Is A Catch-All Address Worth The Spam?

No brainer by tarquin_fim_bim · 2004-07-17 11:14 · Score: 4, Insightful

If the mail is from an intelligent human being they will generally conclude from the returned mail that they have erred, and readdress it accordingly. In the event of any other outcome you are probably better off not receiving the mail.

Re:No brainer by Anonymous Coward · 2004-07-17 11:27 · Score: 2, Insightful

Having worked end-user tech support, I think you're overestimating the intelligence of the average email user :)

You'd be surprised at the sheer volume of users who invert a couple of letters or add a space in the middle of the address, and then *insist* that it's spelled correctly, and something must be wrong with our server for not delivering the mail properly to some random domain (not hosted by us). And yes, if they don't believe us over the phone we get them to forward the bounce message to us so we can confirm that.

So, if the concern is old Mrs. Pepperpot isn't going to remember the proper address to type and may in fact enter it into her email address book incorrectly, that's actually a pretty fair assumption.
Re:No brainer by tarquin_fim_bim · 2004-07-17 11:48 · Score: 2, Funny

I've had more than one IT Manager specify to me that their email address is 'lower case', so I stand by my original post.
Re:No brainer by studerby · 2004-07-17 11:49 · Score: 4, Insightful

I don't think it has anything to do with intelligence, per se. I've seen an MD/PhD with an annual reseach grant total of $100 million struggle with this; I had to go to train his office manager on how to update his mail aliases, 'cause the mail client he liked was funky. If it wasn't in his alias list, and therefore clickable, he'd fubar it about 10% of the time and force the manager to fix it right now , 24/7, and he never understood anti-spam obfuscation (his staff filtered his incoming email for him).
His time was very valuable and he just wanted it to work.
Of course, the odds are good that nearly 50% of the people out there are of below-average intelligence, so any plan has to deal with both ends of the bell curve.

--
.sig generation error:468(3)
Re:No brainer by geminidomino · 2004-07-17 11:55 · Score: 4, Insightful

I agree. I bought my own domain as well, and I turned on a catch-all address (called "spamtrap") specifically TO catch spam. That's all it does catch. If someone types your address wrong, they should be smart enough to figure out "55x No such User" (or whatever the error is) and double-check the address. Anyone saying "random" spam is far less than targeted probably doesn't run a mailserver and watch the dictionary attacks mount up in the log file. "adam@domain", "anthony@" all the way up to "zachary@" (not to mention the various permutations of aaabbbccc, etc...). Unless you're trying to track where the spam is coming from (by reading recieved: headers, not "From:" lines), a catch-all address is nothing but a spam-catcher.
Re:No brainer by Anonymous Coward · 2004-07-17 12:05 · Score: 5, Insightful

Well, frankly I *would* consider that as a measure of intelligence (at least to some degree).

For instance, if a user:

- has used a computer for a number of years (by the sounds of it the very same applications for that same time)

- depends on using the computer for important work

and still can't use it properly (and won't take the time to actually *learn* to use it properly - eg, basic typing/clicking skills), I consider that an intellectual defect.

It's like any other field - if you depend on a particular tool, you have to be able to actually use the tool properly or you'll mess things up repeatedly. And if you do mess things up on a regular basis, that's no one's fault but your own.

Think of all the "valuable time" he has wasted by simply not learning to use his tools.
Re:No brainer by Scarblac · 2004-07-17 12:51 · Score: 3, Informative

I may be totally mistaken, but I thought that using a catch-all address means no "55x no such user" errors are sent anymore? There is such a user, and it's mapped to the catchall address.

--
I believe posters are recognized by their sig. So I made one.
Re:No brainer by tarquin_fim_bim · 2004-07-17 13:16 · Score: 3, Insightful

That's as maybe, RFC 822 suggests otherwise, with a couple of exceptions.
Re:No brainer by pegr · 2004-07-17 13:48 · Score: 2, Funny

I've had more than one IT Manager specify to me that their email address is 'lower case', so I stand by my original post.

IT Management... Where the less you know, the further you go! (I guess it's because you can "relate" better with the average 1D10T...)
Re:No brainer by macdaddy · 2004-07-17 14:23 · Score: 2, Interesting

If a person fat-fingers an address and it is sent to the wrong user on your system you are required to send a DSN. Have you never read the relevant RFCs to administrate a mail system? That should be a prerequisite before being allowed to join the Internet community as a mail administrator.
Re:No brainer by utopyr · 2004-07-17 14:41 · Score: 3, Interesting

Ha!--a few years ago, acustomer wrote to me, asking that his e-mail address in the database be corrected to the proper case mixture--his sysadmin had told him it was important--I responded to his address, all lower-case--"If that is true, you are not reading this." His reply was gracious.
Re:No brainer by Christopher+Cashell · 2004-07-17 15:47 · Score: 2, Informative

Would you to elaborate as to which 'UNIX systems' you might be refering to?

Particularly as this is contrary to common e-mail message standards (see RFC 822, among others).

I know I personally have not come across any non-broken SMTP servers that are case sensitive.

--
Topher
Re:No brainer by SoupIsGoodFood_42 · 2004-07-17 16:18 · Score: 4, Interesting

If I send a letter to you, and it's addressed like this (pretending that the following is your address):
Joe Sixpack
Street, City etc...

You'd expect to get it.
If I sent a letter, but with the name in any of these variations:
JoeSixpack
J Sixpack
Joe T Sixpack

You'd still expect to get it, right?
Now do you understand why people are telling you it's spelt correctly, when infact there's an extra space in there?
Perhaps it's the original designers of the email systems we use, who's intelligence has been overestimated. Because they made addresses far to easy to get wrong.
Now, as a web designer. I understand why these things are that way. But many--including intelligent--people don't understand these little technicalites. Because the expectations of other things in life has taught them differently.
Re:No brainer by paz5 · 2004-07-17 16:44 · Score: 2, Interesting

With my catch all address (that is now off) the biggest problem was not receiving spam its self, but receiving error reply's sent back to my domain when someone was sending out random spam with the from feild being a random address from my domain. I tried getting it stopped and tried appoligizing to people that actuly got the spam and asked to be taken off the list, however the sheer number of them forced my to just get rid of the catch all address.
Re:No brainer by mysidia · 2004-07-17 17:36 · Score: 2, Insightful

It's not true that catch all is necessarily a violation of any RFCs.

