of view, it is definitely useful for me, as
someone who manages their own mail server, to heavily negatively score
all email without DKIM, but I can't do that because vger doesn't add
any.  That's the only thing preventing me from doing that.
-- 
brian m. carlson (they/them or he/him)
Toronto, Ontario, CA

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 262 bytes --]

Re: Heads up: GMail regularly marking list messages as spam

[Konstantin Ryabitsev]

On Tue, Aug 13, 2024 at 10:18:14PM GMT, brian m. carlson wrote:
> The article you linked still recommends DKIM.  In addition, the article
> I linked doesn't appear to limit itself to non-mailing lists in any way.
> It says, "email senders", and a mailing list sends emails.  In fact, it
> explicitly mentions "[i]f you manage a forwarding service, including
> mailing lists or inbound gateways," so it still appears to cover both
> cases and apply to all senders, with only some additional requirements
> applying to forwarding services.
> 
> In general, adding DKIM (whether or not ARC is supported) _will_
> dramatically improve the deliverability of email in general, so it's a
> win overall. 

Sorry, but this is not factually correct. Adding a DKIM signature to a message
where the From: lists a different domain has no impact on anything at all when
it comes to the chances of it being marked as Spam at google.

E.g. your message has:

    From: "brian m. carlson" <sandals@crustytoothpaste.net>

And it already has a DKIM signature for your domain. Adding another DKIM
signature for vger.kernel.org will serve no purpose, because there is no
alignment between "vger.kernel.org" and the domain in your From: address.

In fact, we do add a cryptographic signature, but in the ARC record:
https://lore.kernel.org/git/Zrvbpt3Fkl8yjesP@tapette.crustytoothpaste.net/raw

It's from the overlord subspace.kernel.org domain, but it doesn't need to
align with "vger.kernel.org".

> Adding one-click unsubscribe would also probably keep some
> of those unsubscribe messages from hitting the list since people could
> automatically use the functionality of their mail client to unsubscribe.

This is not possible without rewriting the From: header, which will break all
patches. We cannot modify the message content or any of the main headers that
are DKIM-signed (this bit is mentioned in the forwarder guidelines I linked
to).

> And from a personal point of view, it is definitely useful for me, as
> someone who manages their own mail server, to heavily negatively score
> all email without DKIM, but I can't do that because vger doesn't add
> any.  That's the only thing preventing me from doing that.

There is a small subset of active git mailing list posters who send mail that
is not DKIM-signed, for example Jeff King:

https://lore.kernel.org/git/20240813124550.GC968816@coredump.intra.peff.net/raw

However, signing their messages with a DKIM signature from vger.kernel.org
will serve no purpose, unless we also rewrite the From: to match the
vger.kernel.org domain. The From: field would need to be something like:

    From: Jeff King via Git Mailing List <foo+somemagic+peff.peff.net@vger.kernel.org>

This is called "From-munging" and is not acceptable on any mailing list that
sends and receives patches, because this changes the Author of the patch.

Thing is, this has nothing to do with vger, because if Jeff emails you
directly and you set a high negative score for messages without a DKIM
signature, you won't get his mail either. The fact that it traversed or didn't
traverse vger.kernel.org has no impact on that.

-K

Re: Heads up: GMail regularly marking list messages as spam

[Jeff King]

On Tue, Aug 13, 2024 at 08:10:17PM -0400, Konstantin Ryabitsev wrote:

> > And from a personal point of view, it is definitely useful for me, as
> > someone who manages their own mail server, to heavily negatively score
> > all email without DKIM, but I can't do that because vger doesn't add
> > any.  That's the only thing preventing me from doing that.
> 
> There is a small subset of active git mailing list posters who send mail that
> is not DKIM-signed, for example Jeff King:
> 
> https://lore.kernel.org/git/20240813124550.GC968816@coredump.intra.peff.net/raw

Uh oh, now I feel singled out. ;)

It's true that I use only SPF but not DKIM. FWIW, I haven't had a huge
problem with deliverability. But if the world is ready to move on and I
am one of the last dinosaurs holding things up, I'm OK to be told that I
really ought to implement DKIM to participate in the list.

> However, signing their messages with a DKIM signature from vger.kernel.org
> will serve no purpose, unless we also rewrite the From: to match the
> vger.kernel.org domain. The From: field would need to be something like:
> 
>     From: Jeff King via Git Mailing List <foo+somemagic+peff.peff.net@vger.kernel.org>
> 
> This is called "From-munging" and is not acceptable on any mailing list that
> sends and receives patches, because this changes the Author of the patch.
> 
> Thing is, this has nothing to do with vger, because if Jeff emails you
> directly and you set a high negative score for messages without a DKIM
> signature, you won't get his mail either. The fact that it traversed or didn't
> traverse vger.kernel.org has no impact on that.

Yep, agreed with all of that.

-Peff