Evolution of policy

Last week, I talked about policy, using some different blocklist policies as examples. In that post I talked about how important it is that policy evolve. One example of that is how we’ve been evolving policy related to companies that get listed on Purchased Lists and ESPs. Who is listed has evolved over time, and we’re actually looking at some policy changes right now.

Listing policy 1

The first iteration of the list was crowdsourced by deliverability people. One person mentioned they had a list they used when customers would argue “X company lets me send to purchased lists.” That list got shared and lots of folks contributed their company names. I offered to publish the list and thus the initial blog post.

  • Your company was added to the list by being nominated from a small group of people.

Listing policy 2

Once the blog post went up a surprising number of companies asked to be added to the list. I was happy to add the companies but needed some criteria other than nominated by this group of people. Our policy had to evolve to cover self-nominations. Whatever the policy was it needed to be something I could easily check and verify and couldn’t take up a significant amount of time.

  • Your company was added to the list by being nominated from a small group of people; or
  • Your company was self nominated and your terms and conditions / acceptable use policy states you do not allow purchased lists.

At the time I created policy 2 there were some specific goals driving it. We were getting regular requests to be added to the list. I didn’t have a lot of time or energy to vet every listing. There was also some pushback from anti-spam groups on the initial post that the list wasn’t accurate. Thus, the requirement that there be a public statement on the company’s website stating public lists weren’t allowed.

Listing policy 3

There’s one company on the list we’ve been having ongoing, frustrating interactions with. They don’t seem to enforce their abuse policy at all. We’ve reported multiple customers who are spamming purchased (and “purchased“) lists and the company refuses to take any action. The same customers keep spamming us over and over again. They meet the criteria for listing – they have a public policy that says they don’t allow purchased lists. But we’re seeing ongoing mail to addresses that are either purchased or stolen.

We decided to remove strike that company from the list. That’s fine, we’re allowed to make exceptions to the policy. I also always knew that “having a public statement against purchased lists” was a bit of a weak policy. Many companies have those public statements but don’t actually stop customers from sending to purchased lists. I was sure I’d have to wrestle with this issue sooner or later.

What are the goals?

The initial goal was to post timely information based on conversations happening in the industry. There were folks who wanted the lists to be more public, so they could point their own customers at it. We met that goal.

The second goal was to allow companies to add themselves to the list with some confidence they belonged on the list.

My newest goal is to sensibly and fairly add (and remove) companies who are not enforcing their policy. But what does not enforcing their policy look like? In the case of the company we removed from the list, we have sufficient evidence that they’re not stopping spam off their network. I’m pretty convinced there are other companies on the list that poorly manage their customers, too. But we don’t have as much direct evidence against those other companies.

The questions I’m asking as I think about what a sane policy would look like include:

  • what is the goal of the list now? is it to give props to companies that enforce their policies? is it simply to give companies a place to point to regarding ESPs that prohibit purchased lists?
  • if the goal is to highlight companies that are actually enforcing their policies, what does ‘enforcing their policies’ look like?
  • do I want to do all the vetting myself or should other people be involved in vetting?
  • how accurate do I want the list to be?
  • does it matter if companies get onto the list when they don’t qualify?
  • what is my time availability and how does that interact with the policy requirements?
  • does any of this matter?

I don’t have answers to all of the questions. I would prefer that the list be accurate and reflect only those companies that actively prevent their customers from sending to purchased lists. But how to ensure accuracy? And what counts? Does blocking mail to people who complain count? Making customers reconfirm lists?

This is one of the challenging bits of policy development. I don’t have answers, yet. At best the current policy is

  • Your company was added to the list by being nominated from a small group of people; or
  • Your company was self nominated and your terms and conditions / acceptable use policy states you do not allow purchased lists.
  • I don’t have any direct or overwhelming evidence customers are allowed to send spam to purchased lists.

For today, that’s good enough. But I know that it’s a stop gap policy, not a long term one.

Security Truths
Schroedinger’s email

Related Posts

Not a customer you want

Earlier this week one of my ESP clients contacted me. They have a new (potential?) customer dealing with some delivery challenges. Client was looking for advice on how to move the customer over and improve their delivery at the same time.
My advice was actually pretty simple: this isn’t a customer you want. Walk away.
I reached that conclusion about 10 seconds after I loaded the customer’s website. Because I know sometimes initial impressions are wrong, I did spend about 10 more minutes poking around. What I found did nothing to change my mind or convince me my initial impression was wrong. In fact, everything I found reinforced the belief that this was not a good customer for my client.
I sent my client an email explaining what I’d found and they agreed. Future deliverability problem averted!
Some of what I found inspired the conversations with spammers blog post from earlier this week. For instance, the website had two different signup forms, each pointing to a different ESP. Both links were dead.