Simply put the situation with catch all is that any possible user exists.

If you accidentally sent your mail to nillgates at yahoo.com instead of billgates at yahoo.com; chances are "nillgates" is also a valid user.

Hence no delivery error occures, and it's perfectly fine.

The MTA isn't required to read minds and determine if the user made a typo. Only to act based on whether the destination mailbox exists are not.

And of course, for catch all... every legal mailbox does exist.

Certain addresses like postmaster@ have to work and have to go to a human, but there's no requirement that ppostmaster@ be considered a typo: after all, the user can exist!
Re:No brainer by RedBear · 2004-07-17 17:59 · Score: 3, Insightful

As you have just demonstrated, having a PhD/MD does not equate to intelligence. What a PhD often equates to is mere perserverence shown by the fact that someone trudged through 7-10 years of some sort of schooling and wrote a hundred page thesis with mostly complete sentences. Now, after accomplishing that, this person you've described (and many like him) has a framed certificate on his wall and a complete inability to learn how to properly use a tool that he uses every single day. This is the very definition of moron, someone who can't learn.

But probably the main problem with folks like him is that after going through 7-10 years of schooling he is now "educated" and therefore doesn't need to listen to you or anyone else or take 5 minutes to learn how to do some minor thing correctly the first time. He's got that framed certificate on the wall and his "office manager" to keep him in this "educated" frame of mind for the next 40 years. Doesn't matter how smart you are now or were in the past if your mind is closed to further learning.

If his time was so valuable he would spend an hour sometime and sit down and learn to use the tool, rather than continually breaking the tool and asking someone else to always be there to fix it.

Of course, none of this precludes the fact that 90% of the time the software could be made easier to use in the first place. But it doesn't mean a PhD is a genius. Most of them are just consistent hard workers, and there's something to be said for that too, no matter what their intelligence level.
Re:No brainer by SplasPood · 2004-07-17 18:53 · Score: 2, Insightful

I have a customer who has complained on *3* separate occasions that they cannot email sales@randomdomain. When we inform them that they need to have a top level domain on there they *insist* it worked before.

After 3 or four emails/calls they finally get the point. Until a few weeks later when it starts again.

Argh.
Re:No brainer by Albanach · 2004-07-17 21:08 · Score: 2, Insightful

I've had more than one IT Manager specify to me that their email address is 'lower case', so I stand by my original post.
Seems quite reasonable. RFC 821 says:
For some hosts the user name is case sensitive, and SMTP implementations must take case to preserve the case of user names as they appear in mailbox arguments.

The only email address required to be case insensitive is postmaster.
Re:No brainer by TastyWords · 2004-07-17 22:03 · Score: 3, Funny

Perhaps you are referring to the riddle:

Q: What do you call someone who finishes at the bottm of his class in medical school?
A: Doctor.

For those unfamiliar with some of the eponymous terms, the Peter Principle says, "Everyone rises at least one level above their competitive skill level." IOW, whereever you end up, you should have been at least one level below that. (and the evidence tends to support this.
The simplest example? I could ROT 13 an answer in a couple of sentences for you to guess but it should be obvious: PHBs. They have to come from some place(!)If you've been around one in particular and watched them achieve the lofty position, them since they were in position(s) before that. Somewhere along the line they were in a position which matched some part of their skill set. Then someone saw how efficient they were in that job and jacked them upward, and *poof*, PHB Level 1.0.

They reach a point where they can't go up, won't go down[1], even at another facility, and aren't capable enough to move laterally, current company or elsewhere.

As a professor of mine pointed out about twenty-five years ago, they're at the apex of their profession (their own skill-levelwise), waiting for the next 10-20-30-40 years to pass by so they can retire. Mostly because they've clogged the ladder and frequently taken training in a field which "had a job waiting for them when they finished". That is one f%cking sickening thought for the tech industry: "The requirement in the USA will be 600k each year for the next ten years...blah, blah, blah". Lots of positions for people to take classes and get a B.S. because that field is like a siren song...God, what a scary thought. It's bad enough now.

[1] Okay, I played a straight line there...I figured if I didn't say something most people wouldn't have caught it.
Re:No brainer by lahi · 2004-07-17 23:34 · Score: 4, Informative

It is absolutely amazing how people can refer to a standard when they obviously have either not read it or not understood it.

Chapter 6 concerns itself with address specifications.
The syntax in paragraph 6.1 specifies:
addr-spec = local-part "@" domain
local-part = word *( "." word ) ; uninterpreted, case-preserved

So the local-part is UNINTERPRETED and has its case PRESERVED, presumably to allow case-sensitive handling locally. Moreover, the use of a "."-separated list of words does not imply any structure imposed or recognised by SMTP, it is merely a conveient way to avoid quotes in a large number of cases ("... such occurences carry NO semantics.").

The exception is the local-part "Postmaster" which is required to be recognized using any mixture of case.

So SMTP-servers are not case sensitive, but case preserving when it comes to the local part. The delivery or non-delivery of a message to a recipient however, is a local matter, and SMTP doesn't care about what happens, and whether case-sensitivity is used for this.

It just so happens that local mail systems these days are not case sensitive, although I believe the broken SVR2.2+some bsd+some SVR3/4 based A/UX system I used in the early nineties might very well have been.

(Quotes typed manually from the copy of RFC-822 which I printed out in about 1991 or so. Yes, about the same time some Berners-Lee guy made a few grave mistakes which would end up as the mess we now know as WWW.)

-Lasse

No big problems here by andyrut · 2004-07-17 11:14 · Score: 5, Insightful

Buying your own domain is a smart move. As long as you keep paying for the domain, your e-mail address can travel with you, even when you change ISPs.

