Marketing automation plugins facilitate spam

There’s been an explosion of “Google plugins” that facilitate spam through Gmail and G Suite. They have a similar set of features. Most of these features act to protect the spammer from spam filtering and the poor reputation that comes from purchasing lists and incessantly spamming targets. Some of these plugins have all the features of a full fledged ESP, except a SMTP server and a compliance / deliverability team.
I’ll give the folks creating these programs credit. They identified that the marketers want a way to send mail to purchased lists. But ESPs with good deliverability and reputations don’t allow purchased lists. ESPs that do allow purchased lists often have horrible delivery problems. Enter the spam enabling programs.
From the outside, the folks creating these programs have a design goal to permit spam without the negatives. What do I mean? I mean that the program feature set creates an environment where users can send spam without affect the rest of their mail.
The primary way the software prevents spam blocking is using  Google, Amazon or Office 365 as their outbound mail server. Let’s be frank, these systems carry enough real mail, they’re unlikely to be widely blocked. These ISPs are also not geared up to deal with compliance the same way ESPs or consumer providers are.
There seem to be more and more of these companies around. I first learned of them when I started getting a lot of spam from vaguely legitimate companies through google mail servers. Some of them were even kind enough to inform me they were using Gmail as their marketing strategy.

I didn’t realize quite how big this space was, though. And it does seem to be getting even bigger.
Then a vendor in the space reached out looking for delivery help for them and their customers. Seems they were having some challenges getting mail into some ISPs. I told them I couldn’t help. They did mention 3 or 4 names of their competitors, to help me understand their business model.
Last week, one of the companies selling this sort of software asked me if I’d provide quotes for a blog article they were writing. This blog article was about various blocklists and how their software makes it such that their customers don’t really have to worry about blocking. According to the article, even domain based blocking isn’t an issue because they recommend using a domain completely separate from their actual domain. I declined to participate. I did spend a little time on their website just to see what they were doing.
This morning a vendor in the space joined one of the email slack channels I participate in asking for feedback on their software. Again, they provide software so companies can send spam through google outbound IPs. Discussions with the vendor made it clear that they take zero responsibility for how their software is used.
I don’t actually expect that even naming and shaming these companies facilitating spam will do anything to change their minds. They don’t care about the email ecosystem or how annoying their customers are. About the best they could do is accept opt-out requests from those of us who really don’t want to be bothered by their customers. Even that won’t really help, even domain based opt-outs are ineffective.
What needs to happen is companies like Google, Amazon and Microsoft need to step up and enforce their anti-spam policies.

Gmail: You agree not to, and not to allow third parties or Your End Users, to use the Services: to generate or facilitate unsolicited bulk commercial email;

Office 365: When using Microsoft Online Services, you may not:  […] Use the Services to transmit, distribute, or deliver any unsolicited bulk or unsolicited commercial e-mail (i.e., spam)

Amazon: You will not distribute, publish, send, or facilitate the sending of unsolicited mass e-mail or other messages, promotions, advertising, or solicitations (like “spam”), including commercial advertising and informational announcements. You will not alter or obscure mail headers or assume a sender’s identity without the sender’s explicit permission. You will not collect replies to messages sent from another internet service provider if those messages violate this Policy or the acceptable use policy of that provider.

Ideally, the folks providing these services will have all the tools regular ESPs do. I’m sure many of them do have a subset of those tools. But whether or not these issues are big enough to notice or deal with – as opposed to the other outbound issues they have to deal with – remains to be seen.
Of course, if the issues are big enough, the ISPs will take action and quickly. For instance, last week a poster on mailop pointed out Microsoft was the #1 spam ISP on Spamhaus’ list. A MS rep on the list responded and said they were notifying the appropriate people. This morning when I looked in preparation for this post, Microsoft was #1. When I just went to go get a screenshot, Microsoft wasn’t on the list any longer.
I know many people in the anti-abuse space are working on messaging abuse of the future. Calendar invites are one of the emerging issues. I just hope they don’t forget to address this B2B spam that goes out of its way to hide from current anti-spam services and technology.

Related Posts

Blocking of ESPs

There’s been quite a bit of discussion on my post about upcoming changes that ESPs will be facing in the future. One thing some people read into the post is the idea that ISPs will be blocking ESPs wholesale without any regard for the quality of the mail from that company.
The idea that ESPs are at risk for blocking simply because they are ESPs has been floating around the industry based on comments by an employee at a spam filter vendor at a recent industry conference.
I talked to the company to get some clarification on what that spam filtering company is doing and hopefully to calm some of the concerns that people have.
First off, and probably most important, is that the spam filtering company in question primarily targets their service to enterprises. Filtering is an important part of this service, but it also handles email archiving, URL filtering and employee monitoring. The target market for the company is very different than the ISP market.
The ISPs are not talking about blocking indiscriminately, they are talking about blocking based on bad behavior.
Secondly, this option was driven by customer request. The customers of the spam filtering appliance were complaining about “legitimate” mail from various ESPs. Despite being reasonable targeted the mail was unrequested by the recipient. While ESPs use FBLs and other sources of complaints to clean complainers off rented or epended lists at ISPs, the option is not available for mail sent to corporations. Enterprises don’t, nor should they have to, create and support FBLs. Nor should employees be expected to unsubscribe from mail they never requested.
This option is the direct result of ESPs allowing customers to send spam.
Thirdly, this option is offered to those customers who ask for it. It is not done automatically for everyone. The option is also configurable down to the end user.
While I haven’t seen the options, nor which ESPs are affected, I expect that the ones on the list are the ones that the filtering vendor receives complaints about. If you are not allowing your customers to send spam, and are stopping them from buying lists or epending, then you probably have not come to the attention of the filtering company and are not on the list of ESPs to block.

Read More

The cycle goes on

Monday I published a blog post about the ongoing B2B spam and how annoying it is. I get so many of these they’re becoming an actual problem. 3, 4, 5 a day. And then there’s the ongoing “drip” messages at 4, 6, 8, 12 days. It is getting out of control. It’s spam. It’s annoying. And most of it’s breaking the law.
But, I can also use it as blog (and twitter!) fodder.

Read More

If I can't tell, it's spam

Judging by the amount of B2B spams I’ve gotten this past week, a number of businesses got bright, shiny new email programs for Christmas. “Like to set up a call with you…” “Just need 10 minutes of your time to explore…” “Love to jump on a call and tell you about our product…”
That’s just the mail that comes into my personal address. There’s also a raft of mail coming into our contact address. The majority of those are trying to sell me FB or Twitter followers, although Instagram is rising in the ranks. Some of those messages are kinda funny, though. They try so hard to pretend there’s a real person who really did look at our website and who really has a comment.
Most of the time it’s pretty obvious that it’s not from a human. But every once in a while a message comes in that might be from a real person. I’ve finally decided that if I have any question if a message was written by a human or a bot, it will be treated as written by a bot.
Unfair? Maybe. But I’m a small business owner and a consultant; I don’t have tons of spare time to sit around letting folks pitch me on their business. I don’t think I’m actually that unusual when it comes to entrepreneurs. We’re busy, we don’t like distractions and we go out and search for the things we actually do need.

Read More