If someone can solve the spam problem in email without just manually whitelisting specific providers that heavily monitor their users, then they can completely reverse the direction of this problem. Unfortunately it doesn't seem likely someone could do that.

That would work if most spam wasn't from the cartel. I receive single digit percentage of "spam" from randoms, 95%+ is from Gmail/Google, o365 or mailgun/whatever. Not one of them can either filter their users or actually action abuse reports.

Spam probably isn't as bad as you think it is. It's not the dark old days where 99% of emails are spam.

You should self-host, so you can do the experiment for yourself. You might be surprised. You can always stop self-hosting if you don't like it.

I self host email and surprisingly do not receive any Spam (apart from the occasional cold calling support@ contact@ etc)

I agree Spam is the hardest. Setting up a mailserver is pretty easy today, e.g. with NixOS-simple-mailserver you can do it with a few lines and a few minutes of config in your DNS provider, and maintenance is minimal.

But I self-host email for ~20 years, and I have not managed to get rid of Spam without not also getting false positives.

I first used SpamAssistant, in later years Rspamd, but I feel like they are just not good enough. Also I find Rspamd config pretty incomprehensible.

Hosted email like also does not solve this, e.g. GMail filters way much (e.g. important company correspondence leading to orders almost being lost because they landed in our GMail spam, so I had to turn off the spam filter entirely).

Trivial with spam heuristics and a cheap llm today.

A combination of DNSRBL, SpamAssassin, and using different localparts for each service is working very well for me. Some spam is still getting through, but not enough to feel (heh) spammed, and amazingly I haven’t had any false positives from SpamAssassin in years.

It's not in the current providers' interest to help people avoid the current providers' advertisement or avoid paying the providers to host the customers' email.

Seems like AI is in a pretty good position to do that tbh.

Email can't really change much. The protocol is too old.

It would be better if we came up with new protocols that solve the email messaging problems and then gradually wean ourselves off email rather than trying to "fix" email.

In a sense this is already happening although instead of migrating to open protocols which solve the email problems we're migrating a lot of messaging to walled gardens which solve the problems (e.g. WhatsApp).

Wasn't bitcoin supposedly invented to do that?

Ironic given the amount of crypto spam that exists.

The biggest problem with email spam-wise is that it lacks any sort of user/mailbox authentication. The only useful signal in the meta-data is the origin domain. The protocol assumes the domain owner does some form of access-control and every message coming from the domain is equally trusted. If one has been communicating with alice@foobarizer.com and receives an appendage enlargement ad from bob@foobarizer.com they could be reasonably confident that Bob's account was compromised and communicate that out to Potmaster and Alice to be handled internally.

Of course this assumption is fully invalidated by open-access mail service providers: maintaining communication with xXx_kitty_slayer_xXx@tepidmail.com tells absolutely nothing about sincerity and authenticity of messages from DrJohnSmith@tepidmail.com. Not only there's roughly zero correlation, it could be argued that correlation is slightly negative if one does not expect out-of-the-blue contact attempts. Funnily enough, with the critical mass of non-spam migrating to providers, it becomes sort of positive signal, fueling feedback loop: even if the majority of spam came from gmail, messages from gmail would still be more likely to be non-spam than messages from rncrosoft.com, because most non-spam comes from there too.

On top of that, there's a lot of soft-spam. Companies will happily send out critical contract-related information and unwanted-unasked advertising from the very same domain and even the same address. The big providers are not shying away from selling shielding services to spam agencies.

That "someone" could - in theory - require pgpgpg signatures attached to messages and have origin-based filtering/ranking, but good luck convincing people to set up their gmail/outlook to even generate the signature, let alone publish it reliably/revocably. At the receiver end, your only reasonable bet is filtering/ranking the content. It's probably not a strictly uphill battle, but you definitely need significant amount of volume and tagging before your models become good enough and it stops to the case.

In reality, even if it sounds a bit ironic given above, the best route to fixing this is self hosting, especially in the cases where your messages are needed. The more people try to send mail from their self-hosted instances and insisted that it was the problem of the other end to complain to their service providers if they do not receive the messages, the less hegemony the cartel providers would have. And maybe we could have some sort of client auth for email.

its not really difficult to filter spam off. I spend more time dealing with physical spam in my snailmailbox than my email spamfilter

[dead]