Subject: [ietf-smtp] Mail forwarding to Gmail problem/question

From: Paul Smith <[email-masked]>
Date: Wed, 3 Feb 2016 10:32:03 +0000

Hi, I just wondered if anyone here had any suggestions for this issue we 
constantly have...

We provide a paid SMTP relay service to some of our customers who have 
ISPs with awful SMTP relay services.

One constant issue we have is that several of our customers insist of 
setting their internal mail servers up to forward all mail for certain 
users back out to gmail addresses. That means that they send bucketloads 
of spam (incoming spam to them, which then gets forwarded back to our 
servers). What then happens is that Google (reasonably understandably) 
start limiting our servers from sending mail to them, and they even seem 
to start rejecting legitimate mail just because it's come through our 
servers which are also sending 'spam' to them.

We do tell the customers not to do this. They do it so they can get 
their mail at home, so we tell them it's probably better to simply allow 
access to their internal mail server from the Internet (they have IMAP4, 
so it's a nice user experience as well), but they still want to forward 
the mail back out again regardless.

What I've started doing is detecting this indiscriminate forwarding from 
the customers' MTAs and route that mail to one particular MTA which is 
only used for sending the forwarded messages on to Google. Hopefully 
that will limit the 'bad reputation' to just that one server's IP address.

We could start passing the outbound mail through our own spam filter as 
well, but that's something we're reluctant to do because it'll lead to 
false positives.

Any other ideas or thoughts?

Am I right in interpreting Google's behaviour, or are they clever enough 
to detect MTA forwarded messages and not assign poor reputation to the 
forwarding MTA in that case?

Is there something clever we should be doing to tell Google what's 
happening?

---

From: Evert Mouw <[email-masked]>
Date: Wed, 3 Feb 2016 11:57:28 +0100

Op 3-2-2016 om 11:32 schreef Paul Smith:
> We could start passing the outbound mail through our own spam filter
> as well, but that's something we're reluctant to do because it'll lead
> to false positives. 
It seems obvious to filter out the spam. To be honest, I thing Google is
doing the right thing here, because you are a source of spam. You should
take appropriate measures. Maybe you have to accept a few false
positives. You could also modify your spam filter so that positives are
sent back to the sender, with a warning.

Please note that this mailing list is not intended to help with setting
up mail servers. The (design of) the SMTP protocol is the main topic here.

Regards, Evert

---

From: Steve Atkins <[email-masked]>
Date: Wed, 3 Feb 2016 11:08:39 +0000

> On Feb 3, 2016, at 10:32 AM, Paul Smith <[email-masked]> wrote:
> 
> Hi, I just wondered if anyone here had any suggestions for this issue we constantly have...
> 
> We provide a paid SMTP relay service to some of our customers who have ISPs with awful SMTP relay services.
> 
> One constant issue we have is that several of our customers insist of setting their internal mail servers up to forward all mail for certain users back out to gmail addresses. That means that they send bucketloads of spam (incoming spam to them, which then gets forwarded back to our servers). What then happens is that Google (reasonably understandably) start limiting our servers from sending mail to them, and they even seem to start rejecting legitimate mail just because it's come through our servers which are also sending 'spam' to them.

This is more of a mailop question than an ietf-smtp question.

https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

> 
> We do tell the customers not to do this. They do it so they can get their mail at home, so we tell them it's probably better to simply allow access to their internal mail server from the Internet (they have IMAP4, so it's a nice user experience as well), but they still want to forward the mail back out again regardless.
> 
> What I've started doing is detecting this indiscriminate forwarding from the customers' MTAs and route that mail to one particular MTA which is only used for sending the forwarded messages on to Google. Hopefully that will limit the 'bad reputation' to just that one server's IP address.
> 
> We could start passing the outbound mail through our own spam filter as well, but that's something we're reluctant to do because it'll lead to false positives.

Definitely do some content filtering, but label the mail rather than discarding it.

> Am I right in interpreting Google's behaviour, or are they clever enough to detect MTA forwarded messages and not assign poor reputation to the forwarding MTA in that case?
> 
> Is there something clever we should be doing to tell Google what's happening?

Read this: https://support.google.com/a/answer/175365?hl=en

Cheers,
  Steve

---

From: Paul Smith <[email-masked]>
Date: Wed, 3 Feb 2016 12:07:36 +0000

> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
Sorry - I thought this may not be the right place (although there may 
have been an SMTP extension I hadn't noticed which was relevant... ;-) ) 
I didn't know of that mailing list. I'll sign up to that for this type 
of question in the future.

Thanks for the answers anyway :-)

---

From: Paul Smith <[email-masked]>
Date: Wed, 3 Feb 2016 12:17:48 +0000

On 03/02/2016 10:57, Evert Mouw wrote:
> doing the right thing here, because you are a source of spam.
I'm not blaming Google.

But, on the other hand, is it really 'spam' we're sending, or just 
messages which are spammy? It's a subtle difference, but the recipient 
'wants' to receive the messages (for some definition of 'want') because 
they are deliberately sending them to themselves. Is it spam if I send 
*myself* messages about viagra?

It depends on your definition of 'spam'.

> You should

Backscatter!

I think filtering them, and marking them (not blocking) and sending them onto Google may be the best answer.

