What Happens If You Don't Pay for Goodmail?

Bennett Haselton has written in with his latest report. He starts "Goodmail has announced partnerships with four new ISPs who will charge for "reliable" delivery of your e-mail messages if you want to bypass their spam filters. The news will probably generate another round of editorials like the ones written a year ago about AOL's plan to use Goodmail, including this one from Esther Dyson (for it) and this one from the EFF (against it)." Follow the magical clicky clicker below to read the rest of this story.

If I could ask one serious question of anyone who was defending pay-per-email, or sitting on the fence about it, this would be it: Suppose you sent an extremely urgent e-mail to your doctor or your lawyer, who for the sake of argument you're not able to reach by phone. The recipient's ISP owner happens to see the message before the user retrieves it, and realizes how urgently you need to get it through. So he moves it to the recipient's "spam" folder, and then calls you up and says: pay me $1,000 to move it to the recipient's inbox, or they'll never see it.

Does the ISP have the right to do that? If not, why not?

Perhaps you'd say that Goodmail's 1/4-penny-per-message is reasonable, but $1,000 for one message is too much. But then who decides what is "too much"? The marketplace? Then isn't the ISP admin just another player in the market, and $1,000 is what they want to charge? If you don't like it, you can go somewh... oh, wait, you can't, because there's no other way to get through to the recipient. If you ever get through to your doctor or lawyer, they might switch ISPs after they hear what happened, but should that be your only recourse?

The problem with the ISP charging $1,000 to deliver your message is not that $1,000 is "too much", but that they're charging for a service that has already been paid for. If your doctor or lawyer pays for an e-mail address, they're doing so with the understanding that their ISP will make a reasonable effort to deliver the non-spam e-mails that people try to send them. If their ISP then turns around and asks you for $1,000 to deliver the e-mail, then they're trying to double-bill for the same service, and if they block the message because you don't pay the $1,000, then the ISP is cheating the recipient out of a service that they've already purchased. And it's not just the recipient being cheated; if the recipient has an arrangement with you, as your doctor or lawyer would, then the ISP is interfering in their business relationship with you.

Now, if an ISP using Goodmail offers to let you bypass their filters by paying 1/4 penny per message, how is that different from the doctor example? Well, on the face of it, it's different in at least two ways: first, because the ISP is charging "only" 1/4 penny per message instead of $1,000, and second, they're not saying that your mail will be blocked if you don't pay, only that it might be. But are these qualitative differences, or just differences in degree?

Take the cost-per-message. I have a (verified opt-in) mailing list of about 50,000 people that I send mail to twice a week. In the aggregate, it is just important for me to get mail out to those subscribers, as it is for some people to get a single mail through to their doctor or lawyer. Also, in the aggregate, it would cost me about $1,000 per month if the ISPs collectively asked for 1/4 penny per message and threatened to block them otherwise. So is there any real difference between requesting $1,000 to unblock 50,000 e-mails, and requesting $1,000 to unblock a single e-mail, if you're just doing it because you know the sender urgently needs to get them through? (It's not a reflection of the ISP's costs -- downloading and storing 50,000 messages at 3 K each, costs almost nothing, certainly not anything close to $1,000. And again, I would argue it's a moot point anyway, because those services have already been paid for.)

And how much difference is there, really, between saying that a message (or a group of messages) might be blocked, and saying that a message definitely will be blocked? If it's bad for your doctor's ISP to call you up and say, "Give me $1,000 or there's a 100% chance that your message doesn't get through," what if they say, "Give me $1,000 or there's a 50% chance that your message doesn't get through," isn't that at least 50% as bad? You could say that in my doctor example, the blocking was deliberate, but in the case of the spam filter, it's accidental. But if an ISP chooses not to fix problems with its spam filter, then in a way it's still deliberately creating a certain percentage of cases where the spam filter will block legitimate mail, even if those cases occur at random.

There is one more difference between Goodmail and the scenarios I've described, which is that Goodmail not only lets you bypass an ISP's spam filters, it also certifies that you are trusted and not a phisher. If an ISP like AOL controls the user-interface that a user uses to check their mail, it can display the blue-ribbon "CertifiedEmail" icon next to a Goodmail-certified message. In this case, an ISP can plausibly claim that they're letting all legitimate e-mail get through, but they're still offering a benefit to Goodmail senders. The problem with this is that since phishing only works on users who are gullible to begin with, a phish could just as easily display the CertifiedEmail icon in the body of the message to try and gain a user's trust. It's all very well to say that a user should know that the CertifiedEmail icon only "counts" when it's displayed in the inbox, not in the message itself. But a user who knows that, would probably also know that their bank's Web page is not 209.211.253.169. And besides, most users of Comcast, Cox, RoadRunner and Verizon will be using their own mail clients like Eudora which won't display the "CertifiedEmail" icon anyway.

