spam filter disclosure?

[paul29]

One of my addresses got added to a mailing list (not a spam list, a legitimate list operated by a company that I buy stuff from, just a list that I didn't want that address to be on). After some discussion with the list owner I started marking the emails as spam when I got them. One arrived earlier today and I marked it as spam. A few hours later I got an "unsubscription request confirmed" message from the mailing list software.

Does marking a message as spam result in an unsubscription request being sent to the sender, containing the address of the flagged message? That seems counterproductive to me.

[William9]

It appears that the bulk sender is attempting to avoid accusations of unsolicited commercial email attempting to make subscribe and unsubscribe a documented process. The bulk sender (often times a service provider for the merchant) probably has a process/policy that it follows.

[paul29]

I don't know what you mean by that, about unsubscribing being a documented process. If I flag a message as spam, I thought that was only supposed to anonymously update the parameters of some statistical spam filters. It was not supposed to report personal info to anyone, especially the spammer.

Of course the list operator had a documented subscribe and unsubscribe process. Unsubscribe is something you do if you subscribed earlier, and then no longer want to be on the list. The email you receive after subscribing is a "subscription" that you can later turn off. But, if you didn't subscribe in the first place and you still get added to the list against your wishes, that's not a subscription, it is spam. So "unsubscribe" is the wrong way to stop seeing the emails and "report as spam" is the right way. Having the spam filter translate your spam report into an unsubscribe request is obnoxious and invasive.

[jarland]

Depends on what exactly marking it as spam does. I can't imagine a way to train a spam filter to auto click unsubscribe links and fill in the wealth of different, constantly changing forms that you might see when doing so. There is no universal "unsubscribe" message that all mailing lists simply understand by default.

If marking it as spam caused eventual blocking of the message at the server level, resulting in a bounce e-mail to the list provider, they may very well have a system in place that automatically sends a confirmation to unsubscribe.

[n5bb]

I think your discussion with the list owner is the reason for the unsubscribe message. I'm sure it had nothing to do with your Fastmail account spam filtering. Fastmail has no way to automatically unsubscribe or communicate with the spam sender, unless there are many messages from an apparently good sending service (where Fastmail staff might contact that service to discuss the issue). As you will see below, you can choose for spam messages to be automatically reported to email reputation third-party services.

At Fastmail, when you report a message as spam (or the spam filter catches the message or you manually decide to move a message to the Spam folder):

• The message is moved to the folder shown as Spam in the current interface. The IMAP folder name is "Junk Mail".
• Each paid account (in other words, all accounts except for Guest or Member grandfathered accounts) is scanned once each day for spam reporting and discarding old messages (if configured) and the steps shown below are taken at scan time. Only folders which have received new messages (from any source, including a new message arrival or moving a message using the web interface from another folder or using an IMAP client) in the past day are scanned. The scanning time seems to be roughly 2 AM local in the Fastmail server location (New York City, NY) for my account right now, but the exact time may be different for your account. You can see the last scan time in the Advanced>Folders screen for folders which have received new messages in the past day and which are configured to report spam or not-spam.
• If (and only if) you have enabled External Reporting on the Advanced>Spam/Virus Protection screen, messages reported as spam are forwarded to third parties and may affect the reputation assigned to such messages (and their senders) by external services. This will be done during the daily folder scan process.
• Messages reported as spam or non-spam (by your folder settings) affect the global Fastmail SpamAssassin filter. In addition, if you have enabled your user Bayes spam filter (see the bottom of the Spam/Virus Protection screen) these messages directly affect you specific account spam filtering. The user Bayes filter has a large affect on your future spam filtering, while the global Bayes filter is only very slightly affected by a single spam (or non-spam) report.
• If you make a mistake (or the automatic spam filter makes a mistake), you can correct it any any time by simply reporting that message as spam or not-spam (or moving it to the Spam or Inbox folder, such as by using an IMAP email client). When those folders are later scanned during the next day's update, the previous incorrect report will be eliminated and the new report will be applied. This correction does not have to be done within a day or any other specific interval - whenever you correct the error it will be corrected in the system within a day during the account scanning process.
• If you create new folders, you should set the folder spam reporting correctly (to spam or not-spam) on the Advanced>Folders screen.