Then I looked at the company’s whois record and found a bunch of cookie cutter websites, all with different domain names, all with the same broken subscription links.
I do this manually and I can’t fathom how you would automate this kind of checking. For me, it seems there absolutely needs to be a human in the loop. But I suspect that there are ways to automate these types of checks.
In any case, there’s a spammer looking for an email service provider. He’s having problems with IP reputation at his current ESP. He sends content and will even share with you the domain he’s using to collect email addresses. Pro tip: try and sign up for his mail before he signs your contract.

Read More

Buying lists costs more than just money

ShadyGuyWebsiteI’ve been talking to a lot of companies recently who are dealing with some major delivery challenges probably related to their practice of purchasing lists and then sending advertising to every address on the list. They assure me that their businesses would be non-viable if they didn’t purchase lists and it has to be that way.
Maybe that’s true, maybe it is more cost effective to purchase lists and send mail to them. I know, though, that their delivery is pretty bad. And that a lot of the addresses they buy never see their email. And that they risk losing their ESP, or they risk being SBLed, or they risk being blocked at Gmail, or they risk bulk foldering at Hotmail. There are a lot of risks to using purchased lists.
The reality is it’s only getting harder to mail to purchased lists and it’s getting more expensive to mail purchased lists. Paying for the list is a small part of the cost of using them.
Other costs incurred by companies using purchased lists include:
1) Having multiple ESPs. There are certainly legitimate reasons for companies to use different ESPs but there is a cost associated with it. Not only do they have to pay for duplicate services, but they spend a lot of employee time moving lists and recipients around to see who might have the better delivery today.
2) Multiple domains and brand new websites for every send. Landing pages are good marketing and are normal. But some ISPs track the IPs of the landing sites, and those IPs can get their own poor reputation. To get around it, senders using purchased lists often have to create new websites on new IPs for every send.
3) Complicated sending schedules. Sending schedules aren’t dictated by internal needs, they’re dictated by what ISP is blocking their IPs or domains (or even ESP) right now.
All of these costs are hidden, though. The only cost on the actual bottom line is the money they spend for the addresses themselves and that’s peanuts. Because, fundamentally, the folks selling addresses have no incentive to take any care in collecting or verifying the data. In fact, any verification they do only cuts into their profit, as buyers won’t actually pay for the verification and data hygiene and it also reduces the size of the lists they can sell.
And, no, data hygiene companies that look for traps and bounces and “bad addresses” don’t take a bad list and make it good. They just take a bad list and make it a little less bad. If the recipients don’t want the mail, all the hygiene in the world isn’t going to get that message into the inbox.
Outsourcing address collection to list selling companies is more expensive than it looks on paper. That doesn’t stop anyone from building a business around purchased lists, though.

Read More

Who pays for spam?

A couple weeks ago, I published a blog post about monetizing the complaint stream. The premise was that ESPs could offer lower base rates for sending if the customer agreed to pay per complaint. The idea came to me while talking with a deliverability expert at a major ESP. One of their potential customer wanted the ESP to allow them to mail purchased lists. The customer even offered to indemnify the ESP and assume all legal risk for mailing purchased lists.
While on the surface this may seem like a generous offer, there aren’t many legal liabilities associated with sending email. Follow a few basic rules that most of us learn in Kindergarten (say your name, stop poking when asked, don’t lie) and there’s no chance you’ll be legally liable for your actions.
Legal liability is not really the concern for most ESPs. The bigger issues for ESPs including overall sending reputation and cost associated with resolving a block. The idea behind monetizing the complaint stream was making the customer bear some of the risk for bad sends. ESP customers do a lot of bad things, up to and including spamming, without having any financial consequences for the behavior. By sharing  in the non-legal consequences of spamming, the customer may feel some of the effect of their bad decisions.
Right now, ESPs really protect customers from consequences. The ESP pays for the compliance team. The ESP handles negotiations with ISPs and filtering companies. The cost of this is partially built into the sending pricing, but if there is a big problem, the ESP ends up shouldering the bulk of the resolution costs. In some cases, the ESP even loses revenue as they disconnect the sender.
ESPs hide the cost of bad decisions from customers and do not incentivize customers to make good decisions. Maybe if they started making customers shoulder some of the financial liability for spamming there’d be less spamming.

Read More