Good on them. Now, as someone who deals with end users and e-mails with links on a regular basis, could they--and all of the other mail sending services out there--PLEASE invest some of that money in making click-tracking links less terrible?
It is so, so, so very difficult to get my users to stop clicking on phishing links when they, correctly, point out that legitimate links in real e-mails look virtually identical. Why does
Most enterprise-level email marketing software will allow (or even require) senders to have subdomains that then get used for things like click tracking links.
Mailchimp is pretty far from enterprise and is heavily geared towards small businesses and click tracking links aren't that big of an issue for small businesses.
They're a big security issue for users regardless of MailChimp's customer base. It's an area that MailChimp could assist with by encouraging their clients to clean up click tracking links.
"click tracking links aren't that big of an issue for small businesses"
False. Source: Work with small business owners daily. Email click tracking has been a feature they use for years, and now rely on to help guide content decisions.
Sorry, I wasn't clear with what I meant. Click tracking is important to anyone doing email marketing. What's less important for small businesses is branded link-tracking domains.
Part of this is on them, another for example is in enterprises with Outlook Safe Links. Personally, I think the net benefit for at least Safe Link is great as they can protect against phishing, but on the other hand I wish I could just see the original URL. I feel like whatever functionality fixes this problem could be used in that same realm too.
I feel your pain - it's challenging to have users be vigilant by checking URLs when these things happen.
That involves their customers - remember, small business owners - to set up GA and copy a load of gobbledygook through loads of forms and charts and whatnot. How's that helping their business?
It doesn't address the original problem: you want users that receive a mail claiming to come from A.com not to click on a link to B.com.
The only advantage that routing clicks through MailChimp has, is clicktracking. Clicktracking can easily - trivially - be handled serverside. Just embed per-recipient unique ids in the url.
If MC is worried about customers lying about #clicks, they coukd easily make all urls point to A.com/mailchimp?mailid=xxx&linknum=yyy.
That forces A.com to run the one thing MC sends them to sort out the clicks... which of course does the clicktracking and hides the useful info from their customers.
It would be interesting if they could work with Cloudflare, AWS, big small business web hosting providers, etc. and other people in line in processing the click to make special casing the clicktracking URL easy.
Have you ever gotten an email from Synchrony Bank (the Amazon credit card)? Everything about it looks like phishing designed to steal your Amazon ID and login. But nope, it's real. Way to go guys.
Synchrony Bank is the shittiest banking vendor I have ever encountered; cancelled my Amazon Store Card because of how horrible they are. (also the Amazon Prime Chase card gives the same 5% benefit)
That's going to take a lot of processing power to be able to handle their amount of customers on a single domain. Even loadbalanced behind the domain to multiple servers, even running kafka, probably could bottleneck it through a single domain. Regardless, even if you did A.com, you have to redirect the customer to whatever actual link they originally wanted to go too from MailChimp's server, instead of the customers server.
Sorry for not being clear.
My idea was a small file on A.com/mailchimp that takes the arguments and passes them on to mailchimp's servers (possibly already spreading, e.g. mailing1.a.com.mailchimp.com/clicktrack?click=...)
This would redirect to A.com's targeted link.
The processing power would still be needed on mailchimp's side. All the customer (A.com) does, is add a tiny redirecting script on their site.
It's similar to how one fingerprinter for android works.Get your client to forward you the user details. User only sees the client (so nothing suspicious, no 3rd party to be blocked), while encryption ensures that your client has to forward you the data - they cannot parse it themselves.
It's really not a problem to handle any number of users on a single domain, you can load balance, serve from different geos, etc.
Case in point: google.com
The real reason they don't do this is because it's a more involved set-up from the customer's side. As people mentioned, enterprise-oriented mail services will do this kind of thing but MailChimp is a long tail solution.
That'd involve subdomain delegation to Mailchimp, or some kind of server-side thing installed on a customer's site - not possible for a lot of small businesses (and a lot of large ones, too).
