Cold email, one year on: it got bigger, not better

Spamhaus’ take on Cold Email

By definition cold emailing is the practice of sending unsolicited emails to individuals or businesses with whom you have no prior relationship, typically for professional purposes. As we explained here, and by the industry standard "unsolicited bulk email" definition, regardless of any personalization or so-called legitimate interest claims: cold email is spam. We stated it last year and our position has only been further cemented.

Getting validation from Industry

In November, the Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG) published a one-pager setting out its Position on Cold Email: “that using deceptive and misleading delivery methods to send unsolicited email (including cold email) is an abusive practice.” M3AAWG is a highly respected and influential body in the email industry - its members include many large senders and receivers, with some of the largest mailbox providers, such as Microsoft, Apple, Google, and Yahoo, and of course Spamhaus Project too. If M3AAWG calls out cold email as spam, then it’s spam.

And it’s not only an industry association view. Laura Atkins, Partner at Word to the Wise, started banging the drum as early as 2018 when she wrote that cold email "is just the most recent euphemism for spam". Responding to our blog post last year, she went further: “All cold emailers should realize that cold email as it’s currently being sent is vulnerable to all the consequences of spam, including a Spamhaus listing. I want to publicly thank Spamhaus for stepping up and making a public statement about this kind of mail.”

Acknowledging cold email for what it is, spam, is only the beginning. To drive real change, we have to influence what has become a thriving multi-million dollar industry.

Inside the numbers…

Tom Bartel, SVP of Data at Validity and Chair of M3AAWG's Board, recently shared research into investment activity across the cold email space that puts investor funding in this market at roughly $100 million… yes, you read that right, $100 million!

And his analysis of domain acquisition tells a similar story. Cold email operators have purchased an estimated 1 million disposable domains at an average of $10 each. That’s roughly $10 million spent purely on the throwaway infrastructure used to deliver cold email traffic and evade filtering.

Not only is this a thriving industry, it has a business model, it has a supply chain, and it even has the capital to back it.

Why should this worry legitimate senders and ESPs?

Email Service Providers (ESPs) have spent two decades building and enforcing the deliverability and consent standards that make the inbox work, from authentication, to confirmed opt-in, to the compliance teams that act on reports.

The cold email “monster” operates entirely outside of this framework. If it’s just left unaddressed, cold email will erode the trust and deliverability that legitimate senders have spent years earning. This is what makes it a shared problem rather than someone else's. For those deep in the weeds, you’re no doubt already starting to feel the impact. What Spamhaus has done about it

We did what we do best: track abusive infrastructure and list it. We cross checked a large dataset (thank you, Validity!) of known cold-email domains against our own research and found a considerable overlap among the top contributors. This confirmed we were looking at the same underlying activity, enabling us to bulk classify a large batch of cold email domains simultaneously.

Problem solved?

Well, not exactly. We’re aware that aggressive blocking pushes operators to rotate infrastructure faster. It’s been a pattern in fighting spam for over 20 years. It raises the cost but does not remove the incentive. Spamhaus has become more agile in quickly identifying and listing the infrastructure, working with email providers and registries and registrars to get abusive domains suspended. The real fix, however, would be for spammers to no longer spam or to make spam, regardless of intent, illegal. Never gonna happen!

What more is needed from industry?

M3AAWG has set the standard, and so have we, but the rest of the industry has to take action too.

Enforce your Acceptable Use Policies (AUP). This applies to everyone whose infrastructure touches cold email. We’re not only seeing it come from ESPs and other sending platforms, but from hosting companies too. We also see a lot of cold email coming from Google apps and Microsoft 365; platforms that are well positioned to apply pressure on spammers. Any provider that enables cold email, whether it’s sending it or hosting it, should prohibit the activity in its AUP and actively enforce the policy.

Share data. The more the industry can share what it sees, the faster rotating infrastructure can be identified and shut down. You can share with Spamhaus, via our Threat Intel Community.

Call out cold email. Whenever you get the chance, talk publicly about why cold email is a bad business practice: the negative impact on infrastructure, the damage it does to brand reputation, and the potential legal implications it creates under laws such as CASL and GDPR.

The more we collectively call out cold email for what it is (spam), the harder it will be to sell it as legitimate email.

Heading to M3AAWG this week? If you have thoughts or ideas on how the industry can tackle cold email, grab one of us for a chat.