So it seems pretty clear that the main benefit of using Goodmail will be deliverability. And that's the basic Catch-22: If an ISP gives the same deliverability to non-Goodmail-certified messages, then who's going to use it? On the other hand, if an ISP gives better deliverability to Goodmail-certified messages than to other messages (much more likely), then they are to some extent misrepresenting the services they sell to their users, since users expect an ISP to make the best effort to deliver all legitimate e-mails, not just the ones from paying senders.

Goodmail likens their service to FedEx or UPS for "enhanced delivery" of paper mail as a way of getting the recipient's attention. But the difference is that if you're trying to reach your lawyer, then the office complex where he works (or the city that maintains the streets to his house) is providing the service that he expects and has paid for, namely, allowing different companies to deliver stuff to him there -- and because you have different choices, that means FedEx, UPS and the USPS have to compete with each other, and that keeps the delivery prices down. On the other hand, if an ISP blocks you from mailing their customer unless you pay their fee, then the ISP is going against what the customer expects them to do, and it is precisely that betrayal of trust that gives the ISP a monopoly on your ability to reach the customer -- which leads to them charging monopoly-style prices, like $1,000 to receive and store a few tens of thousands of messages.

There is a lot of debate about whether "the market" would fix problems of legitimate e-mail being lost. Esther Dyson's editorial was a classic libertarian defense of the free market as the arbiter of systems like Goodmail: "If it's a good model, it will succeed and improve over time. If it's a bad model, it will fail. Why not let the customers decide?" Actually I don't think the free market does fix most e-mail deliverability problems -- I've been involved in a few business that sent bulk e-mail (to subscribers who requested it and confirmed their subscriptions), and have had conversations with dozens of others, and we've all had problems sending to Hotmail, AOL, and Yahoo, and I've never, ever heard anyone say that their deliverability problems were solved by "the market". (Usually the problems just come and go, and nobody knows why.) But in a way this is all beside the point. Even if the market would stop more egregious abuses, what gives ISPs the right to charge senders for e-mail services that their customers have already paid for?

I actually met Richard Gingras, the CEO of Goodmail, and Charles Stiles, the postmaster of AOL, at a conference in Seattle last year where they were on a panel defending against the Goodmail controversy. They seemed like nice guys who were genuinely blindsided by the criticism that Goodmail had been receiving. It's easy to see the point of view of Goodmail's defenders -- if Bob wants to pay Alice to "certify" Bob, why would it be anybody else's business? It isn't, until it leads ISPs to steer people towards a system where if you want to be treated like a non-spammer, you have to pay -- even if, strictly speaking, the recipient is already paying to receive your mail.

As for the much-vaunted free whitelisting privileges that non-Goodmail senders will continue to enjoy, in the pre-Goodmail era I once found that AOL was blocking some of my mail to their users, so I called their postmaster department and learned the following facts:

• The first person I talked to, said that he checked the logs and our mail was being blocked because we didn't have reverse DNS set up. I thought this was odd because we did have it configured, but I thanked him and hung up.
• Then, I called back and got someone different. I asked them the same question and they said that according to his logs, our mail was being blocked because someone else at our ISP was sending spam. I asked him why they were blocking our IP address, if it was different from the IP of the alleged spammer; he paused and said, "Is there anything else I can help you with?", and this repeated several times as I thought my phone or his headset wasn't working, before I realized he was just being a dork.
• Then, I called back and got yet another person, and this person said that he could see our mail was being blocked because it contained banned content. I was pretty sure that was wrong, because you get a different-looking bounce if you're sending mail that contains a banned string, but I took a note of that anyway.
• Then, I called back and got a fourth person, who said that our mail was being blocked because some of their users had flagged mail from our IP address as spam. He paused for a brief conversation in the background, then came back and added, "This has already been explained to you, sir." I said that since I had gotten four different explanations in four different phone calls, I figured I could just keep calling and tallying the votes that I got for each explanation, until one of them emerged as the winner.

Much later I found out from someone else about the AOL whitelisting program, which I'm currently trying to see if it prevents us from getting blocked. But if none of the people answering the phone at the postmaster department knew or told me about it (and I confirmed that it did exist at the time), how many other organizations or businesses don't know?

ISPs adopting Goodmail say that while Goodmail senders can bypass their spam filters, non-Goodmail senders will continue to enjoy the same deliverability rates that they have in the past. That's what I'm afraid of.