Bill

[paul29]

Originally Posted by n5bb

I think your discussion with the list owner is the reason for the unsubscribe message. I'm sure it had nothing to do with your Fastmail account spam filtering. Fastmail has no way to automatically unsubscribe or communicate with the spam sender, unless there are many messages from an apparently good sending service (where Fastmail staff might contact that service to discuss the issue).

The discussion with the list owner was probably around 6 months ago, so I doubt if they just did the removal just now. The scenario I imagined was something like the one you described: the emails are being sent from a good sending service, which conceivably has channels open to the 3rd party external reporting places that get spam reports from FM, and then the 3rd party said to the sending service, "hey, someone at address xyz@fastmail.fm flagged this mailing from you as spam", so the sender then removes the address from the mailing list. The reporting service shouldn't do that, it's invasive, the sender should never receive any feedback about whether their traffic is being flagged, much less individual addresses that entered reports. Flagging spam should never result in it not being delivered (either bounced or some kind of info returned to the sender saying to de-list it). It should still be delivered, except to the junk mail folder instead of the inbox.

[n5bb]

The third party reputation services I mentioned are usually used for two purposes:

• SMTP stage XBL blocking and other insecure senders: Sending machines which have a high likelihood of being compromised or configured by spammers. This is a block of IP addresses or sending server names. If this was not done, the spam filter would receive a huge number of undesired messages (maybe 10X the current rate). This also reduces the chance of a denial of service attack. Connections from insecure senders are blocked, so the message is never received at Fastmail.
• SpamAssassin filtering after the message is accepted: This is the conventional spam filtering you have control over in the Spam/Virus Protection screen.

If every single attempt to send spam to your account from a compromised machine was allowed to be delivered to the spam filter, I think you would be surprised at the extremely large spam load you would receive. The vast majority of spam sending attempts result in the sending server not being able to connect to the Fastmail receiving server. If you were trying to send from such a server, you would receive a message from your sending server that Fastmail was rejecting connection attempts.

If you are curious why that sender sent you the "unsubscription request confirmed" message, just ask them. If they are a reputable sender they should at least discuss this issue with you.

Bill

[paul29]

Yeah I understand XBL blocking is a requirement and anyway it doesn't give the sender info about how individual spam messages are recognized. Ideally it wouldn't be needed but the amount of traffic would be impossible to handle without it.

I might contact the mail sending company, but it would be a bit awkward, "why did you unsubscribe me from that list I didn't want to be on? I wanted the unwanted messages to still be sent so they would hit my spam filter, and I wanted the global spam filter to impute all of your company's emails with higher probability of being spam, couldn't you just leave it like that?". Well yeah, no wonder they unsubscribed me. The question is how they got the info that I didn't want their email. A very private personal address made it back to the list company somehow.

[n5bb]

You can file a Fastmail support request and see if they can add any insight.

[nenieorg]

Originally Posted by n5bb

Fastmail has no way to automatically unsubscribe or communicate with the spam sender

It could follow the link in the List-Unsubscribe header when you report spam, whose purpose is precisely that kind of thing (I don't know if it's a standard or just a convention, but it seems common in mails generated by legit mailing list software).

I suspect Fastmail doesn't do that, but they could. Perhaps there are bad cases where doing it could be misused by spammers.

[randian]

Why didn't you click the unsubscribe link rather than report the email as spam? That's rather rude if you ask me. You said that the list was otherwise legitimate, and simply reporting it as spam creates unwarranted problems for them.

[William9]

I agree, it's being a good net citizen to click unsubscribe to a legitimate list to which you have subscribed, rather than reporting the messages as spam.

[paul29]

Originally Posted by William9

I agree, it's being a good net citizen to click unsubscribe to a legitimate list to which you have subscribed,

I did NOT subscribe to the list. The list owner put me on the list on his own initiative (got my address from a third party), not by my subscribing. I asked him to stop that practice and he declined, so it's not a pure subscription list, it's at least partly a spam list and mail sent to non-subscribers on it is unsolicited, i.e. spam, not subscription. Just because a spammer calls his list a subscription list doesn't mean that it is one. This case was sort of borderline and I wasn't super-aggressive about flagging, but I did flag a few.

Anyway that's neither here nor there. What I still want to know is if and how word got back to the sender that I had flagged the messages. I'll check the wording of the external spam reporting docs to see if this is somehow allowed, but if it's allowed then that's invasive and I have to disable external reporting.