From personal experience, I've found that only a very small percentage of spam I get comes from using the catch-all address. I get only a few junk e-mails to "webmaster", "postmaster", and other generic usernames. A far greater portion of it is addressed to the "real" e-mail address I use that's been plastered all over the web for years and years.

Judging only from my inbox, it would seem that spammers are more likely to use lists of known e-mail addresses than trying to guess valid usernames for a domain. My advice would be to use the catch-all address and just wait and see if spam becomes a problem. Turning off the catch-all wildcard, if need be, is a very simple operation.

Re:No big problems here by Anonymous Coward · 2004-07-17 11:19 · Score: 2, Insightful

That is, until the DSL provider you host your domain on decides to block port 25 because someone else on your ISP was spamming or relaying spam. :|

Spammers ruin it for everybody.
Re:No big problems here by toonerh · 2004-07-17 11:24 · Score: 3, Informative

Right after registering a domain, you'll often get a few spam's hawking hosting services, ect. Verisign (no flames please!) does allow you to opt out of their bulk sale of whois data - although why are they doing it in the first place?

Also for $9 a year you can buy a redirected e-mail address that changes every 10 days that appears as your whois contact.
Re:No big problems here by Oloryn · 2004-07-17 11:41 · Score: 4, Interesting

From personal experience, I've found that only a very small percentage of spam I get comes from using the catch-all address.

My experience doesn't match. I've got my own domain, hosted on my home computers. I don't use a catch-all address, but my mail logs show anywhere from 400 to 1200 emails daily bounced because they're addressed to invalid email addresses. Roughly 80% of these come with an envelope from address of (null, supposed to be used only by bounce messages). Because spammers are sometimes known to use as an envelope from address on spam, I can't be sure that these are all bounce messages. I am pretty sure, though, that they represent either spammers using a dictionary attack on my domain, or spammers using @mydomain> as a From address for that spam. And the other ~20% are pretty well for sure dictionary attacks on my domain.

Now, I'll admit that while I'm by no means a big-time anti-spammer, I have done my share of reporting spammers to their ISPs and posting on nanae. It's possible that I've gotten on a list of 'known anti-spammers' that spammers use for generating spam from addresses, just for harrassment potential. My experience may apply mostly to those who go beyond filtering in fighting spam. But it is another data point.
Re:No big problems here by Pembers · 2004-07-17 11:44 · Score: 2, Interesting

Judging only from my inbox, it would seem that spammers are more likely to use lists of known e-mail addresses than trying to guess valid usernames for a domain.

My experience so far has been the opposite. I got my own domain about four months ago and put my website there. So far, the only address at that domain that I've publicised on the web has been webmaster@. To date, this address has received only one spam. (To be fair, I think most spammers filter "webmaster" out - my old ISP let me use webmaster@username.domain. That was visible for about six years, and that got hardly any spam either. Other addresses that have been visible on the web have been spammed mercilessly, to the point where I've had to tell the server to drop anything sent to them.)

Anyway, my point was that within about a month of my domain being created, I started getting spam to sales@. A month after that, they started trying info@ as well. Seeing as I had never used those addresses in any way, and had no plans to use them, I felt no compunction in auto-forwarding them to uce@ftc.gov.

So, I use the catch-all address. I find it useful for the usual trick of telling any company that wants my address that it's company@my.domain. I don't have to do anything else to allow the mail through, but if I start getting spam to that address, I know who sold it (or who got hacked). This hasn't really been a problem for me, though. Maybe I'm just paranoid about giving out my address in the first place.

--
Just another wannabe fantasy novelist...
Re:No big problems here by alienappliance · 2004-07-17 12:51 · Score: 3, Informative

I've had to shut off my catch-all, but not because of spam, but because of spoofed return-email addresses someone has been sending out with my domain name. My INBOX would be filled with bounce backs from email addresses some spammer was using that we're live anymore. He/she didn't have to deal with the bouncebacks, but they cause my mailbox to overflow. Shutting off my catchall address eliminated the boucebacks because the spammer wasn't using my "real" email address, just some made-up name at my domain.

--
The harder you try, the luckier you are.
Re:No big problems here by macdaddy · 2004-07-17 13:59 · Score: 3, Informative

Advice can not get any worse than this. Postmaster and Abuse are required mailboxes. They are not optional. RFC 2142 mandates their use. This isn't some new requirement either. That RFC was written in 1997. People who violate this RFC will find themselves in a blacklist at a very aptly-named website: RFC-Ignorant.Org. A very fitting name for a very ignorant group of people.
Moderators, please moderate the parent down for being a fool giving fool's advice.
Re:No big problems here by shird · 2004-07-17 13:59 · Score: 2, Informative

are you sure all those bounced messages arent from mail worms forging from addresses? Probably about 80% of my mail is from 'mailer daemon - your message was infected' or 'we tried to deliver but failed' type messages, from domains Ive never sent mail.

Aside from those, I get virtually no spam, or at least it gets filtered quite reliably.

And I just have a regular yahoo account.

--
I.O.U One Sig.
Re:No big problems here by jrockway · 2004-07-17 14:00 · Score: 2, Insightful

Are you a two-year-old?

Spam is annoying. Spam is trashy and "unethical". But it's not worth killing someone over.

Just get a new email address. I got a new one and don't get spam anymore (the gmail one above does get spam, though...)

Every time I post this, I get modded down (slashbots hate spam, I guess... I'm pretty indifferent myself), but I'll say it again. I actually think spam is a good way to motivate ISPs to upgrade themselves. If their mail servers die every few days because of the load spam inflicts, they upgrade their servers. That means new features (or more uptime) for you! Bandwidth is the same way... spam uses a lot of bandwidth so the Big ISPs have to upgrade their links. And they aren't doing the bare minimum (when you've dug up the cable, you're going to put more than you need down... digging is expensive, fibre is cheap), they're adding more bandwidth than they need. Which means that slashdot loads faster (or your movie downloads faster). That's a good thing.

Just don't give your email to anyone who asks, and you'll avoid spam. I hear putting numbers in your username helps against dictionary attacks (jrockway in in a dictionary, but jrockw2 isn't).