Comments

The big deal about spam...

[danpsmith]

I don't get the big deal about spam. Honestly, you get more junkmail than regular mail on a daily basis, but yet there's no big call to outlaw regular postage and allow only confirmed 3rd parties to send you mail. Why the hell should e-mail be any different? If you want my opinion they should make Internet access a utility just like phone, electric and other things and regulate the piss out of ISPs so they can't start payola practices such as "send us $100 dollars or the e-mail gets it." Spam isn't a bigger deal than junkmail, it's actually less costly, so why do we care so much that we'd let them ruin e-mail?

Re:The big deal about spam...

[packetmon]

Less costly according to whom. Ever had to buy a Barracuda spam filter? Set up Spamassasin, etal. If you've ever worked at an ISP, spam isn't as cheap as you'd think. Imagine receiving and having to filter 1million plus messages of spam a day. Imagine as that ISP your NSP is passing off the extra charge to you. You do realize that inside those annoying spam messages, many are often images. Image_size * Amount_Of_Mail = Amount_of_Extra_Bandwidth_You_Don't_Need.

Re:The big deal about spam...

[ch-chuck]

you get more junkmail than regular mail on a daily basis

I don't encourage that either - in fact you can go to Direct Marketing Association and pay a buck to get on a kind of 'do not mail' like (voluntary by DMA members, not enforced by law like on telemarketers).

Another thing I had to stop was a local newspaper trying a new business model. I had canceled subscription to the regular newspaper, but they started delivering a small printing of ads and a few articles - so once a week I had to walk out on the lawn and pick up a yellow bag, what is basically garbage a motor route guy tossed there, and put it in the trash. I just went ballistic getting that stopped. I didn't ask for it, I don't want it - get off my lawn!

Re:The big deal about spam...

[geekoid]

"It wastes YOUR ISP's hard-drive..."
which comes out of the fee they charge me.

"it wastes YOUR time,"

So does snail mail spam. A lot more of my time in fact.

"and it wastes YOUR ISP's BANDWIDTH"
That comes out of the cost for doing business, which the consumer pays for.

Snail mail cost me my garbage bandwidth. Meaning I pay to have my trash picked up, and it takes room out of my trash can. Well, usually my recycle bin, but the same thing applies.

Snail mail is far worse on the environment then Spam. it take physical recourses AND substantial more energy to get to it's destination.

Since I pay 15 bucks a month for DSL, the cost of handling spam seems to be pretty minimal when spread out across a large customer base.

Re:The big deal about spam...

[geekoid]

"
The post office has to do the same route every day whether they deliver you one piece of mail or 10"

If they didn't deliver advertisements, they would only need to deliver mail once or twice a week. nobody uses regular mail for quick correspondences anymore. There is no need to deliver 6 days a week.

"I normally get about 22 mpg on my truck. Towing a trailer around with 1000 pounds of weight in it makes me get about 21 mpg even on hilly routes."

great, 1 gallon. Now multiply that bout the thousands and thousands of vehicle's used by the post office.

That doesn't even get into the energy of production of paper, ink, and the energy used to route the mail.

"Do you check your mail daily? Does carrying a couple ounces of mail to your dwelling cause you so much wear and fuel that you can measure it?"

Over time, times every person checking mail in the country, yeah, it does come to a lot. Which without advertisements would be less since you wouldn't need to get regular mail any more. see previous point.

"hey, my heat is carbon neutral and cheaper than oil/coal/gas/electric though it is offset by manual labor)"
Yeah, if you have nearby neighbors, the smoke will settle on their property until your chimney heats up. oh and don't forget of all the poisonous carcenigens you are putting in the air from the ink and paper processing materials.

"Spam is much, much more annoying to me than junk mail is. "

That's great, but overall it is still less resource intensive then regular mail advertisements.

"Spammers incur almost no cost to send out an unlimited amount of garbage. "

That is completly false. While cheap, mass spammer do pay for the privilidge. Do you think the major providers don't know when someone sends 100K of emails...in fact you can pay them to be able to do that.

"I get 100 spams a day averaging at least 30 megs a month. I have to spend time making sure my network doesn't turn into a bots, cleaning out friends machines which were turned into bots, etc."

obviously I can't speak for your network, but I have never gotten a bot, or a virus and I have been using personal computers since they existed. I just use my computers intelligently.

Re:The big deal about spam...

