Slashdot Mirror
Sending Mail to Hotmail Users?
Cafesolo wonders: "I'm developing a web application using PHP. It has a user registration system that sends a link via email to activate new accounts. I've found that sending mails to Hotmail accounts is very difficult, because the spam filter is very strong and it filters lots of non-junk messages. I think the spam filter blocks any email whose domain isn't in an internal whitelist (which might contain popular domains, like hotmail.com itself, gmail.com, yahoo.com, msn.com, etc). Most of my users have Hotmail emails. I can't simply tell my users to read the junk folder because most of them are not computer-savvy and that seems to be a bit confusing to them. Has anyone managed to solve this problem? Did somebody try to contact Microsoft? Is there any way to get whitelisted? Can an independent programmer get his domain whitelisted?"
Did you see this article? http://yro.slashdot.org/yro/04/05/05/1237245.shtml ?
Also, have you tried sending the email spoofing the receivers email address? You can set the "from" header to their own address. Of course, this won't help ip based whitelists, but it will help many emails make it through for some mail hosts (few users block their own email address)
Funnypics
Welcome to my world. I work on email deliverability for a financial services company, so no, I'm not a spammer. Hotmail makes two tools available to you to help you get your email delivered:
MSN Smart Network Data Services: http://postmaster.msn.com/snds/
This will let you put in your SMTP's IP address and it will give you consolidated stats on how much mail was received, and how much was filtered as spam.
Sender Score Certified: http://www.senderscorecertified.com/
This company will "certify" you as a safe sender, and Hotmail will let your emails in unfiltered. The catch is you have to pay for this.
Good luck. It isn't easy, but at least there are some tools at your use.
Grab something like SpamAssassin, and set it up to add headers telling you what rules have been triggered. Then send an email from your web application to that account, and examine the headers. While Hotmail probably don't use the exact same rules as SpamAssassin, it's an easy way to spot obvious stuff for you to fix. For example, using too much HTML, particular phrases, too many capital letters, being on blacklists, etc, can all be remedied by you without Microsoft's involvement.
I also seem to remember that Hotmail strongly discriminates against senders who don't have SPF set up, so it's probably a good idea to enable that for your domain.
Bogtha Bogtha Bogtha
My domain has a SPF record and I never had issues sending email to anyone on hotmail or other services.
c hnologies/senderid/wizard/
See:
http://www.microsoft.com/mscorp/safety/content/te
&
http://openspf.org/wizard.html
You sound like you're making some very large assumptions about what's actually triggering the spam filters at hotmail. What makes you think it's your domain, and not the crappy MTA you're using? Spammers often use non-standard MTAs that anti-spam programs have learned to identify through header analysis. Have you tested sending mail from a standard mailer like sendmail or postfix to a hotmail account? You obviously need to confirm what's actually causing hotmail to tag your mail as spam and stop making assumptions.
AccountKiller
Get yourself a hotmail account and have PHP fire off e-mails to it. Tweak as needed until you get one through that's not marked as spam.
I've noticed that Hotmail is very particular about the headers you send along with the message. If you send the message as a content-type: text/plain and specify a valid Message-ID, it should get through. Here is what I use for extra headers:
."Message-ID: \r\n";
$PlainMailHeaders= "MIME-Version: 1.0\r\n"
. "Content-Type: text/plain\r\n"
. "Content-Transfer-Encoding: 7bit\r\n"
Hope it helps.
1. Publish an SPF record. For a custom setup like yours, you can choose a subdomain just for your application and publish a record just for it, even if you don't want to use SPF for the main domain.
2. Process the bounces. Hotmail notices and ranks the source accordingly.
3. Make sure the reverse DNS for your server matches the forward DNS and that both resolve to a server name that is not obviously a dynamic IP address. Mail from a machine named customer43.dsl.bigisp.com tends to get weighted as spam for reasons which should be obvious.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Anyone else ever find themselves without a route to any of hotmail's MXes? Once or twice per month, my mail server can't make a connection to any of the hotmail MXes. The outage typically lasts 12-72 hours, but never long enough to cause a bounce (5 days). I run tcptraceroute to port 25, and it dies at a msn.net router (the last hop that responds is 207.46.37.161). I'm on a Tier-1 ISP (Internap) sending 500-1500 messages daily to hotmail (and another 10-15k to other ISPs, with no problem). I submit to Hotmail support (gesthm@microsoft.com)... they always claim the problem must be on my end, and refuse to escalate. Just grabbing straws here to see if I'm not the only one...
