Today’s guest post comes from Skyler Holobach! I’ve known Skyler forever, as one of our fellow deliverability experts in this world of email, and now she runs her own company focused on email deliverability consulting, incident response, and advising new ESPs on what features to build. Check out Threadsmith Group to learn more. -- Al Iverson
One of the most jarring aspects of working as long as I have and as deeply as I have in email is occasionally realizing how little most people actually know about it. 93% of people check it every day (source: https://www.zerobounce.net/email-statistics-report) , 100% of people complain about getting spam (source: my conversations), and I’d guess maybe less than 1% of those people know what headers are, let alone how to read them and do something meaningful. Today, we’re going to use the headers to do my favorite meaningful thing, POLITELY complaining.
First off, what is an email header? You can think of email headers like an audit trail that can help you answer the question, “What happened in between me clicking send and the mail getting to its end destination?” It’s a giant block of metadata that helps you trace back what happened to the email, determine if it’s legitimate or spoofed, and whether it’s properly authenticated. If you know a bit about how to read them, they’re also a helpful way of knowing what Email Service Provider, or ESP, sent the mail on that sender’s behalf. You can then complain directly to that ESP so they can investigate.
“Skyler, why does an ESP care about spam? Don’t paying customers get to do as they please?” If an ESP is a legitimate, good steward of the internet, they care about not sending spam as much as possible. Now for the capitalism reason: spam’s expensive. If you have a reputation for being a spammer platform it costs you future business. Deliverability issues are a major reason people migrate platforms, and Spamhaus listings mean 80% of your mail’s getting bounced. Allowing rampant abuse to go unchecked costs money, reputation, and time.
Now, before I get into this: great power comes with great responsibility. Do not inundate my abuse industry friends with direct complaints. Also, be nice when you reach out, it’s not their fault you got that spam message. If it's a brand you’ve bought from or have engaged with in some way, unsubscribe first; save abuse reports for mail you truly never asked for and have never heard of. In the example I’m giving, I’ve never heard of this spammer and only use this inbox for very specific use cases. If you’re unsure, unsubscribe or report spam.
I use Gmail, so I’m going to give instructions for Gmail here. If you’re an Outlook user and you’re trying to find headers, this will help you get there: https://support.microsoft.com/en-us/outlook/view-internet-message-headers-in-outlook. In Gmail, you’ll want to open the offending message, click the three dots in the right hand menu at the top of the mail, then click “Show original”.
You’ll get a new page with a bit of information about the mail at the top, then you’ll see the original headers below.
Eagle-eyed readers will spot HubSpot right away from the end of the Message-ID at the top. It says, “hubspotemail.net”, so in theory you could dust off your hands, say “case closed”, and go complain to their abuse address. But that’s not as fun and interesting as actually reading the headers (and the Message-ID can be set by the sender, so it isn’t proof of anything alone), so let’s dig deeper.
Scroll down. You’re going to scroll past a lot of letters and numbers. Do not panic, we’re almost there. Toward the bottom of the headers, we’re looking for an X-Report-Abuse line.
Here it is! Now we know we should be reporting the offending mail to abuse@hubspot.com. It’s incredibly helpful to provide the abuse team with the headers, so let’s scroll back up and click the blue “copy to clipboard” button...
Now we can go write an email to HubSpot’s abuse team. I recommend forwarding the original spam message and including any info you have on yourself and your email practices (for example: this address is never used to sign up for anything, I never signed up for this and believe they’ve purchased a list, etc) and then pasting the headers in. From there, Hubspot can now investigate with as few back-and-forths as possible: they know you definitely didn’t sign up and the headers help them track down which client is sending the mail. That makes their day easier, and having sat on the other side of that desk, I can tell you it matters.
One more thing: don’t expect much of a response back. If an abuse team does write back, it’s probably a form email and that’s the best you’ll get. Whatever happens to their customer’s account stays between them and the customer.
So the next time an email you never requested from a company you’ve never heard of hits your inbox, you have more options than just grumbling to me (though you’re still welcome to do so; I’ve got stories to share). Grab the headers, find the abuse address, write them a nice note, and let the people whose job it is do their thing.
