Confusion About GMail Vs Non GMail Based Email

Long ago, when diagnosing a problem thought to involve email, in Blogger Help Forum: Get Help with an Issue, we would ask a very simple question

Is your Blogger account based on a GMail - or non GMail - email address?

And we would carefully add

Please, do not state your email address, here!

The latter request was to prevent theft of peoples Blogger accounts.

Now, in many cases, we must qualify the question of email address. We also ask.

Is your email provided by your employer, ISP, or school network?

and even

Do you read your email in a browser window, or a local email client?

Modern email distribution is not always homogeneous.

Both questions reflect the complex nature of email delivery, that is a part of Internet reality.

Few people can accurately diagnose their problems, based only on the simple question

Is your Blogger account based on a GMail - or non GMail - email address?

The lines between GMail, and non GMail email accounts - and addresses - are not absolute, any more.

Both GMail and non GMail addresses may be used in a local network.

GMail, and non GMail addresses, alike, may use GMail browser based email, in delivery and display. And GMail accounts may use non GMail email systems, for addressing, delivery, and / or display.

These variations can lead to interesting scenarios such as mysterious loss of blog membership invitations, and of email subscriptions. And options for Blogger account recovery become more complicated - with password synchronisation issues, between the email account and the Blogger account.

Thanks to Google Apps based domains, and the ability to provide non GMail addresses which use GMail, anybody can use a non GMail address with GMail based delivery and display. Some people have even setup Blogger accounts, based on Google Apps based email addresses (again, appearing to be non GMail based) - though this is not recommended.

Managed domains may use GMail delivery, and a non GMail email address.

Corporate email systems, ISP provided email, and schools (of all grades, elementary through university) may use Google Apps based email. Many large local network based email systems have been "upgraded" to use cloud based email, such as GMail, for delivery and display. The results are not always beneficial.

And, thanks to "push / pull" GMail options, where an individual GMail account can be configured by a knowlegeable account owner, even individual account owners can use a GMail address, with non GMail delivery and display - or can use GMail display, for non GMail based address / delivery.

With computer owners who do not care or know about what email system they use, with where the individual messages may be filed, and with security filters that update without notice, loss of email messages is common.

Bounced email does not get dropped into the "Bulk" / "Spam" folder.

Note that "bounced" email may not be treated as spam. Some "bounced" email never gets as far as a spam filter - it may simply be rejected. You will look, in vain, in the "Bulk", "Inbox", and "Spam" folders.

This will interfere with account recovery - if you can't find the password reset email, how do you recover control of the account?

The simple question

Is your Blogger account based on a GMail - or non GMail - email address?

just is not accurate, when diagnosing all Blogger problems.

Private / Team Blog Owners, Using Non GMail EMail

For some time, we've known about a problem with non GMail based Blogger accounts, and comment moderation / notification email.

That problem, though mildly annoying to the blog owners affected, has an easy workaround - use a GMail based email address, for comment moderation / notification. That's a quick 15 minute fix.

1. Setup a GMail account, if necessary.
2. Change the comment moderation / notification email addresses, for the blog(s) affected, to use the GMail email account.

GMail email accounts are, after all, free.

Besides the ease of putting a workaround in place, that problem is not all that severe. The problem with comment moderation / notification email, being filtered, only affects blog owners who moderate before publishing. Owners who moderate after publishing can always use the Blogger dashboard Comments wizard, at their convenience, to moderate.

This week, we realised that the base problem - rejected email because of non GMail based Blogger accounts - may also affect owners of private / team blogs, who have prospective non GMail members. This specific problem probably affects less blogs - but it won't have as easy a workaround.

Owners of private / team blogs, who use non GMail based Blogger accounts, may not find an easy workaround for the problem of Blogger blog membership invitations being rejected by a non GMail email system.

The base problem, as it affects comment moderation / notification, is obvious. The owner of an affected blog will see all comment moderation / notification email, sent to him, rejected by his own non GMail email system. Anybody who owns a blog that's affected will be sending all comment moderation / notification email to the non GMail email system.

The base problem, as it affects private / team blog membership invitations, is more subtle. This problem will affect blogs owned under non GMail based Blogger accounts - and / or when sending invitations to prospective members who use non GMail email systems. Email within Google - Blogger to GMail - should not be subject to the same filtering, since the email will actually originate from a Google server.

With all that, this problem will be more annoying, in that it will involve email rejected by the prospective member email system - not by the blog owner email system. Prospective blog members won't likely be receptive to changing their email addresses, just to receive a membership invitation. Also, the blog owner may not always see the email rejection - and may not know that the invitations are being dropped - and may not be found in the "Bulk" / "Spam" folders.

To avoid this problem, membership invitations, from any affected blogs, will have to have be sent from a GMail based Blogger account. This will require a GMail based Blogger account, added as an additional administrator - and it will involve the known risks of having an extra administrator account. Only administrators can send membership invitations.

This problem will probably have less exposure than the one with comment moderation / notification email - but to the blog owners affected, it will seem more severe. It will actually prevent prospective members, using non GMail based email systems, from joining the blogs affected. And, it will require a blog owner to add a GMail based Blogger account, as a blog member.

Please, Do Not Publicise Your Email Address

We've seen a few reports, recently, about stolen blogs, in Blogger Help Forum: Something Is Broken.

Why is my blog not on my dashboard - and why is somebody else publishing, and using my name?

There are so many reports from people who are not using Google "One Account" login properly, that the significance of this problem report was initially overlooked.

More than a few such reports started with the blog owner email address being openly disclosed - generally on the blog, or in comments. Too many blog owners want to be contacted - and they innocently provide their email addresses as a contact point.