In closing, please have a drink of your choice and relax a bit. No need to get worked up over spam. And if a gmail invite would calm you down, I'll give you one :)

--
My other car is first.
Re:No big problems here by tyler_larson · 2004-07-17 14:27 · Score: 2, Interesting

From personal experience, I've found that only a very small percentage of spam I get comes from using the catch-all address.
The same was true for me until a few months ago. My tactic was, whenever I needed to give out an email address, it would be their_company_name@my_domain. If I started getting spam to that address, I'd know who was to blame for selling me out. I could also just blacklist that address.
Then, very recently, after my domain started getting popular on google, I started getting spam sent to a whole ever-changing list of random names @my_domain: cunningham@ dennis@ schmidt@, etc. Something on the order of 300 pieces per day. It's very clear that this is all from the same spammer, because it's always the same product: software. And the content of the email always follows the same pattern: chunks of web pages pulled at random to fool the spam filters, followed by something like: "N0r-t0n S0ftw-are 0-n Sa1e T0d-ay".
He uses a huge variety of mail servers all across the world. I'm thinking of blocking email from all Non US/EU IP ranges, though I could probably just install a filter a basic lameness filter that check for too many zeroes in the message body :)

--
"With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
RFC 1925
Re:No big problems here by macdaddy · 2004-07-17 15:45 · Score: 2, Interesting

If they want people to accept their mail then they'd best play by the established rules of the Internet. I reject mail from domains that don't conform the the RFCs on all my mail servers. Don't you?
Re:No big problems here by killjoe · 2004-07-17 16:36 · Score: 2, Insightful

Since that RFC was written before the advent of spam they should change it. I got tired of getting hundreds of spam to postmaster@mydomain.com and simply shut it off. If anybody blacklists me then fuck them.

They are ones that are ignorant. Blindly following an RFC that ignores the reality of what is happening today is the height of stupidity. Blacklisting somebody for not doing it just plain moronic and asshololic behavior.

But then again there is no shortage of assholes on this planet are there.

--
evil is as evil does
Re:No big problems here by Jesus_666 · 2004-07-17 20:07 · Score: 2, Funny

Kill'em all, let God decide.

Good idea. If we kill each and every human on the planet we have a 100% chance of stopping all spammers. Who cares about a few false positives?

--
USE HOT GRITS WITH STATUE OF NATALIE PORTMAN (NAKED AND PETRIFIED)
Re:No big problems here by Tim+C · 2004-07-17 21:00 · Score: 2, Informative

I guess I must just be lucky. I've had a domain, complete with "catch-all addressing", for about 4 years now, and I get maybe a few dozen spams per week. Almost all of those, too, go to an address I was foolish enough to use in plain text on kur05hin a couple of years ago.

I am anti-spam, but not particularly vehement about it. I can imagine thought that if I were getting that many mails, I'd probably be howling for blood...

--
It's official. Most of you are morons.
Re:No big problems here by macdaddy · 2004-07-18 02:22 · Score: 3, Interesting

Alan Ralsky, is that you? Ernie Haberli, is that you? No wait, I know who you are, you're Scott Richter. Hi Scott. I knew only a spammer could possibly say so many stupid things in one post. Yes Scott, it really is inconvienent for you when we anit-spammers quickly forward all your lovely little spams to postmaster @ the provider whos poor customer was compromised by your little ope proxy viruses and unknowingly let you spam via their computer. Yes, that is inconvienent. Wouldn't you love it if no one used postmaster or abuse or any other standardized mailbox to contact mail admins around the globe? Why your spamming might be able to go on for a day or two before we determined few could find a way of contacting the right people--that's if we can get through the various levels of BS at any one given company to actually get to the mail administrator. There there Scott, don't cry. I know it's been tough on you. That's too bad though because this accepted practice just isn't going to stop any time soon. There is hope for you though. Get ahold of the zone files from rfc-ignorant.org. They compile lists of the really ignorant people that can't seem to comprehend what a RFC is and how to use it. You should be able to spam freely from those ignoramuses since they obviously aren't very compotent mail administrators. Been nice talking to you Mr. Scott Richter, spammer.
BTW, you're intentionally inciting a DoS attack on the RFCI folks. Don't you know that's illegal? Maybe you should just step away from the computer now before you really get yourself into trouble.
Re:No big problems here by RobertB-DC · 2004-07-18 15:27 · Score: 3, Funny

Postmaster and Abuse are required mailboxes. They are not optional. RFC 2142 mandates their use. This isn't some new requirement either. That RFC was written in 1997.

In other news, .com is the approved TLD for commercial entities. .net is reserved for organizations that provide connectivity services essential to the operation of the Internet, and .org domains must only be assigned to not-for-profit organizations. Enforcement of these rules is essential to the smooth running of the Internet, and violators will certainly be blacklisted within an inch of their lives.

Yep, it's great living in 1997.

(Sorry if it seems I'm piling flames on a fire that's already burning just fine... it's just that your post contained such tempting kindling!)

--
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.

Your shouldn't worry about that by toetagger1 · 2004-07-17 11:15 · Score: 4, Insightful

If you use a spam filter, you sould not have to worry about it. You are not exposed to more kinds of spam, just more instances. And since spam filters currently have no issue with volume, you should be ok.

--
who | grep -i blond | date cd ~; unzip; touch; strip; finger; mount; gasp; yes; uptime; umount; sleep

conditions by TedCheshireAcad · 2004-07-17 11:15 · Score: 2, Funny

just be glad you're not asdf@asdf.com.

Re:conditions by Liquidity · 2004-07-17 11:18 · Score: 2, Funny

I think foo@bar.org might get even more.
Re:conditions by Ryan+Huddleston · 2004-07-17 11:28 · Score: 2, Funny

support@microsoft.com seems to do quite nicely :-)

bayesian filter is your friend by elucubra · 2004-07-17 11:15 · Score: 2, Insightful

set it up, but make sure you have a good bayesian filter to weed out the crap.

bounce? by Anonymous Coward · 2004-07-17 11:15 · Score: 2, Insightful

if anyone really emails your domain, and it bounces, won't they figure it out?
Seems like a useless feature.

