Heads up: GMail regularly marking list messages as spam

If you read the list via GMail, you may want to regularly check your Spam label for messages from the git list.

I'm not sure what's up with that. A handful of real spam had made it through vger, but GMail seems to be hitting a fair number of false positives lately.

Sometimes it is just one message in a patch set. Others, it is whole sets of patches. I didn't check to see if there was anything in common across the messages. Maybe if anyone has a large batch, they can check?

It would be interesting to see if this affects domain specific users as well (e.g., Google itself).

Cheers, mrc

On Monday, August 12, 2024 11:10 AM, Mike Castle wrote:

What I think you will find is that some spammers use this mailing list to send spam. Most of it gets blocked because it is in HTML or RTF. However, various honey-pots and organizations like SpamCop detect the mailing list servers as the source of spam so the servers get black-listed or marked as spam. Unless the servers themselves filter out spam before redistributing it, this is going to keep happening.

On Mon, Aug 12, 2024 at 08:10:23AM GMT, Mike Castle wrote:

Gmail is using internal spam training on all mail that it receives. Unfortunately, mailing list traffic like that on the git list falls way outside what is "normal," and this tends to trigger false-positives.

Most of the time it's super unhelpful:

    Why is this message in spam?

    It is similar to messages that were identified as spam in the past.

Sometimes it's something specific:

    Why is this message in spam?

    Lots of messages from xxxxx.msg.chrl.nc.charter.net were identified as
    spam in the past.

This isn't really anything to do with vger.kernel.org -- we are complying with all Gmail "bulk mail sender" requirements and we try our best to deny spammers early. Unfortunately, my general recommendation is not to use Gmail for this kind of work.

-K

On 2024-08-12 at 15:10:23, Mike Castle wrote:

Gmail and Yahoo have both set up new requirements for senders[0]. This requires that all senders have SPF and DKIM, and senders sending more than 5000 messages per day have DMARC set up. One-click unsubscribe in RFC 8058 is also obligatory, as is TLS for sending messages. These changes came into effect in February 2024.

I don't believe vger uses DKIM (at least, it doesn't appear to add DKIM headers) and doesn't support RFC 8058 one-click unsubscribe. Perhaps adding support for those, as well as any other relevant requirements, would improve things.

[0] https://support.google.com/a/answer/81126?sjid=9729987135322685176-NC&visit_id=638590935924706038-3386441869&rd=1

On Mon, Aug 12, 2024 at 09:16:56PM GMT, brian m. carlson wrote:

These guidelines are only applicable if vger was the origin of the messages, not a forwarder. For forwarders, it is only required to add ARC signatures:

https://support.google.com/mail/answer/175365?hl=en

The only thing we aren't doing is we're not adding X-Forwarded-To headers, because mlmmj doesn't yet support it (should be in 1.5).

-K

On 2024-08-13 at 15:06:13, Konstantin Ryabitsev wrote:

The article you linked still recommends DKIM. In addition, the article I linked doesn't appear to limit itself to non-mailing lists in any way. It says, "email senders", and a mailing list sends emails. In fact, it explicitly mentions "[i]f you manage a forwarding service, including mailing lists or inbound gateways," so it still appears to cover both cases and apply to all senders, with only some additional requirements applying to forwarding services.

In general, adding DKIM (whether or not ARC is supported) _will_ dramatically improve the deliverability of email in general, so it's a win overall. Adding one-click unsubscribe would also probably keep some of those unsubscribe messages from hitting the list since people could automatically use the functionality of their mail client to unsubscribe.

And from a personal point of view, it is definitely useful for me, as someone who manages their own mail server, to heavily negatively score all email without DKIM, but I can't do that because vger doesn't add any. That's the only thing preventing me from doing that.

On Tue, Aug 13, 2024 at 10:18:14PM GMT, brian m. carlson wrote:

Sorry, but this is not factually correct. Adding a DKIM signature to a message where the From: lists a different domain has no impact on anything at all when it comes to the chances of it being marked as Spam at google.

E.g. your message has:

    From: "brian m. carlson" <sandals@crustytoothpaste.net>

And it already has a DKIM signature for your domain. Adding another DKIM signature for vger.kernel.org will serve no purpose, because there is no alignment between "vger.kernel.org" and the domain in your From: address.

In fact, we do add a cryptographic signature, but in the ARC record: https://lore.kernel.org/git/Zrvbpt3Fkl8yjesP@tapette.crustytoothpaste.net/raw

It's from the overlord subspace.kernel.org domain, but it doesn't need to align with "vger.kernel.org".

This is not possible without rewriting the From: header, which will break all patches. We cannot modify the message content or any of the main headers that are DKIM-signed (this bit is mentioned in the forwarder guidelines I linked to).

There is a small subset of active git mailing list posters who send mail that is not DKIM-signed, for example Jeff King:

https://lore.kernel.org/git/20240813124550.GC968816@coredump.intra.peff.net/raw

However, signing their messages with a DKIM signature from vger.kernel.org will serve no purpose, unless we also rewrite the From: to match the vger.kernel.org domain. The From: field would need to be something like:

    From: Jeff King via Git Mailing List <foo+somemagic+peff.peff.net@vger.kernel.org>

This is called "From-munging" and is not acceptable on any mailing list that sends and receives patches, because this changes the Author of the patch.

Thing is, this has nothing to do with vger, because if Jeff emails you directly and you set a high negative score for messages without a DKIM signature, you won't get his mail either. The fact that it traversed or didn't traverse vger.kernel.org has no impact on that.

-K

On Tue, Aug 13, 2024 at 08:10:17PM -0400, Konstantin Ryabitsev wrote:

Uh oh, now I feel singled out. ;)

It's true that I use only SPF but not DKIM. FWIW, I haven't had a huge problem with deliverability. But if the world is ready to move on and I am one of the last dinosaurs holding things up, I'm OK to be told that I really ought to implement DKIM to participate in the list.

Yep, agreed with all of that.

-Peff