We've known, for years, about disclosed email addresses, and brute force password guessing. That is not the only way your email address can be used, to gain access to your Blogger account, however.

Google recently had to deal with a very carefully executed hacking project, where Blogger and Google account owners received some well phrased advice, in their email.

Google treats policy violations and invalid activity very seriously in order to protect the users, publishers, and advertisers who make up our advertising ecosystem. While we usually notify publishers and take action for policy and invalid activity at the site level, there may be times when we will need to suspend or disable accounts due to policy violations or invalid activity.

Our hope is that you will be able to resolve your policy issues during the suspension period using This Link

I'm betting that the above message was written, very carefully, by hackers who studied the phrasing and wording of the many abuse / spam / TOS violation notices, sent out by Blogger Support constantly.

Many of the recipients of the email are the same crowd that I encountered, several years ago, when we saw similar numbers of reports about the same type of stolen blogs. The owners typically

• Post their email address, or provide it for contact, visibly.
• Participate in comment based networking, on their blog, and openly state their email address.
• Participate in comment based networking, on similar blogs, and openly state their email address.

Each of these activities can be used, by the bad guys, to build lists of email addresses, of people who can be easily persuaded by an email message, to resolve their policy issues using the link provided. And this led to a number of reports, in the forums, about stolen blogs - and mentioning email, offering to sell the stolen blogs back, to the rightful owners.

If you want contact from your readers, there are more safe ways to allow this.

• The Blogger "Contact Me" form.
• Blogger based comments, with email address concealed (and not stated openly).
• Google+ based comments / networking, with email address never involved (and not stated openly).
• Setup a second email account. Use one email account for contact - and a second for blog ownership.

All of the above contact options give you a possibility of hearing from and / or networking with, your readers - and none of these options require you to disclose your ownership email address.

Just don't disclose your email address, to the world at large. Your email address is one half of the security measure, as designed by Google - that prevents unknown individuals, from taking control of your Blogger account and your blogs.

Finally, if you are not yet using Google 2-Step Verification, this is the time. If you were one of the victims of the recent attack, you know the despair. If not, you truly don't want to be. In either case, you should really want to protect your account, and your blogs.

Confusion From Email Spam Detection, And Non GMail Email

We're seeing a few reports in Blogger Help Forum: Something Is Broken about problems with email, sent by Blogger, when the destination is a non GMail email system.

Some email systems verify the sending email address, against IP address. With these systems, email which originates from a Blogger account that's based on a non GMail email address, and comes from a Blogger / Google IP address, is going to present a problem, to the account owners.

If your Blogger account (your readers Blogger account) is based on a non GMail email address - and your blog provides any of various "notification" / "subscription" services, this can be a problem.

• "BlogSend" (aka "Email posts to") based subscriptions.
• Comment moderation or notification email.
• FeedBurner feed distribution, such as "Subscribe by Email"
• Your readers like to comment authenticated, and select the "Email follow-up comments ..." option.
• The Blogger supplied "Contact Me" accessory gadget.

You're going to have email "bounced" by some (non GMail) email clients. This will be a similar problem, if a reader sends you email - or Blogger relays you email based on your reader request, as in comment notification or contact form entries.

Note that "bounced" email may not be treated as spam. Some "bounced" email never gets as far as a spam filter - it may simply be rejected. You will look, in vain, in "Bulk", "Inbox", and "Spam" folders.

Blogger originated email, to certain email clients, will be bounced, because Blogger sends the notification / subscription email with your Blogger account (your readers account) mentioned, as the sender.

With Blogger comment moderation / notification email coming from a non GMail based Blogger account, and sent from a Google IP address, an email client such as AOL, HotMail, or Yahoo, which verifies email address against IP address, is going to reject the incoming email message. This is because "Sender Policy Framework", which AOL, HotMail, Yahoo, and other email systems use, detects the originating address as "spoofed".

Spoofing is a common technique used by spammers, in hiding their email identity. Most email based spam is spoofed - so email systems, which use DKIM or SPF filters to identify spam, will bounce any messages which do not verify properly - when IP address and originating email address are compared.

The problem may also involve comment subscription email. This may result in bounce messages being sent to the person attempting to publish a comment. This causes more confusion.

The solution, to the problem with moderation / notification email, is simple - but unlikely to satisfy many Blogger account owners. You will have to use a GMail email address, for comment moderation or notification. Until Blogger Engineering figure a better way to send the moderation / notification email, email clients such as AOL, HotMail, and Yahoo will have this problem.

If the blog owner changes ownership of a blog, from a non GMail based Blogger account to a GMail based account, and neglects to change the comment moderation / notification email address, the bounce messages will likely continue. What might happen with comment subscription email is yet to be determined.

This problem, as discussed above, affects the comment moderation process. While annoying to some blog owners (as noted, those using non GMail based Blogger accounts / email addresses), the problem is not all that severe. Affected blog owners can use the Blogger dashboard Comments wizard, to moderate comments. Also, blog owners, who moderate comments after they are published, may not even notice this problem.

This problem may also affect membership invitations to private / team blogs This will be a more severe issue, in that this problem will affect all blogs with owners using non GMail email addresses, and with prospective blog members on large non GMail email systems - because there will be no dashboard based wizard - and no possibility of moderation after publishing.

The involvement of Google Apps based (non "gmail.com" Google email) Blogger accounts, and Blogger originated email, is yet to be studied. Also please note that Blogger account email addresses, and comment moderation / notification email addresses, do not have to be the same - and this may cause still more confusion.