Shared tracking domains expose senders to a neighbor's abuse

Transcript

From the transcript Latent Space publishes with the episode.

1. 13:29

   There's no tracking. 'Cause you can't embed the, the image. That's right. So you don't have open rates. Yeah. How do you know you have deliverability if you don't have open rates? Yeah, this is very interesting because the, the industry, there are two ways of tracking, right? You have open tracking and click tracking. Open tracking, what it does, it, it includes a one-by-one GIF, uh, image, a transparent image, and then if that image is loaded, then you detect that as opened.

2. 13:55

   The problem with that is that all the changes that Apple did recently in terms of, uh, transparency and, and data privacy, like they read the emails before it lands if they're doing the summaries and all those kinds of things. So like the open rate as a metric, as a whole, isn't really a- as reliable as it used to be because all these spam filters are, are checking that before. So then you rely on click tracking.

3. 14:23

   Now, click tracking can also be, uh, difficult because you want the URLs to match the sending domain. You also want the images' URLs to match the sending domain. That's another pattern that an abuser will do. They would host images somewhere else, point links somewhere else, and then they are sending from these domains. Yeah. I, I feel like I have, uh, used email services that would rewrite, like for the link tracking, right, they would rewrite to their own domain. Yeah. You're saying that's bad.

4. 14:51

   That's bad because what hap- We did that too at first. Yeah. And then- I thought that's normal. Yeah, but what's bad is when... and you have a noisy neighbor problem too, where if one of the customers using that click tracking is an abuser and sends a bunch of phishing, that domain might get listed on a blacklist, and then it takes maybe days or weeks to get out of the blacklist. Then you're screwed as a business. Is that not pretty common? Like, you make it very easy- Yeah... to just sign up, free tier, send a bunch- Yeah...

5. 15:22

   of em- I would assume you have a lot of spam, a lot of phishing- Yeah... but you're able to avoid, and this is why? Yeah, I think what, what was different to me, and then this is more like a philosophy, right? So I saw the, those other products and the way they behaved, and I felt like, okay, it's almost like if you are born in a society where you first go to prison, and then you have to spend like eighteen years in prison.

6. 15:46

   You gotta prove that you are a good citizen, and then you get out of prison, and now you can do the things you wanna do. I always, always felt like, no, I wanna live in a society where I'm born free, and if I make a mistake, then I m- I might be punished just a little bit, or if I do something like really bad, a bad punishment, right? So that's how I feel about that too. Like, you come in, we trust you by default. Of course, again, a, a naive way of thinking, but you know what?

7. 16:14

   We're gonna trust you by default versus make the whole platform worse for everyone because of those bad, uh, actors, right? So we trust you by default, but then what we do differently from others is like at the very first moment, ev- like when we notice something is off, like by looking at the bounce rates, complaint rates, all the feedback we get from mailbox providers, then we block you, like, very quickly, and then we chat with you.

8. 16:38

   We try to understand. And most of the time, it's just misuse. It's not abuse. So we learned that we need to differentiate. Skill issue. Yeah. [laughs] It's a skill issue. Exactly. It's a skill issue.