Fighting spammers and abuse at eusend

Every shared sending service has the same problem. Signing up takes a minute, the first email goes out a few minutes later, and that is exactly what makes it attractive to people who want to send mail nobody asked for. If they succeed, the IP addresses that every other customer sends from get a worse reputation, and your password resets start landing in spam.

We want signup to stay that fast. So instead of making everyone wait, we watch what new accounts actually do, and act when the sending stops looking like a product talking to its users.

This post is for two audiences. If you're a customer, it's what protects your inbox placement. If you're thinking of using eusend for something you shouldn't, it's what's going to happen to you.

Most of them never get to send

In the last 30 days we stopped 19 accounts. Ten of them never sent a single email. Some were linked at signup to an account we had already stopped, some meant to send from a domain already on our blocklist, and the rest were suspended before their first message went out. Six more were stopped within their first three emails, before anything that could be called a campaign had started.

Three got further, to around a hundred messages each. The attempts that get furthest are the ones that teach us something, so here are four of them from the last three months.

Four attempts, and what changed after each

Every one of these is real, from the last three months. We've left out names and domains.

The comeback

An account sent a phishing run, its bounce rate went through the roof, and it was suspended automatically. Eleven hours later the same person signed up again through a different login, with a new address and a new domain. On the day, nothing connected the two.

Now: every signup is compared against accounts we've already stopped. A new account that looks like a returning one is held before it sends anything, and stays held until a person has looked at it. Coming back with a new address is not a fresh start.

The bonus blast

A week-old account sent three ordinary-looking emails to warm up. Then it sent more than a thousand copies of "Last chance to claim your bonus", one recipient per API call and paced to look like normal traffic. Nothing had bounced yet and nobody had complained, so by every reputation measure it looked like a model sender.

Now: a new account mailing the same message to large numbers of strangers through the transactional API is contained. Its sending stops at what has already gone out, and an operator is paged.

The local list

A day-old account sent an invoice lure to a list made up almost entirely of one regional internet provider's mailboxes, and rotated through dozens of made-up sender addresses so no single one would collect the complaints.

Now: both patterns stop an account. Real products have one or two sending mailboxes, and real user lists aren't built one provider at a time.

The mail merge

This one happened this morning. A day-old account sent a sales pitch to around a hundred organisations that had never heard of it. Every message was personalised, with each recipient's name in the greeting and a unique tracking link, so no two bodies were identical. Within an hour one recipient had reported it as abuse.

Now: personalising the body doesn't hide the shape of a cold list. We tested the new check against the last month of real traffic: it would have stopped this account a quarter of the way through, and it flagged nobody else.

What happens when you're caught

• Your sending stops. New sends are refused, and anything still waiting to go out is bounced back out of our queue rather than delivered late.
• Phishing gets reported. When an account we've stopped was sending a lure, the pages it pointed at are reported to Netcraft automatically, which feeds the phishing blocklists built into browsers and security tools.
• Your domains get blocked. A domain we've blocked can't be sent from or linked to by any account on eusend, so moving it to a new account doesn't help.
• Coming back doesn't work. See above.

And if you're a real customer

Every one of these checks has caught a legitimate sender at some point, and that's why most of them contain rather than ban. A contained account keeps everything it has, and a person reviews it the same day. If you've been held by mistake, reply to the email you received, or write to support@eusend.dev.

Some things are never affected:

• Mail to your own users. Password resets, receipts, notifications, mail that differs per recipient because it's actually about them. That's what eusend is for.
• Free accounts don't share your IP. Free accounts never send from the addresses paying customers use, and new paid accounts start out separate too, so a bad signup can't spend your reputation.
• Our own mistakes don't count against you. If a mailbox provider refuses mail because one of our IPs is listed, that bounce never suppresses your recipient or counts toward your bounce rate.

What we won't do

We won't tell you where the lines are. Every incident above taught us something, and the checks change as people try new things. We'll miss some. When we do, the next person who tries the same thing gets caught by what we built after the last one.

If you're sending mail people asked for, none of this will ever touch you. If you aren't, use a different provider, or better, don't send it.