On November 11, 2008, McColo Corp, a small hosting company in San Jose, lost its internet connection. Its upstream providers, Global Crossing and Hurricane Electric, cut it off after reporters showed them evidence of criminal activity on its servers. Federal agents were not involved, but the drop in spam was real: estimates ran from about 50 to 75 percent, and IronPort put it at roughly 66 percent. Spam was back to its old levels within months. The big change since then is where the pressure on spam comes from. Today it is mostly mailbox provider rules, such as the Gmail and Yahoo bulk sender requirements that started in February 2024 and Microsoft’s Outlook.com rules from May 5, 2025.
How one hosting company carried so much of the world’s spam
In mid-November 2008 many inboxes suddenly got quieter, because one of the biggest hubs of the spam business had gone offline. McColo was a fairly small hosting firm, but its servers acted as the control centre for a large share of the world’s spam. Researchers found that the master servers of major botnets, including Srizbi, Rustock and Warezov, were hosted there. A botnet is a network of infected home PCs that sends spam on command.
McColo’s customer list did not stand up to scrutiny. According to the reporting at the time, its customers included operations selling fake pharmaceuticals and knock-off handbags, plus sites offering child sexual abuse images, all promoted by email. Security groups had complained for months. McColo’s response was to move the offending servers to different parts of its network rather than shut them down.
The end came when the Washington Post’s Security Fix blog, run by reporter Brian Krebs, took its findings to McColo’s upstream providers. Hurricane Electric said it cut every connection to McColo within an hour of seeing the evidence.
How far spam volumes dropped
Global spam fell sharply as soon as McColo’s servers went dark. IronPort, the email security company, reported a drop of about 66 percent by the evening of the shutdown. The Washington Post, reading SpamCop’s live graph, saw volume fall from about 40 spam emails per second to around 10. SpamCop is a spam-reporting service whose public statistics were widely used as a gauge.
Other measures were less dramatic. Dark Reading quoted SpamCop data showing an average of 11.9 messages per second over the next 24 hours, against a monthly average of 30.1. A later analysis of a UK ISP’s mail traffic by Cambridge researcher Richard Clayton warned that the headline drops of 60 percent or more told only part of a more complicated story. Every source agrees on the direction, though: the steepest overnight fall in spam seen up to that point.
Why the hosting company was blamed
When it went offline, McColo’s long-term fate looked grim. Mark Rasch, a former cyber-crime prosecutor for the Justice Department, explained the legal question in the Associated Press coverage. Liability usually depends on whether a host knew, or reasonably should have known, what its customers were doing. “It’s a little bit like a landlord who owns a building and sees people coming in and out of the apartment complex constantly at all hours and not suspecting there may be drug activity going on,” he said.
Playing dumb was a weak defence. With months of public complaints on record, McColo almost certainly knew what was running through its servers.
McColo never returned to normal service. On November 19, 2008, it was briefly back online through a backup connection, long enough for some botnet operators to send new instructions to their infected machines, and was then cut off again. SecureWorks researcher Joe Stewart estimated that about half a million bots lost contact with their command servers, Srizbi’s above all. Within weeks a new version of Srizbi was reconnecting to replacement servers in Estonia, according to FireEye. Symantec’s April 2009 report found spam back at pre-takedown levels.
What it meant for legitimate senders
In 2008 this was a major win for every legitimate email sender, and for anyone buried in irrelevant, spammy email. The lasting lesson was the rebound. Taking down one host bought only a few quiet weeks. So mailbox providers stopped relying on takedowns and started judging every sender by authentication, complaint rates and reputation.
For legitimate marketers today, that is the system that decides inbox placement.
The sender rules that apply in 2026
The three biggest consumer mailbox providers now publish formal requirements for high-volume senders. Gmail began ramping up enforcement in November 2025: mail that fails its requirements can get temporary or permanent rejections, not just a trip to the spam folder.
| Provider | Who it applies to | In force since | Authentication | Spam complaint rate | Unsubscribe |
|---|---|---|---|---|---|
| Gmail | 5,000+ messages a day to personal Gmail accounts (once you hit that, you count as a bulk sender for good) | February 2024, enforcement stepped up November 2025 | SPF, DKIM and DMARC (at least p=none), with alignment | Aim below 0.1%, never reach 0.3% | One-click for marketing mail, honoured within 2 days |
| Yahoo | Bulk senders | February 2024 | SPF, DKIM and DMARC (at least p=none) | Keep below 0.3% | One-click, honoured within 2 days |
| Microsoft Outlook.com, Hotmail.com, Live.com | 5,000+ messages a day | May 5, 2025 | SPF, DKIM and DMARC (at least p=none), aligned | No fixed figure published | Clear, working unsubscribe link recommended |
A minimal DMARC record that meets the baseline for all three looks like this:
_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
One-click unsubscribe uses these two headers, defined in RFC 8058:
List-Unsubscribe: <https://example.com/unsubscribe?id=abc123>, <mailto:[email protected]>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Most major ESPs add both headers automatically. Check by opening a sent campaign in Gmail and looking for the “Unsubscribe” link next to the sender name.
Where the full story ran
The Associated Press story on the takedown ran on msnbc.com at the time and is worth finding in news archives. Thanks to Greg Cangialosi for flagging it when it broke.
FAQ
Did the FBI or federal agents shut down McColo?
No. McColo went dark when its two upstream bandwidth providers, Global Crossing and Hurricane Electric, cut its connections on November 11, 2008. They acted after the Washington Post’s Security Fix blog showed them evidence of botnet control servers and illegal sites on McColo’s network. It was a private decision by the network providers, not a federal raid.
Did spam stay down after McColo went offline?
No. Spam stayed low for a few weeks, then climbed back as botnet operators rebuilt their control servers elsewhere, Srizbi in Estonia among them. Symantec’s April 2009 report found volumes back at pre-takedown levels. Mailbox providers learned from this, which is why today’s filtering depends on sender authentication and reputation rather than chasing individual hosts.
Can a hosting company or ESP be held responsible for its customers’ spam?
It can be, especially if it knew or should have known about the abuse, which is the point Mark Rasch made about McColo. Under CAN-SPAM, the FTC says both the company whose product is promoted and the company that actually sends the message can be held legally responsible. That is why reputable ESPs screen new accounts, watch complaint rates and suspend senders who mail purchased lists.
What spam complaint rate do Gmail and Yahoo allow?
Google asks bulk senders to keep their user-reported spam rate below 0.1% and never let it reach 0.3%. Yahoo uses 0.3% as its ceiling. You can see your Gmail spam rate in Google Postmaster Tools once your domain is verified. If it creeps up, cut inactive subscribers first.
Do these rules apply to small senders?
Gmail’s and Microsoft’s formal thresholds start at 5,000 messages a day, but Google requires SPF or DKIM from everyone who sends to personal Gmail accounts. Microsoft also recommends the full setup for all senders. Setting up SPF, DKIM and a p=none DMARC record takes under an hour with most ESPs, so treat it as the baseline whatever your volume.
Is it ever safe to buy an email list?
No. Purchased lists are full of spam traps and people who never agreed to hear from you. That drives up complaints and bounces, and can get your domain blocked. Many ESPs ban purchased lists in their terms of service, and in many cases sending to them breaks GDPR.
Sources
- Google: Email sender guidelines
- Google: Email sender guidelines FAQ
- Yahoo Sender Hub: Best practices
- Microsoft Tech Community: Outlook’s new requirements for high-volume senders
- Microsoft SNDS: Policies, practices and guidelines
- FTC: CAN-SPAM Act compliance guide for business