Email Newsletter Software

I received a B2B spam email today. That’s not too remarkable. I get anywhere from four to eight of them a day. The volume is irritating enough that I log them, and I always reply and ask where they got my email address from. (Some day, I might even “out” some of the worst offenders, highlighting their lack of permission for the whole world to see. And to shine an uncomfortable spotlight on those awful “business contact database” selling companies, who sell B2B lists.) 

This time, I got a reply back to my query. The sender indicated that I gave them a business card at a conference.

Okay, so it’s somebody I’ve actually met. That’s fine, that’s good. I give out a lot of business cards at conferences. People always want my business card, and often ask me if it’s okay to email me a deliverability question or two at some point in the future. Time permitting, I welcome deliverability questions via email, and answer as many as I can.

But, just because I gave you my email address, how does that mean that I wanted to be subscribed to your company’s newsletter? A competitor company, even. Think of how poorly considered this is, on multiple levels. Wanted mail is well delivered mail. Did I want this mail? No, I didn’t ask for it, and I didn’t expect it. Also, do you think it’s wise to obtain competitor email addresses at conferences and sign them up for your newsletter? Do you really want to broadcast what you’re doing, directly to your competitors?

The real issue here is the logical leap (or lack of one) from “you may have my contact information” to “please send me your newsletter.” I stated the former by handing over my card. I did not state or even imply the latter. So how does somebody make the logical leap from contact info to permission? I’m not seeing it, because there’s a step missing: Asking me if I wanted to receive your newsletter. That’s what permission is all about. Ask, don’t assume. 

In this case, the guy assumed. And that assumption was a bad one, and it colored my opinion of him, and his company’s permission practices, accordingly.

I’m sure somebody somewhere will take a different point of view and suggest that gosh, this email was really targeted (or should have just been targeted a little better), and then it would have been fine. That’s untrue. “Properly targeted” spam is still spam, and the proof is in the spam complaints. Send mail to people who don’t want it, even if it’s on topic, and it garners spam complaints. It’s that simple.

In this case, I know I wasn’t the only person who received this mailing, and I know that some of the other recipients were similarly unhappy about it. I guess I’m not alone in thinking that a business card exchange doesn’t equate with opt-in permission.

I'm active in a lot of the different email industry groups, and on a number of those lists, the hot topic lately is DKIM – DomainKeys Identified Mail.

What is DKIM? Wikipedia explains that DKIM “is a method for E-mail authentication, allowing a person who receives email to verify that the message actually comes from the domain that it claims to have come from.”

A lot of the ongoing discussion surrounding DKIM relates to what people want from the specification. Senders (ESPs, big brands) and receivers (ISPs, spam filtering device manufacturers, and MTA (mail transfer agent – i.e. “mail server software”) publishers seem to want different things from the spec.

Anything I tell you about my desires for the specification are certain to be tinted by my own biases. As is the case with anyone. But, allow me to be up front about those biases. I'm a representative of a sender, email service provider ExactTarget. But I also have a strong history in the realm of blacklists, having created more than one of them myself, and having worked with various ISPs over the years to help them filter out spam.

So what do I want out of DKIM? I want two things out of DKIM, or out of email authentication in general:

Enable better whitelisting. Prove that mail from domain.com really came from domain.com, and then a receiving site has the ability to better develop statistics specific to those messages. Maybe IP address reputation doesn't go away, but if an ISP can see that very few messages sent from a domain generate complaints, I suspect the smarter ISPs are going to be more likely to allow that mail through, regardless of its source IP address. (The flip side of this is that if I'm a bad sender, it becomes harder to sidestep a bad reputation by changing IP addresses. This I believe to be a feature, not a bug.)

Enable better blacklisting. Is there a better way to promote message security? Block, or more heavily filter, unsigned mail, especially if it comes from a domain where you've recognized that other messages sent are being signed properly. This is controversial, and it's hard to say if it would ever come to be. But this is about what I want, and this is what I want. I want, when signing up for an ISP feedback loop, or registering with a spam filterer or MTA vendor, to be able to tell them that all of my mail is signed, and that you can feel free to discard or reject unsigned mail.

Pros: Stops a lot of phishing in its tracks. Helps recipients to understand that if the from domain is “ebay.com”, the message really did come from eBay.

Cons: Doesn't stop “lookalike domain” attacks. (What if the message came from ebay7.com?) Some technology experts really hate the idea of using DKIM in this way, because they feel that a system issue would cause a legitimate message to be nuked. I think the risk here is lower than others represent, and I also think that some of the folks making this case, while I respect them, they do not run abuse desks at large ISPs. I find it hard to believe that ISPs would never consider this.

Making things better for those who send mail isn't my only consideration. Making things easier for those who block or filter mail is also very important to me. If I ran a spam filter, how would I want things to work? That's part of where I'm coming from here. How does DKIM, or authentication in general, fit into a spam filtering strategy?

So what do YOU want out of DKIM, or out of email authentication in general? Comments and feedback welcome. (Please keep it gentle – I won't approve any comments with insults.)