Isn't that the POINT? by SuperRob · 2004-07-17 11:16 · Score: 5, Insightful

What does it matter if it opens you up to spam. It's a catch-all account right, isn't that what it's supposed to do?!?

Here's one way to get the most from it by quinxy · 2004-07-17 11:18 · Score: 5, Informative

As someone who has been using a catch-all account for years, and has enjoyed the benefits and suffered the consequences, I would suggest you do it (though not without some warnings and recommendations). I do receive a fair amount of SPAM for accounts which have never existed on the system. I have also endured several periods when some SPAMmer referred to fake accounts at my domain in the return-to of the SPAM they were sending out (they were not using my mail server, they simply made up random usernames for my domain). Since they were random (both the names they used and the content of the SPAM) it was impossible to easily filter out. That sucked. I would receive hundreds of bounce messages per day. Ultimately I was able to make it stop by writing a script to post every bounce message I received through to the support form on the websites being advertised (modifying for each of the three or four sites which were involved), making the normal "cease and desist" legal threats. It seemed to work, since the SPAMs did stop soon after (presumably those sites complained to the SPAMmer they employed), and the SPAMmer no doubt moved on to some other fake accounts. Bastard. One of the best features of the catch-all is that you can totally control to whom you give out your "real" e-mail address, as well as track who is using the e-mail addresses you are giving out. For example, if you want to register at example.com for something, you give them the address me.example@yourdomain.com (or some structure which has a prefix or postfix, the 'me.', and the site name for which you are registering). You'll be able to receive that sites mail until you either don't want to, or until you see that they have abused the privilege of e-mailing you. Often I will see six months after registering to some site, I start getting tons of SPAM from the e-mail I gave to that site, and I can then simply block that on the mail server, bouncing them or sending them to /dev/null (via aliases, for example). This is the greatest strength in using catch-all addresses. To mitigate the danger I mentioned previously of fake usernames, one should (though I am no sendmail expert and don't know how) set up a rule that any incoming recipient address must correspond to an existing account/alias, OR the catch-all structure you want (the whole PREFIX.SITENAME@yourdomain.com). Q

--
Don't vote for Eugene Papansanovich for Congress!

Re:Here's one way to get the most from it by panaceaa · 2004-07-17 13:41 · Score: 3, Informative

You should consider not capitalizing the word "spam". I couldn't bother to read the rest of your post after I noticed you were doing it. It just makes you seem out-of-the-loop, plus Hormel has said they would prefer people to spell it "spam" anyway.

--
my blog

This is what I do... by flamechocobo · 2004-07-17 11:18 · Score: 3, Funny

I just write mail back. It's rather funny when you get a reply from the spammer. That isn't automated.

Nope by Inominate · 2004-07-17 11:18 · Score: 2, Insightful

Not at all.

The ideal setup is to have several addresses.
One for close friends, associates, individuals and people who the address is sent to privately.
A second address for mailing lists, and any kind of public posting.
And a third address for anything guarenteed to end up in you getting spam. (Website signups for instance)

Then you simply drop it into three different folders. This method combined with a good spam filter can eliminate virtually all spam.

the whole /point/ of a catchall address is spam by luge · 2004-07-17 11:18 · Score: 5, Insightful

It is great. You never have to worry about giving out an indiscriminate address again. Signing up for a fantasy league on cnn/si? I used cnnsi@mydomain. cnnsi sold it and now I get several hundred spam a day there. And I can trivially filter and nuke them, with the added bonus that I know never to send them my business again. amtrak has amtrak@mydomain, I get all the mail from it, and can easily track that they have never violated their TOS. It's the greatest thing- I heartily recommend it to anyone who can.

--

IAAL,BIANLY

Re:the whole /point/ of a catchall address is spam by Mirlyn · 2004-07-17 11:26 · Score: 2, Interesting

This is exactly what I do, and what I've been doing for two years now per recommendation from another friend. I can't suggest this strongly enough.

If it ever gets violated, add that address to an account with zero or small size limit and let it bounce back to them.

I get less than a half-dozen pieces of spam per month. Most are to the address I put in the whois information (whois@domain), followed closely by sales@domain, info@domain and webmaster@domain, none of which were intended to be valid addresses anyway.
Re:the whole /point/ of a catchall address is spam by Zocalo · 2004-07-17 11:43 · Score: 4, Informative

Alternatively you could also flip that on its head and proactively add new accounts as required, which is what I do. So, if the scumbags at "Foo Corp." decide to sell my email address, I simply delete the "foo@mydomain" entry from my aliases file and both the spammer and Foo Corp. just get a User unknown from the MTA. It avoids all the pain of having a catch-all address and as a bonus it makes sorting email into folders a snip because "To:" is always unique and relevent!

--
UNIX? They're not even circumcised! Savages!
Re:the whole /point/ of a catchall address is spam by KingJoshi · 2004-07-17 11:51 · Score: 4, Interesting

I do this as well. I used to have an email address from MailBank (later changed to NetIdentity). They buy up domains with last names so you can do firstname@lastname.com. They started off charging $5 a year for email and now it's $25/year. I got fed up with it and bought my own domain name.
Best move I did. I have greater control over it and feel more security about it as well.
There is a free DNS service held by ZoneEdit. If you only use it for one domain, it allows free email forwards, web forwards, etc. It has about all the services I could ask for (except hosting) for free (assuming you don't go over a quota).
I have emails redirected to my gmail account as well as comcast (which also hosts my personal website). I could host this on my own computer or elsewhere and I have a lot of freedom to do what I want.
And as the parent said, being able to create email addresses on the fly allows you to catch businesses that sell your email address, or find out where the spammers mostly target (and as another poster said, Slashdot is worst of all the ones I've created). It also makes it easier to filter with gmail and do searches and so forth.
I know I'm being mostly redundant as others, but I can't emphasize enough how valuable this is, especially to a computer geek. And I'm only paying $7/year for all this! I can't mod the parent up any more so I just want to re-iterate the value of catchall addresses and owning your own domain name.

