Hacker News new | ask | show | jobs
by oelmekki 2850 days ago
Just to be clear, if we don't implement SPF on our domain names, our mails will be rejected by gmail, right?

If that's so, this is purely a theoretical discussion (which has its own merits, of course).

1 comments

I don't believe Gmail rejects automatically for missing SPF records. It may be a significant hit to the spam score, but it's still technically optional.
My experience is anything less than SPF, DKIM and DMARC results in Gmail silently dropping messages. Also, HTML mail with inline images similarly causes Gmail to drop.

And forget about sending from a DO Droplet due to poor IP reputation. A friend of mine at an ISP confirmed their third party SPAM scoring provider (like Symantec/ Brightworks) gives them a list of IPs to block at the edge, which includes large swaths of DO’s IP blocks. Not sure what the story is for other low-end VPS providers like Linode, etc.

Testing deliverability has become completely absurd. Every ISP and ESP has a completely different method for mail rejection. And thanks to outsourcing options for SPAM scoring, is subject to change at a moment’s notice.

This is a glaring omission in all Net Neutrality discussions I’ve seen, the ability to simply communicate an order acknowledgement to a customer. Even outsourcing to Mailgun, SendGrid or the like is no silver bullet for this issue, you’ll still have interruptions in delivery because every day some spammer gets through their checks and trashes that shared IP you’re sending from. And probably you’re having unnoticed delivery failures because someone else reported it / got it fixed. Renting a dedicated IP isn’t really a solution because you have to send from IPv4 to reach the guy who is still doing email @hisdomain.com and doesn’t even know IPv6 is a thing. And IPv4 addresses are in short supply.

Correct. I can say for sure that Gmail does not reject for missing SPF records, I send voicemail-to-email messages from VoIP systems with no DNS records all the time.

Gmail will accept anything that isn't actively failing anything, even spoofed nonexistant domains, but it will likely get flagged as spam.

If the host is the (or one of the) A/AAAA records for the From domain it'll generally not flag as spam.

If the host is not, then SPF records are required to be reasonably confident it won't get flagged.

Office 365 is a bit pickier and Yahoo is a pain in the butt. Fortunately I deal with mostly business systems so telling the end user "stop using Yahoo for your company voicemails" is reasonable.

I see, thanks. I had the experience of having some mails ending in gmail spam box until we added SPF, but we were a young company (and thus, domain name), and it was in 2014. I wouldn't feel confident recommending not using SPF to anyone, though :)