[daeg]

Fixing an arguably broken SMTP system with something like Goodmail isn't the way to go. It has been proposed in several forms to transition e-mail from "push" to "pull". When your computer sends and e-mail through mail.yourisp.com, mail.yourisp.com holds that e-mail and notifies recipient@domain.com "I'm holding a message for you from you@yourisp.com". It is then up to the configuration of domain.com whether the e-mail is downloaded immediately, ignored forever, or downloaded partially. This forces spammers to maintain servers. You can tie some sort of basic encryption/signature that makes each message take a small fraction of computing power to compute a key, probably some combination of sender address+receiver address+current time or something like that. This would force spammers to not only maintain active servers, but also dedicate expensive processing time to create each key individually. Once the abused machine is found, the data center or ISP can simply block mail pickups to that IP address, cutting out any additional spam that hadn't been picked up yet.

Re:The big deal about spam...

[jank1887]

And this is currently how it should be. If the spammer had to pick up a portion of your ISP costs based on the amount of spam they were sending, that would be fine. They're incurred business costs would be payed for out of their own pockets instead of being passed on to unwilling consumers, and the consumers would get a net benefit for the inconvenience. Unfortunately, the current situation enables the spammer to shift the majority of the costs of his advertising onto the consumer. If done 'illegitimately', nearly all costs are passed onto a 3rd party. Supporting the spam industry is now a significant portion of your ISP bill (ISP's should list this line item separately on the bill), it provides you no net benefit, and you have no way to remove yourself from the 'service'.

Re:The big deal about spam...

[catman]

Get rid of the "almost" and you're doing fine.

I, for one, sometimes get e-mail advertising that I do not report as spam, because it is very well targeted and the sender has good reason to believe that I'm interested in the product he's selling. But the spam (even filtered and labelled) that comes through my ISP is getting to be too much - currently I'm running a Postfix server at home and seriously thinking about getting a static IP. cbl and spamcop helps me block almost all spam at the server.

This isn't Russia, Danny.

[hal2814]

"So he moves it to the recipient's "spam" folder, and then calls you up and says: pay me $1,000 to move it to the recipient's inbox, or they'll never see it.

Does the ISP have the right to do that? If not, why not?"

You don't have to use your ISP's email. Not everyone has a bevy of choices for their ISP but everyone on the Internet has plenty of e-mail options. An ISP has the right to do such a thing as far as I can tell but if they actually tried pulling a stunt like that, they'd see how quickly they can get people to jump ship on their email services. I wouldn't recommend tying your email into your ISP anyways. You don't always have the option to take your ISP-based email with you when you move or change ISPs.

And that's not even taking into account that Goodmail is a complete sham. The only people using this will be spammers with money looking to get around your spam filter.

Re:ridiculous premise.

[HappySmileMan]

The argument of only reaching a doctor or lawyer by email is an example of how important mail could be blocked, that example is made up and the author explained it, he then went to elaborate on how HE needs to send 50,000 people mail twice a week and explained it would cost him about $1000 to do that each month.

But if you need a different example, what if you ran a large shop and ordered 10,000 chairs to sell, but then realised you made a mistake and only needed 8000... This would cost you a huge amount of money, and if the ISP had access to the email the blackmail could be huge, however it still needs to be paid to save thousands more dollars...

That is, it would have to be paid if it wasn't illegal, but there are going to be people who pay quietly without looking up laws or consulting a lawyer.

Whos mail is more precious

[CryogenicKeen]

What happens if you need to call 911 because of an emergency like you broke your leg or worse? While email isn't 911 it does seem to me that it more and more can and will be used when either the person is unable to use a phone or otherwise does not want to/can't reach the person any other way. The idea to pay a free email service extra to make SURE your mail gets to where it's going seems great but isn't this a silppery slope? Do we really want to start making extra paying people's mail a higher priority then others? "Oh im sorry sir that you missed your child's recital because the email notifying you about it couldn't be bothered to be fished out of the spam folder because X Y and Z clients already payed their "my mail is more important" stipend and we need to be priority to THERE mail." Are we just seeing the slow phase-out of freemail in the longrun?

Workable mail solution..

[mulvane]

This is something I have setup and have had great success with. Aside from the spam filters I get that are obvious "P3NI5" and such in the text, I have setup an auto response to anyone not whitelisted. Basically, if you are someone not on my white list and you send me a mail, it goes into a holding queue and sits for 5 days (like a spam folder but different in my setup). Any mail that goes here gets sent a auto-reply that basically ask them to send me another email with a confirmation string or the option to go to a web form and enter the email address they sent it from. This will grey-list the email and allow one from that sender through. From that point, I can see its grey-listed and choose to white list or remove from all list or blacklist. If I remove it, they have to repeat the process to get it through again.

AoL, i've dealt with them before...

