• by daniel.c , Melinda Krueger , November 7, 2006

Dear E-mail Diva,

We are seeing an increasing number of spam challenge replies to our newsletters. We have to either reply or, in many cases, visit the e-mail supplier Web site and type in a CAPTCHA code to validate our sending address as legitimate. Currently, this trickle is manageable as a human process, but it is increasing and could soon become just too large to manage. How do large e-mail vendors manage these challenge replies?

Ian Mansfield

www.cellular-news.com

Dear Ian,

The industry seems to agree that challenge/response filters create more problems than they solve. They increase e-mail traffic volume significantly, expanding the burden on the e-mail infrastructure; block e-mail from legitimate senders without the recipient's knowledge--and can result in huge waves of challenges being sent to people whose mailboxes have been hijacked by spammers. We continue to expect that the challenge/response solution will die out as a result of these flaws, but it persists.

As a sender, you need to either draw a hard line or invest the staff time to deal with challenge/response. If you choose the hard-line approach, post a notice on your opt-in confirmation page stating that you don't respond to challenge/response messages and readers using them must white-list your address in order to receive your publication.

To get the e-mail vendor perspective you are looking for, I turned to Exact Target Director of Privacy and Deliverability Al Iverson. Al closes with another alternative to challenge/response management:

"We recognize that challenge/response filters exist, but the percentage of users using them is fairly low, and I don't see usage increasing. C/R suffers from a general ineffectiveness and a high false positive rate. I think consumers discover that C/R systems work poorly in not allowing through lots of kinds of solicited mail.

"Your bank, your online travel site, that online store you recently bought DVDs from; very few of these very legitimate senders have the resources or capability to respond to C/R requests. You'll find that most of them silently discard replies, as they come back mixed in with tons of spam, viruses, blowback, out of office replies, etc. I think after suddenly not receiving mail they want, users often rethink their use of C/R.

"Also, C/R can be a significant technical hurdle to overcome for novice e-mail users. Let's say that some father e-mails his son and receives a C/R reply. Is he going to be tech-savvy enough to understand what's going on? The experiences I've had don't make me confident that this is the case.

"We generally leave it up to our clients on how they want to handle challenges. Our automated reply management service can receive and route C/R requests upon demand."

Thanks, Al, and to you, Ian.

Good Luck!

The E-mail Diva

Send your questions or submit your e-mail for critique to Melinda Krueger, the E-mail Diva, at emaildiva@kd-i.com. All submissions may be published; please indicate if you would like your name or company name withheld.