> up mail servers. The (design of) the SMTP protocol is the main topic here.
Yes, sorry. I am a regular member of this list, and it just came up as 
the most likely place to ask. I am suitably ashamed.

(Maybe there SHOULD be an SMTP feature to indicate MTA forwarding is 
taking place, because it certainly doesn't seem as if we're the only 
people who will have this problem - domain hosts often do general email 
forwarding, often without any spam filtering)

---

From: Dave Crocker <[email-masked]>
Date: Wed, 3 Feb 2016 07:34:35 -0800

> Definitely do some content filtering, but label the mail rather than discarding it.

That makes good sense.

In terms of false positives, think of it as restricting the problem to 
this sub-stream, rather than Google's imposing false positives on the 
larger, aggregate stream from your entire site...

d/

---

From: "John Levine" <[email-masked]>
Date: 3 Feb 2016 16:47:31 -0000

>https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Agreed, see reply to.

>Read this: https://support.google.com/a/answer/175365?hl=en

And weep, because it contradicts itself and is woefully out of date.

I have a clever solution to this problem which is too long to fit in the
margin of this message, but I think there's room on mailop.

R's,
John

---

From: Brandon Long <[email-masked]>
Date: Wed, 3 Feb 2016 14:05:06 -0800

> And weep, because it contradicts itself and is woefully out of date.

The mark as spam in the subject and don't rewrite the message is a nice
touch.
They were supposed to change that to add a header on the message... but
they'll come back and say we were supposed to make a consumer level
"incoming relay" IP setting to match the one that GfW has.

> margin of this message, but I think there's room on mailop.

There was a long discussion about this on mailop not that long ago, you can
see it here when you join the list:
https://chilli.nosignal.org/cgi-bin/mailman/private/mailop/2014-June/005184.html

Right now, there is no great solution.  One I recommended before was to
block relayed spam, and then have the user's set up pop fetching.  So, the
cleanest mail should arrive quickly, and everything else will be fetched
more slowly.

Brandon

---

From: Paul Smith <[email-masked]>
Date: Thu, 4 Feb 2016 10:26:58 +0000

On 03/02/2016 22:05, Brandon Long wrote:
>
> There was a long discussion about this on mailop not that long ago, 
> you can see it here when you join the list:

Thanks. I've had a look at that.
> Right now, there is no great solution.
>
The 'best' solution could be for Google to allow a user to define a 
'forwarder' IP address/range... (And possibly allow forwarders to say 
that they are forwarders to help Google remind users to set their 
'forwarder' settings)

> One I recommended before was to block relayed spam, and then have the 
> user's set up pop fetching.  So, the cleanest mail should arrive 
> quickly, and everything else will be fetched more slowly.
The problem with setting up POP3 fetching is that it requires a massive 
leap in technical ability for the user. It takes 2 seconds to set up 
'forward to [email-masked]' in our software. To do POP3 fetching, they 
need to set up port forwarding in firewalls, tell Google the server 
details etc. They may need to change from a dynamic IP address to a 
static one (or set up noip.com or whatever), and so on. So, users will 
stick with forwarding despite the problems it causes for their MSP.

---

From: "John Levine" <[email-masked]>
Date: 4 Feb 2016 17:18:08 -0000

>stick with forwarding despite the problems it causes for their MSP.

I suppose when we propose POP3 fetching we assume that one's mail
system already has some POP or IMAP users.  Is your system really 100%
forwarded addresses?  If not, what's with the firewall stuff?  How do
your current POP or IMAP users pick up their mail?

It's true, they need to tell Google the server details, but it's the
work of a few minutes to set up a cookbook web page that tells them how
to plug the POP details into the three mail systems to which people
are likely to want to forward their mail.  It is if anything easier
than setting up a desktop MUA, and we've been telling our users how to
do that for decades.

R's,
John

---

From: Brandon Long <[email-masked]>
Date: Thu, 4 Feb 2016 13:02:35 -0800

On Thu, Feb 4, 2016 at 2:26 AM, Paul Smith <[email-masked]> wrote:

>> There was a long discussion about this on mailop not that long ago, you
>> can see it here when you join the list:
>>
> 'forwarder' IP address/range... (And possibly allow forwarders to say that
> they are forwarders to help Google remind users to set their 'forwarder'
> settings)

Sure, and we have that for Google Apps customers, but when it comes to
consumer Gmail accounts, it would have to be per account, and it just
hasn't been a high enough priority.  Kind of a 1% of 1% problem...

And that assumes that an "IP" is good enough, and not having to say use a
domains SPF records to define their full IP list dynamically (that's what
we make other services use if they want the list of Gmail's IPs, they have
to monitor _spf.google.com).

And, assuming that people don't mess up and put the wrong thing in there
and then have spam issues (we routinely have Apps customers mess up the
differences between inbound gateway, spam ip whitelists, and other things).

If there was a good mechanism we could use without user intervention, that
would be best.

Brandon

>> user's set up pop fetching.  So, the cleanest mail should arrive quickly,
>> and everything else will be fetched more slowly.
>>
> need to set up port forwarding in firewalls, tell Google the server details
> etc. They may need to change from a dynamic IP address to a static one (or
> set up noip.com or whatever), and so on. So, users will stick with
> forwarding despite the problems it causes for their MSP.
>
>
>
>
>
> _______________________________________________
> ietf-smtp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-smtp
>