Why is creating a single arbitrary DNS record not possible (or even difficult)? SMB’s already have to do this when validating ownership of their domain for e.g. Google services, SSL certs, etc.
I don't know, so please correct me if I'm wrong. But isn't DNS record creation now handled automatically, and in the background, with the standard one-stop-shop site systems like Wix, Weebly, and SquareSpace?
If so, and they decided to further support integration with senders like MailChimp by auto-creating subdomains as needed, and it worked perfectly, that would make it all easier. But anything less than perfect, and users (ie small business owners) would be hopelessly lost.
If the one-stop-shop handles your domain registration, then yes.
Regardless, whoever handles the registration should have an interface to add records. For example, you'll need to add MX records to use Google or Office365 for your mail service. You'd also need to add TXT/CNAME records to prove ownership of the domain for Google Webmaster Tools, etc.
Mailchimp doesn't have to make this a requirement. They can offer it as an option for businesses who are concerned about making their mail not appear phishy, and have the competence to create DNS records.
Also, there is precedent for service vendors telling companies how to configure the appropriate DNS records (with a variation for each common domain registrar). Example: https://support.google.com/a/answer/33353?hl=en
solving that issue (providing human readable click tracking links for potentially millions of emails) would be at best very complicated.
How much do you think companies would pay for it? I think they might like it but not pay much for it.
Do you have have a suggestion as to how to fix it because everything I am thinking becomes horribly complicated?
Looking at the link destination is pretty much Anti-Phishing 101. Sure, many users don’t inherently care about this, but enterprises are trying hard to change that. Mailchimp and similar platforms totally undermine those efforts.
So do link shorteners. I don't think you can really know what link you're going to in general until it's in the address bar on the actually opened page.
At the same time google and apple do everything they can to deemphasize the url in the browser, which doesn’t help less sophisticated users learn to watch and understand what they click on.
While I agree these links look dumb (to those who take the time look), I'm quite happy as a user I can see I'm very indentifiably (?) being tracked. Also your solution you could do yourself by providing traceable links for every campaign, and not using mailchimp's stuff?
What you are suggesting is actually quite complex. Mailchimp would have to install a bunch of stuff on customers servers (which are probably run by a third party) and/or control some of their customers subdomains.
Maybe you just need to invest some money in better spam filters, and user education.
This year the Canada Revenue Service is running an ad campaign saying they aren't calling/emailing Canadians and demanding they go buy gift cards at Rexall/Shoppers Drug Mart/Sobeys in order to not go to jail for tax fraud.
I'm sorry but there is no level of user education that will protect a large organisation from phishing links. The attack surface is way too large and safety depends on how the user is feeling on any given day when a random email turns up. There are no high reliability systems that require manual user interaction on a frequent basis especially on low-effort low-concentration tasks.
I agree about the insufficiency of user-education.
I think we need go further: what we need to do is kill the idea that email is an good vector for notifications inside of big organizations (or maybe even outside of them). I should have a dedicated app with a whitelist based system that official notifications go through. This could be not only a security improvement, but also a stab at better UX, better productivity, and avoiding notification fatigue.
It is so, so, so very difficult to get my users to stop clicking on phishing links when they, correctly, point out that legitimate links in real e-mails look virtually identical. Why does
www.ecommercesite.example/products/brown-boots/buytoday
have to turn into
ecommercesite19.ie.randomdomain.otherstuff.xd/lists/email/4910/598gjweo5g8er7485hwog8u3eo8whfo8wc2o38fh38f/totallynotphishing/9384gjh34fgoiu34hgffh/noreallywepromise/?utm_stuff=2928&utm_things=morewords&utm_whyareyoustillreadingthis=lolmoney
At the absolute minimum, these e-mail campaigns should only contain click-tracking links that originate under the recognizable domain of the sender.
emails.ecommercesite.example/products/brown-boots/buytoday/4918ac7
would be so much easier to understand and use as examples when showing my users.