Cure the cause, not the symptoms

There is little that surprises me these days. Years of working in Government have left me cynical and jaded. I have seen the lowest of the low in terms of bad practice. But it just goes to show that I can still be left speechless. But not for long. The organisation I work for send out legitimate large volumes of information to people who opt in. They go through great lengths to make the user prove they own the email address and that they have subscribed. To do this we send out a PIN to the email address they supply and require them to log back in to enter said PIN. So even if you are a bad guy who has access to someone’s email box you cannot succeed as you will not have their login details. Pretty secure. What has come up though is that one of the major free email providers spam filters are being overzealous and while they are accepting our mail onto their servers their filters mean they do not pass the message on to the user's inbox. This increases our cost of support as the users then contact us asking where the mail is, we check our systems and it shows as delivered. Very frustrating for the user and for us. We managed to contact said email provider who informed us that there are two options. The first is for them to look at our emails in a test account to see why they are labelled as spam (when I can confirm that spam assassin scores us very low and well below spam mark levels). The second is to join a scheme called bondedsender (www.bondedsender.com). And this is where my chin hit the floor. The email provider has decided that rather than just have a white list where bona fide companies can put their IP on, they will only use the white list from this organisation. The problem is it costs money. Lots of money. Not only that, their terms and conditions are so onerous that despite the fact that we are very secure and anti spam and high on privacy etc etc we do not fit the very narrow model they have outlined as the only acceptable way to be part of their scheme.
The worst part is that they require a bond (hence the name) and that if people complain, rightly or wrongly they will deduct $20 a time from your money. They do give you a few free complaints though. If you send 5000000 messages per month they will not charge you for the first 5 complaints. Lucky lucky us. In fact it gets worse. They do not disclose the person who complains and even if you have proved opt in etc they will still deduct money anyway.
While I can see what they are trying to achieve the words SCAM and blackmail come to mind.

So lets just recap. If I, as a bonafide company want to send our customers legitimate email, customers how have opted in, to their email account I have to pay and put my business at risk. Not because my emails are spam, but because the spam filters in the email provider are set so high that legitimate mail (which ours is) is blocked. We then have to register with a 3rd party and pay them lots of money so that the over zealous filters will not remove our legitimate mail.

The alternative of course is my initial reaction which is to simply ban that provider and suggest to all of our users that they get another email account from one of the providers competitors which has a sensible approach to spam.

It seems a dangerous road to go down and a back door to controlling email. And of course the real joke is that the spam continues to flow regardless. So in fact all that is happening is the legitimate businesses get penalised while the spammers continue to work their trade. If this grows then we can easily see a time when the white list is the only way to get emails through as companies (maybe financially rewarded by such white list companies) continue to throttle up the spam filters. Nice business if you can get it.

If you look at the operation of blacklists we can see a more sensible approach. The black list is innocent until proven guilty. If you get complaints then you simply go through the right process to get off the list. It naturally balances itself out as it is in the black list owner’s benefit not to incorrectly list people. In fact a successful court case in the US where a black list provider incorrectly listed a business’s IP resulted in huge court fees and eventually closed them down. If ISPs want to add value to their customers then they can pay to subscribe to block out the bad guy. The whole approach seems right and the interests of right and wrong seem nicely in balance. The white list approach is heading towards blackmail. If you do not pay us, we will not allow your mail to be delivered even if it legitimate.

So come on guys, just get your own white list or use a company which is not a sledge hammer to crack a nut. Even AOL has managed it.