There's this myth that automated spam detection is hard because spammers are all very clever masters of disguise.

No. Spammers are stupid as a shoe. They have dog shit for brains.

Automated spam detection is hard because the line between spam and "legitimate" marketing activity is a fiction.

@danslimmon There is no "legitimate marketing activity" in email. Any mail that's sent in mass of a commercial nature is spam.
@dalias
Hard to differentiate though. When Oracle's billing department produces mails that confuse spam filters..
@danslimmon

@danslimmon are you starting a church? I am in.

May i suggest marketer sacrifices? 🙃

*goes back to sharpening oddly glinting very ceremonial looking dagger*

I'll be here...

@danslimmon unsolicited marketing activity
@north @danslimmon Specifically Pointless Act of Marketing.
@danslimmon @lisamelton I read this as “automatic sperm detection”.
@danslimmon While spammers are stupid, they also use a trick to reverse spam-filter their targets: If you—as a human reader—can identify their writing as spam, when their writing is easily recognisable as spam, they don't want you as a "customer", as you are not going to go through with what they're proposing anyway.
So they are filtering their target audience by adding enough typos etc.

@danslimmon

that and that the big boys, like google and outlook, who like to think they are too big to block, are huge sources of spam and refuse to clean up their own customer bases. they make money on spammers, not legit users bombarded with spam.

@danslimmon just block all legitimate marketing emails problem solved
@azonenberg @danslimmon most spam I get is badly formatted and gets rejected by postfix even before my spam filter gets to see it. The most common fail is no reverse DNS.
And my spam filters then rejects most of the rest, they don't even get into my spam folders.
So most of the marketing emails I get to see are from companies I have bought from in the past and I've decided I want to see when they are running sales: useful for items I regularly buy such as bike brake pads.

@marjolica @azonenberg @danslimmon

If we blocked no reverse DNS, I'm not sure there would be anything left.

@azonenberg @danslimmon unfortunately, there are, for example, banks who will stop sending you transaction notices if you report their spam as spam
@danslimmon It's a cat and mouse game. Every successful spam detector becomes a useful pass/fail test for future spams. So no matter what blocking path you run, they always find a new route.
@danslimmon at least one email provider seems to err on the side of "That person who emails you three times a week mentioned a product, they must have suddenly turned into a spammer so we'll block them and not tell you"

@danslimmon

Here's a foolproof solution to spam, except its one part of a new Internet ecosystem, a set of technologies that must all exist, in order to work, and are not much use by themselves.

It's an ambitious vision, and I am bringing it to life. Would appreciate your thoughts:

https://rant.li/ashwin/visions-for-a-new-web#spam

Visions for a New Web

( Web De-enshittification, Ethical AI, Worker-owned Co-Ops & Wealth Redistribution ) Table of Contents Introduction Identities — t...

The Moving Finger
@danslimmon that, and spammers use the same systems as "legitimate" marketing activity. i got inbox bombed by zendesk support tickets a few months ago.
@danslimmon And by implication, marketers are stupid as a shoe. They have dog shit for brains.
@danslimmon that is a very good point!
@danslimmon spam blockers are also dumb as wood, like aws that puts email receivers in a blocklist as soon as they bounce *once*.
@danslimmon
Legitimate marketing should be treated like spam. Maybe it will improve in order to evade detection. If not? Nobody cares.
@ml

@danslimmon I personally find that greylisting + greytrapping removes the obvious ones, and saves a lot of electricity plus wear and tear on the poor servers doing content and header filtering.

My greytrapping and misc retrospective is hopefully useful to others too: Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off? https://nxdomain.no/~peter/eighteen_years_of_greytrapping.html - with references at the end.

Eighteen Years of Greytrapping - Is the Weirdness Finally Paying Off?

@danslimmon Cory Doctorow blogs about administrability which I think is relevant to this case. https://pluralistic.net/2026/03/25/fact-intensive/#market-definition
Pluralistic: The cost of doing business (25 Mar 2026) – Pluralistic: Daily links from Cory Doctorow

@danslimmon As someone who has been dealing with spam in wiki environment I think this is a bad take. Automated spam detection is hard because we don't want to accidentally target legitimate users. And legitimate user activity sometimes may look like spam to a dumb machine code.

I can only guess what you mean by a "legitimate marketing activity", however implication that it's easy to make automated spam detection system that would target all corporate advertising is silly.

Context is always important and no automatic spam filter can judge it better than a creature can.

I do agree that spammers are insanely stupid, that I did notice after years of working in the field.

@danslimmon This reminded me of that one Twitter thing where they tried to develop an automated system to combat hate posts from white supremacists, but had to shelf it because it would mark posts from official GOP politician accounts

https://www.businessinsider.com/twitter-algorithm-crackdown-white-supremacy-gop-politicians-report-2019-4

Twitter reportedly won't use an algorithm to crack down on white supremacists because some GOP politicians could end up getting barred too

Twitter used an algorithm to crack down on ISIS-related tweets, but an employee said an algorithm targeting white supremacists could bar GOP figures.

Business Insider
@danslimmon I'd say legitimacy is created through active consent, opt-in only. Because when I absolutely *want* to receive 'product news' from the people whose stuff I enjoy using every day, I don't consider it spam at all.
@danslimmon Honestly, the hardest thing in email anymore is getting your legitimate emails through to the big three when you aren't using their services. I do not regret leaving gSuite or whatever they call it this month, but managing one's MX reputation can be a pain in the ass.
@nuintari
Try managing it when you move servers.

My current Algo:

- Get the new server
- Add the new server to SPF, and add it as low-prio MX (but don't run anything on port 25, yet)
- wait a month
- cross fingers
- pray to the gods of email. Like, *really* hard
- switch servers, but keep the old server around, just in case
- monitor results
- if problems occur: switch back and fix
@danslimmon

@danslimmon From a legitimate mail (not even marketing) that I intentionally subscribed to:

X-Spam-Status: Yes, score=5.323
tests=[DIRECT_LOW_CONTRAST=2.499, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, DMARC_PASS=-0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25,
HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.1,
MISSING_HEADERS=1.021, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,
REPLYTO_WITHOUT_TO_CC=1.552]

@danslimmon

Woof, so much this. I get so much "spam but supposedly not spam" in my line of work. It's nuts.
And it's very hard to attack the spam as spam because my email is (and kinda has to be) public.

@danslimmon

A number of times, at a number of different organizations, I've asked *my employer* (and their partners) to please do a better job with their email requests for action so as *NOT* to "check off" a number of issues in their emails that are literally in their own required computer security training. 💢