--
In times like these, it is helpful to remember that there have always been times like these. - Paul Harvey
Re:the whole /point/ of a catchall address is spam by luge · 2004-07-17 12:31 · Score: 5, Insightful

This is a good approach, and the one I'd use, /if/ I had an easy admin interface to add accounts. But most don't (and it certainly sounds like the questioner on the original question doesn't.)

--
IAAL,BIANLY
Re:the whole /point/ of a catchall address is spam by droleary · 2004-07-17 13:10 · Score: 3, Insightful

I used cnnsi@mydomain. cnnsi sold it and now I get several hundred spam a day there.

Are you sure they sold it, or were you merely a target of a dictionary attack (the dictionary being domains)? Same will go for amtrack@. All a spammer has to do is decide it's a significant enough domain to add to a dictionary and, BAM, you're getting spam there without any kind of TOS violation on Amtrack's part. Common word domains like amazon@ have long been dinged, and it is foolish to blame the company for your own poorly thought out system.

If you really want to use a catch-all to track who sells your address, you have to use a hash or something else that you keep entirely secret and is not easy to guess, like c66915c4ff6a27e5f3aac08f58130ba9 for . . . guess who! :-) Otherwise you're just adding to the abuse that the spammers are dishing out to you.

My own experience with a catch-all is that you're safe until you're hit by a dictionary attack, and then it never stops. I have domains with next to no traffic and a catch-all is fine, but in the last year I've had two of them get hit by dictionary attacks and after that each domain gets an increasing stream of spam attempts, currently around 1000/day. That's bad enough that I shut off the catch-all for the one I don't really use it with. The other one keeps SpamCop full.

I gave it up after a year by killbill · 2004-07-17 11:18 · Score: 5, Interesting

I fought it for a year or so, coding up custom filters, using spam assassin, you name it, and finally just gave up and blackholed it.

Spammers are trying dictionary attacks against domains to try and guess live accounts. I would get 500+ copies of the same message to made up names in alphebetical order a day.

That being said, I have since gotten on the Gmail beta, and just forward all my mail there now. It has a far better spam rejection rate then anything else I have tried, so if you forward all your mail to a google account and let them try and sort out the spam, it would probably be usable (and maybe even helpful to them to train their filters).

--
Mathematically impossible requirements are technically not against policy.

Spam ID .. by Manip · 2004-07-17 11:19 · Score: 2, Informative

On the other hand if you leave the * account on, you don't need to creat a new account eact time you need one. I for instance only have one account on my mail server and that is the postmaster this allows me to invent e-mail addresses on the fly.

With this ability you can make an e-mail address for each use of your e-mail for sites and forums like Slashdot@Domain.com and if you start getting spam at that address you can quiet happily block it via the filter.

One Person's Experience by Rob+Carr · 2004-07-17 11:19 · Score: 2, Interesting

One of the options provided is to make one of your email accounts a catch-all account.... The question I have, is this a good idea or not?

I have one of my e-mail addresses configured to catch all the "bad" addresses as you are talking about. There is an extraordinary amount of crap that account gets every day. It really isn't worth it, especially if you have the admin and postmaster addresses dump to your primary mail account.

--
This sig seemed like a good idea at the time....

mr_you_only_know_this_one@mydomain.com by Anonymous Coward · 2004-07-17 11:19 · Score: 2, Interesting

so, if you get spam on this specific address you know where to complain.

Yes by Saeed+al-Sahaf · 2004-07-17 11:20 · Score: 2, Funny

As a geek, I run my own mail server. A "catch all" that goes to /dev/null is great.

--
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck

Been there, done that by FrenZon · 2004-07-17 11:23 · Score: 3, Interesting

I run several catch-alls on my domains for several years, and I've never been spammed at [all]@[domains].com. However, just last week all my domains were hit by an email virus that did a dictionary-based attack. While it was all still caught by my spam filter, my spam filter is client-side, and after downloading 18200 emails, I decided it was time to shut down the catchalls.

The only thing I really had to do was notify my friends, who are long used to typing whatever they want into the username section of the domain, tailored to whatever it is they want (eg boywhowillfixmycomputer@, bikemechanicmanwhowillalsofixmycomputer@ etc).

Re:Been there, done that by lewko · 2004-07-17 12:59 · Score: 5, Funny

The only thing I really had to do was notify my friends, who are long used to typing whatever they want into the username section of the domain, tailored to whatever it is they want (eg boywhowillfixmycomputer@, bikemechanicmanwhowillalsofixmycomputer@ etc).

The worst thing is when your so-called friends figure out for themselves that you have a catchall set up, so you start receiving emails to pigfucker@yourdomain, grabass@yourdomain etc... and it's not even spam, it's from your friends!

I now use the free http://www.spamgourmet.com/ for my disposable addresses and highly recommend it.

--
Do you or your partner snore? - Visit www.snoring.com.au

Speaking from experience by Bradee-oh! · 2004-07-17 11:24 · Score: 5, Insightful

I have a catch-all address at my domain. YES, there are huge amounts of spam. BUT, it is definitely worth the trouble IMHO, and here's why.

1 - most of the spam seems to come to 5 or 6 addresses only - admin, root, sales, webmaster, etc etc. That's cake to filter out straight to trash.

2 - The convinience of being able to sign up for random websites with a different address on the fly is great. For example, signing up on ebay to buy something and using the address "fromebay@mydomain.com" means you KNOW that only one person in the world has your email address so you know who to blame if spam starts coming in, and it is also a piece of cake to automatically filter those ebay emails straight to an ebay inbox, for example.

3 - Not as significant as my first 2 points but still a nice perk in my setup is that I'm able to create email addresses for family and friends on the fly and just setup my own server to split the addresses out into their own inboxes.

So if you will be running the server(s) yourself over slow dsl or cable, the volume of spam MAY be a concern to you. I get about 600-700 spams a day to the common webministrater addresses I mentioned, but it's no concern to me because I don't run the incoming email server and my dsl is more than fast enough to d/l them in a few seconds.