My hotmail inbox seems to only get mail about c14lis and v14gra. Perhaps you should use these keywords in your mail to help it get through?
Falsifying headers is illegal, but I doubt anyone will actually pursue a small-time website operator who's sending otherwise legitimate traffic.
But for many of us forging headers is an automatic death sentence. I've walked away from existing business relationships where I had non-refundable credits because a customer support request was answered with a forged header.
On the other side of the table, it's one of the few actions where I would not hestiate to recommend immediate termination for cause if I caught a member of our staff pulling that stunt. (The other actions are using the computers to perform illegal acts or to distribute pr0n/warez.)
The reason it's so serious? It shows a culture that has a casual disregard to the consequences of identity fraud. If you forge mail that appears to come from me, then who else are you sending those forged messages to? Why should I believe your answer? Trust, once lost, is not easily recovered.
(BTW this doesn't even address the original point of getting past spam filters. Like many sites I have my MTA set up to reject incoming messages that claim (in the envelope) to come from my own domains. I know who I am and anyone claiming to be 'me' is, prima facie, making fradulent claims and should be treated accordingly. The last time I checked that test, by itself, was blocking about a third of inbound traffic.)
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
I've been using a Hotmail account for about 9 years now... things were okay until Microsoft took over control. My experiences have varied after MS came in:
1. For the first year, 90% junk mails, only 10% proper mails.
2. For the second to fourth years, 50 - 50.
3. Three years back, proper mails got landed in the Junk mail folder, and junk mail in the Inbox... that's when David Coursey's (Chief Microsoft aplogist, then at ZDNet Anchordesk) mail got delivered in the Junk folder.... on second thoughts it seems sorta right now!
4. I lost interest a year ago, just 2MB box-size.. didn't check my account - and boom! all mails lost.
5. NOW: There's more than 25 MB, but it's been months since I checked my hotmail. Not much spam, but I've lost interest after getting a gmail account.
Short answer to your question: You're better off writing a utility that swaps Junk mail and the Inbox for hotmail users. Microsoft doesn't like PHP. Open up PHP and email in google, you'll find 100s of pages of Vulnerabilities, BEFORE coming to the functionality.
If you keep throwing chairs, one day you'll break windows....
I don't know this guy's target audience, but a whole lot of people don't have an ISP but still get on the net at public terminals (library, school, net cafes). They rely on free email services to have a net presence, and I think it would be sad to discriminate against them for that.
don't require users to activate the account via email.
i work on a medium sized, event driven, community website, and year after year we had the same problem - tons of people signing up at once, and a sizeable percentage of them wouldn't receive an activation email no matter how hard they tried.
this led to much customer support.
so we stopped requiring activation.
and it hasn't been a problem.
when you think about it, activation is useless. what benefit do you get out of it? you proved that some guy had access to some email account at single point of time in the past. so what? anyone who wants to get an account can sidestep your activation requirement with a throwaway email address. you're putting up a barrier to your less technically inclined customers without providing ANY benefit in return.
The best way to make sure people get the e-mail (provided it isn't thrown off with invalid SPF records), is to get them to add said e-mail address to their online address book.
Change is certain; progress is not obligatory.
Actually, sending mail to Hotmail is much worse than that.
The Symantec BrightMail filters that Hotmail uses will silently delete mail. The sender will see no indication that the mail failed, but the message will be deleted; it will NOT necessarily appear in the Junk Mail folder.
I've been using Hotmail for years, but have recently been having terrible trouble with it losing messages from mailing lists that I am on, even with spam protection set at its lowest level.
Hotmail is NOT a reliable email system.
As far as I can tell, the only real solution to this is to tell your recipients not to use Hotmail.
From what I've seen, nearly everyone has a real email account. I ran an ecommerce site for a while where I blacklisted all free email accounts as well as any email account or purchase that routed back to AOL. Those two restrictions cut the fraud down to almost nothing. I can't remember a single case where someone complained about the restriction and found they had no "real" email account they could use. A lot of people would use their work email. I did wonder if banning AOL entirely was a bit much, but I couldn't argue with the results. It elimated tens of thousands of dollars of fraud each week and cost us very in legit sales.
Ditto here, we blocked all the free email providers once we realized pretty much all our fraud orders were using them and few if any legit signups used them. Gave up forwarding to the free providers abuse departments as well.