I’m seeing a significant amount of chatter on various lists that queues to Comcast are backing up right now. Looks to be something on their end.
Error messages are 421 “Try again later.” I’ll see if I can find someone at Comcast to give me some info.
This morning (9 or 10 am Pacific) my various mailing lists were lighting up with questions about Yahoo delays. A lot of people reported they were seeing Yahoo respond “420 Resources Unavailable, try again later” on connect.
What everyone wanted to know was is if other senders were seeing this.
The answer was a resounding YES.
And, in fact, Yahoo commented on Facebook around 2pm Pacific that they had a mail outage and were trying to bring services back up before close of business today.
As with many things, the Internet rumor mill is one of the fastest and astonishingly accurate sources of information about mail servers falling over.
I started hearing reports that queues were clearing mid-afternoon pacific, but not everyone is seeing that.
So, yes, Yahoo is having a bad day. And it’s not you, it’s not spam, it’s just that some of their mail servers fell over and they’re struggling to accept all the mail headed their way.
It happens.
If you’re interested in hearing more timely updates, I will often announce things like this on twitter when I hear about them.
Over on the DMARC-Discuss list, Comcast announced they had turned on DMARC validation and companies that publish DMARC records should start receiving reports from Comcast.
Read MoreComcast recently published a statement on DMARC over on their postmaster page. The short version is that Comcast is publishing a DMARC record, but has no current intentions to publish a p=reject policy for Comcast user email. Comcast will be publishing a p=reject for some of their domains that they use exclusively to communicate with customers, like billing notices and security notices.
Comcast does point out that Yahoo! and AOL’s usage of p=reject is “not common usage.”
This is something a lot of people have been arguing loudly about on various mail operations lists and network lists. DMARC is about organizational identity. In fact, I was contacted about my DMARC primer and told that I didn’t mention that it’s not about domains, it’s about organizations.
The way I read the DMARC spec, it is all about organizational identity. The underlying theme being that the domain name is linked to a particular organization and everyone using email at that domain has some official relationship with that organization. I’ve always read the spec mentally replacing organization with corporate brand. This was for brands and organizations that strictly control how their domains are used, who can use those domains and how the mail is sent with those domains.
I never expected any mailbox provider or commercial ISP to publish a p=reject message as it would just break way too much of the way customers use email. And it did break a lot of legitimate and end user uses of email. Many organizations have had to scramble to update mailing list software to avoid bouncing users off the lists. Some of these upgrades have broken mailbox filters, forcing endusers to change how they manage their mailboxes.
Even organizations see challenges with a p=reject message and can have legitimate mail blocked. At M3AAWG 30 in San Francisco I was talking with some folks who have been actively deploying DMARC for organizations. From my point of view anyone who wants to publish a DMARC p=reject should spend at least 6 months monitoring DMARC failures to identify legitimate sources of email. The person I was talking to said he recommends a minimum of 12 months.
This is just an example of how difficult it is to capture all the legitimate sources of emails from a domain and effectively authenticate that mail. For a mailbox provider, I think it’s nearly impossible to capture all the legitimate uses of email and authenticate them.
It remains to be seen if the other mailbox providers imitate Yahoo! and AOL or if they push back against the use of DMARC reject policies at mailbox providers. Whatever the outcome, this is a significant shift in how email is used. And we’re all going to have to deal with the fallout of that.