But in any other case, I'd say it's well worth it! And on a slightly different note, I have been very impressed with the honesty and adherence just about everywhere has to their privacy policies regarding email addresses. over 2 years of using my system with about 50 "from@domain.com" addresses, only one of them screwed up and got the address on a spam list somehow - cancelling my account with them and filtering those spams straight to trash solved the problem.

--
"This is Zombo Com, and welcome to you who have come to Zombo Com" - www.zombo.com

No catch-all problems by GrouchoMarx · 2004-07-17 11:24 · Score: 4, Informative

I've been running my own mail account off of my own domain for about 2.5 years now, and I don't regret it. I do have the catch-all set to dump to my personal account, and it's not been a major problem. Most of the spam I get is addressed to a "real" address (either mine or one of my older accounts I have forwarded to me), and there's a lot of that, so the amount I get from the catch-all is negligible.

In practice, actually, most of the spam-related stuff I get is mail bounces attempting to a random address with a faked from line of 63745624573@mydomain.com (or something like that). I really should look into implementing SenderID, but that would require hosting the server myself on a my dynamic IP instead of letting my web host take care of it. :-)

--

--GrouchoMarx
Card-carrying member of the EFF, FSF, and ACLU. Are you?

Re:No big problems here - not correct for me by sprior · 2004-07-17 11:24 · Score: 2, Interesting

From my personal experience I've been getting a LOT of spam lately which is addressed to "made up" addresses at my domain. Either an awful lot of people lately have been giving out fake email addresses at my domain or spammers are somehow making them up from reasonable sounding usernames that never existed at my domain.

In a word... by Vellmont · 2004-07-17 11:30 · Score: 4, Informative

is this a good idea or not?

No, it's not a good idea. Looking through my mail server (and other mail servers I administer) I've seen A LOT of attempts by spammers to harvest email addresses by just trying a lot of common names on the domain (and some strange not so common addresses). If you had a wildcard address, you'd get all that spam to that box.

With no wildcard email address if people miss-spell a name on your domain, they'll get a prompt bounce message (and they'll probbably figure out the miss-spelling). With a wildcard they'll never figure out the miss-spelling, and may continue to use that wrong address.

There's also the problem of auto-generated virus bounce messages from other peoples servers. Most viruses lie about their from address, and can even make up a @yourdomain.tld. If you had a wildcard all those erroneous "you sent a virus" messages would go to your wildcard box instead of just bouncing.

Unless you want an account that's deluged with spam and like wading through it every so often on the off-chance someone sent a message to admin or postmaster, I'd not create a wildcard box.

--
AccountKiller

Give it a try by phalse+phace · 2004-07-17 11:31 · Score: 2, Insightful

All I can suggest is to give it a try for a while (couple of months, a year) and see what happens. If you get a ton of spam and no important email, then turn it off.

When I had my catch-all account, I rarely got any spam, and that's probably because most spammers won't really bother with trying to send you something at afhg329087dsfljifd90hlg@domain.com or whatever.

Just dump non-existent users by kstumpf · 2004-07-17 11:33 · Score: 4, Interesting

I think it's best to just reject mail addressed to non-existent users during the SMTP transaction. My outside relay uses Postfix's relay_recipient_map to validate all recipients before relaying inside... anything not matching gets rejected with a 550. This saves my content filters (amavis/clamav) alot of work since we get TONS of spam to non-existent recipients.

relay_domains = mysql:/etc/postfix/mysql-relaydomains.cf
relay_re cipient_maps = mysql:/etc/postfix/mysql-recipient.cf,
mysql:/etc/postfix/mysql-alias.cf
relay_transport = relay:mx2.somethingawful.com

If you don't validate recipients, then you probably SHOULD use a catch-all address. The alternative to this would be bouncing spam back to the (usually forged) sender, in which case you become part of the problem and can cause yourself major queueing problems.

Spam not a problem if forwarding also included by Diamon · 2004-07-17 11:33 · Score: 4, Informative

I recently switched to using e-mail from my registar/hosting company, they included one free address and I paid for an additional 5 mailboxes.

I set up an account for myself and my wife, and used the free account for a spam bucket. My account is set up as a catch-all. Whenever I sign up for something I use and address in the form slashdot.org@<mydomain>.com so if it does start getting spam I know who sold my e-mail address.

If any spam comes in being caught by the catch-all I set up a forwarder to my spam account. For example dns@<mydomain>.com gets forwarded to spam@<mydomain>.com I then just set up my e-mail client to dump anything that comes in via the spam account directly into the trash.

To date I have received spam on three addresses that didn't really exist (dns@, sales@ and info@), but overall it works very well.

Be Careful with Catch-All Accounts... by Anonymous Coward · 2004-07-17 11:34 · Score: 2, Insightful

I host my own personal domain (something like johndoe.com) with a hosting company. I had a catchall account, and used it to great success when giving out my e-mail addy. (For example I'd give stores their own name: homedepot@johndoe.com, walgreens@johndoe.com, etc. Not these specific example, but you get the gist.)

Anyhoo, somehow, someway, somewhy, a spammer got ahold of my domain. And they created just about every possible name you could imagine for my domain: janey123@johndoe.com, rty5632@johndoe.com, ricksmith@johndoe.com, etc. Of course, it's just me at the site. But I suppose they didn't care. To make a long story short, I started getting over 1,000 spam messages per day in my catchall. And now it's grown exponentially. The assholes even send the same spam to the same addy, like, ten at a time. So basically my domain is fucked. And of course, once you get on some dumbass spammer list, they ALL start sending it to you. I've had my catchall account turned off for the last several months, and it's set to bounce back. But it makes no difference.

Every month or so I turn it back on to see if they've given up, but it's just more and more and more of the same. Until a cure for spam is found, I'm dying over here. It makes my e-mail almost useless. Sheesh. Please someone do something about this stuff.

Hopefully this won't happen to you, but if it does, you're screwed. :(

No Daddy! by davekebab · 2004-07-17 11:36 · Score: 2, Interesting

Now I am using GoDaddy as registrar, I found it's them that's filling the inbox with spam. The default inbox is riddled with bollocks sent to godaddy@mydomain.com.

They're bloody cheap and'll do anything an extra few cents..........