[LullySing]

... and they are complete utter idiots/wankers. This does not even surprise me at all coming from them. While i am sure there exists some people with clue somewhere, someplace within the thing, most of the people manning the phones are ( as per past experience, numerous comments and dealing of associates, other occasions where i've kibbitzed with people having had to deal with them) :

- Insuficciently trained to deal with admins ( where a postmaster/mail line should)
- Don't have enough knowledge about how email works oin the network
- Limited network training
- No power to do shit all to REALLY help you
- Extremely bullshitty. they don't know what they're talking about, they'll just go with whatever.

This is just like their bullshit "mail report cards" they started sending back in the days. It's condescending, badly implemented ( and hence) mostly useless. ( included original rant on that lower behind supersnip). I think the whole " pay for delivery" is a dangerous slope to get onto for networked mail. At least the Sender Policy Framework makes more sense.

Shit man, it's times like these I don't miss working abuse@some.isp

==(supersnip)==

---(start idiotic message from AOL)---
Date: Mon, 5 Apr 2004 09:04:13 -0400 (EDT)
From: postmaster@aol.com
Subject: AOL email concerns for isp-where-i-work-abuse.net
To: abuse@isp-where-i-work-abuse.net
X-Scanned-By: MIMEDefang 2.39

Dear isp-where-i-work-abuse.net,
You are receiving this message via our automated "Report Card" process (which helps analyze AOL's Internet inbound mail) because our available data indicate that isp-where-i-work-abuse has risen above the acceptable threshold for complaints:

Total number of AOL member complaints: 186

AOL takes proactive steps to contact owners of mail servers whose e-mail transmissions are impairing the functioning of AOL's proprietary e-mail system, or causing significant levels of AOL customer complaints.

AOL requests that you take immediate steps to resolve the issues identified in this AOL Report Card. In the absence of a satisfactory resolution, AOL reserves the right to take measures to protect its email network and its member goodwill from any possible damage. These measures may include declining to accept e-mail transmissions from isp-where-i-work-abuse.net through AOL's proprietary e-mail network.

AOL strives to provide the best online experience possible for our members, and we pride ourselves on being intensely focused on consumers and their needs. Email is a core feature of the AOL service, and the proper functioning of AOL's e-mail system is vital to our members' goodwill.

Please review AOL's e-mail policies and guidelines, as well as other technical details concerning e-mail on the AOL network, at http://postmaster.info.aol.com/
--(end message)--

Ooohhh, AOL's proprietary e-mail network. No information that is gonna be any use in determining WHY people are complaining at all. I guess this should not be a surprise, considering this crap is coming in from AOL! So i do the next available thing , i go to the website. Result : No information that is gonna be any use in determining WHY people are complaining at all. But there's a phone number.

Result of calling 1-888-212-5537:
*dials phone*
"The holding time for the next available consultant will be more than ten minutes." ...( silence )
"Thank you for calling America online ..."
*spits water all over desk, workdesk and papers*
(musak)
(an hour later)
"Hello, this is postmaster helpdesk, can i help you?" ...And here i am explaining to the bloke on the phone the situation, namely that we are getting "Report cards" without any kind of information as to why people are complaining, with no headers or anything at all to help us.
REP:"oh, that's because you don't currently have a feedback loop with us."
ME : "huh? but we received your repor

Re:So use RSS, not e-mail.

[Aladrin]

And the rest of us aren't impressed with those who feel everyone set up an RSS feed, regardless of their actual needs. Even as a geek, I just recently found RSS easy enough to deal with that I starting watching feeds. (Google's Reader app is nice and I can see it anywhere.)

The majority of people on the internet don't even -know- what RSS is, but they know what email is, and when you say 'mailing list' they know what they're getting into.

That's not even getting into securing the information. A mailing list only goes to who you send it to. An RSS feed is either unsecured, or a hassle.

What's missing from e-mail...

[Kjella]

...is a way for someone you've opted in to, to prove it. If I wanted to subscribe to a mailing list, I shouldn't send a mail to listmaster@foo.com. I should send an email to mailfilter@myisp.com with the title "whitelist listmaster@foo.com" which would create a keypair, send the private key to listmaster@foo.com and store the public key in a database on the mail server. Then when foo.com wants to send me an email, they sign it with that key, my mail server verifies it and if it's good, it bypasses the SPAM filter.

Obviously I should be able to do a few other things like "blacklist listmaster@foo.com" which would basicly be an unsubscribe which the server would record, then let the mailing list know the next time they try to deliver mail. Same thing if that token is somehow compromised (and/or shared with partners) which start sending you SPAM. That gives pretty much all the benefits of Goodmail, of course without making money for anyone so I guess it won't happen...