No More Outgoing Email Spam Problems
Ok, I think I finally fixed it.
Since 2017, I’ve been having outgoing email spam problems. At one point, I’m sorry to say, malicious actors were sending 50,000 emails per day from @lee.org. I’ve been wrestling with the tools that stop stuff like that from happening. How did I finally fix it? Until last month, my email was hosted at Dreamhost.com and it forwarded to my free Gmail account. Now, it goes straight to a ($6/month) Google Workspace account.
I’ve only moved email over, not all the other google services but so far the move is successful.
Pluses:
- I can send email and expect people to get it!
- My spam folder is now seeing 10 spams/day instead of 100. I guess the paid account is smarter. Not having to wade through that crap monthly for the inevitable non-spam is well worth $6/month!
Minuses:
- I’m now 1/2 in Gmail and 1/2 in Google Workspace and fixing that will take some more effort
- Right now I’m keeping my contacts in Gmail (for my phone and Google Voice) and a not-often-updated copy in Google Workspace (for my email) :-(
- Switching Calendar will be a bother since I’ve got like 20 shared calendars and fiddly defaults to set up.
- Switching to Google Workspace Google Voice will be $10/month which I’m hesitant to do since it’s free right now
- Migrating my 30k emails took 3 days and a learning curve but it’s done!
- I’ll have to migrate my beloved Boomerang for Gmail manually
- Setting up DKIM for my email wasn’t hard per se but took some thinking and clicking
Some tools to test the spamminess of your domain:
- Mail-Tester.com
- MXToolbox.com
- toolbox.googleapps.com
- DMARC Quarantine vs. DMARC Reject: Which Should You Implement?
- Valimail.com DMARC tools
- Dmarcian.com DMARC tools
Here’s a big snippet from a conversation I’m having with a kind soul who showed me the headers of a spoofed email allegedly from info@lee.org that fell into his spam folder.
>i got it on the spam folder,
Ah! That is an important distinction!
When you get spam from a university, it’s probably them not listening to your preferences. But in this case, there is a bad actor sending out spoofed emails that purport to be from info@lee.org. But they aren’t really coming from lee.org! Hmm, let me ramble a bit here…. I was -going- to say that there isn’t anything I can do to stop emails from coming from a spoofed address. That’s mostly true. What the email tools (SPF, DKIM, DMARC) do is make it so that emails from spoofed senders don’t get any “love” from the actual domain holder. So, in this case, spoofed email “from” info@lee.org goes straight to your spam folder. But my email gets the “love” and doesn’t go to spam.
But hey! I have my DMARC set to “reject”. That should tell your mail server to throw away emails that don’t get any love. But it’s not doing that! Instead, it’s putting them in your spam folder! Your mail host… Gmail… isn’t following the mail standard! That’s not right!
Ugh.
This shit never ends.
Ok, digging more…. I see in the headers from the email you sent me “dmarc=fail (p=REJECT sp=REJECT dis=QUARANTINE)” What does that mean? It means:
– p=reject – I said that you should reject messages claiming to be from @lee.org!
– sp=reject – I said that you should reject messages claiming to be from any subdomain of @lee.org!
– dis=quarantine – “dis” stands for “disposition” – what your mail host ACTUALLY did with it. It quarantined (aka put in spam folder) the message. Why?!?!?!?! Argh!!!! I TOLD IT to reject it but it quarantined it!