DK

Greece is the Word

The problem is these newfangled worms... by InakaBoyJoe · 2004-07-17 11:39 · Score: 2, Interesting

I also use the method of giving out lots of different E-mail addresses to track down who sells my info. Those who say, "you can always turn off the catch-all" are missing the point, because those of us using this method don't usually remember all the addresses we've given out, and therefore, using a "whitelist" isn't practical. Now, this system works great as others have said. You get a few occasional spams to things like webmaster@, sales@, info@, etc. but those can be easily filtered. The big problem is with annoying worms that generate random E-mail addresses. Of course, all of them get sent to your catch-all account -- in one day I got 150 Zafi.B worm E-mails from somewhere in Mexico. When you get one of these, what do you do? If you don't bounce the message, it's likely that the randomly generated E-mail address will be treated as valid and added to some spammer's database. Sure, you can blacklist each address, but then you're playing catch-up to a random generator algorithm. Not likely to win at that kind of game. Anybody know a good way to generate bounce messages in this kind of situation? Most mail bouncers assume you have only one address, and they create dangerous bounce messages that carry your *real* (i.e., desired) return address. I need a bounce script that grabs the "Received from... for ____" header and uses that to generate a bounce as if it originated from the randomly generated E-mail address. Can anybody help? PLEASE? Thanks!

No catch-ALL, just a catch-SOME by mejh · 2004-07-17 11:44 · Score: 2, Insightful

When I hosted my domains I just had a few 'standard' addresses at the domains going to a 'stuff' mailbox. Aliases like:
- root
- webmaster
- postmaster
- admin

I thought it was better when people use other non-existent addresses that they get a bounceback rather than mail being accepted. Especially with the newer worms/trojans that forge headers to send out mails from blahblah81@yourdomain.com etc.

Automatically sorting out SPAM by SmoothTom · 2004-07-17 11:44 · Score: 4, Funny

"Most of the spam these days is ovbious spam like Subjects which make no sense and often have lots of spelling errors in the body."

Uh, sorry, but that sounds just like the legitimate e-mail I get from some of my friends... :o)

--
Tomas

Disagree by Uber+Banker · 2004-07-17 11:45 · Score: 4, Interesting

But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam:

If it is a personal domain with perhaps a couple of description pages and even a blog then, like me, you will get no more (from personal experience) than 10+ random (random in the way they are sent to webmaster/admin or anything that * catches other than regular) messages/week. No big deal

A better known site seems to get a greater ranking in auto-traffic (let me generate logos, banners, security, etc for your website). But an email address listed on the site (my site) gets far more spam than a generic catch-all (e.g., I have "email webmonster@....com" as the auto admin address, more emails come to that than webmaster coz it's googled/harvested on those lists).

But the original statement said "I decided to pay the extra money to have email for the domain I registered" WFT?! Go to something like directnic.com, get your domain for $15/yr and get mail forwarding included (including wildcard)!

Re:Disagree by The+Snowman · 2004-07-17 11:56 · Score: 2, Interesting

But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam:

My main address (unmunged, in this message's header) gets about 500 spams per day. Before I removed the catch-all I was getting almost twice that. Granted I am not everyone, but a few other people are in the same boat as I am. My web host has its own private news server (i.e. not connected to Usenet), and quite a few people who post there talk about getting thousands of spams sent to nonexistant addresses on their domains every day. Turning off the catch-all is a no-brainer in that case.

Go to something like directnic.com, get your domain for $15/yr and get mail forwarding included (including wildcard)!

I am leery of most of those "quasi-registrars". I have a full fledged registrar, and I get those features, SPF, IPv6, et al. and it is all included in my free account, for the same $15 (or less) per year per domain.

--
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Re:Disagree by studerby · 2004-07-17 12:00 · Score: 4, Interesting

I suspect your domain hasn't been out there long enough yet.
My company's primary domain is registerd with technical contacts of "hostmaster@[our_domain.com]" and for years we never got a spam. Then about 2 years ago, somebody must have included it in a big master list; now it takes about 30-50 spams a day on average, mostly true "bottom feeder" crap like cialis and vicodin and *adult* crap.
My work email's been out there a lot longer, but doesn't draw nearly the number of spams and about 80% of them are financial/economic scams - mortgage and stock touts, lottery, 419, etc.
Upstream filters are blocking emails with virus attachments; I have no idea how many of those are coming in...

--
.sig generation error:468(3)
Re:Disagree by chimpo13 · 2004-07-17 12:09 · Score: 2, Interesting

I'm also on pair, and I get the catch-all. Close to 1,000 spams a day. Now everything goes to gmail since I'm going to need web email and it's cut my spam down to 0-15 a day (5 a day has been average). So far, 2 false positives.

The best is no more 200 virus messages going through names A to Z. I'm sure a good spam filter would take care of the catch-all spam.

My spam rate went way up with my previous provider (servercentral). I don't know if I just got hit hard or if they're just crappy. Lots of it was addressed to servercentral@servercentral.com Just 86'ing that address cut spam back.

--
riding round the world on an old motorcycle
Re:Disagree by MDMurphy · 2004-07-17 12:16 · Score: 5, Informative

Catch all will kill your inbox. I had a catch all from 1996-2002. All of a sudden, around Labor Day 2002 I started getting up to 3000 spams a day. The vast majority were to bogus addresses. Even with local spam filtering my email client was spending near 100% of the time downloading mail.

I eventually killed the catch all, resulting in losing email from some places I'd given unique email addresses to. Also went with a 3rd party spam filter ( spamcop.net ) so most spam never makes it to my desktop at all, getting filtered upstream.

Recently I got a Gmail account. Just for grins I thought I'd test their spam filtering capabilities before using it for anything "real". I reactivated my catch all, forwarding it to my Gmail account. In the last 3 weeks my Gmail spam folder has accumulated 163MB of spam, or almost 27,000 individual messages. Gmail is only catching 30-50 percent of it, I've had to manually tag the remainder.

So while all my catch all addresses bounced these past two years the flow has reduced from 3k a day to about 1k a day.

The only reason to have a catch all is if you want lots of untargeted spam. I don't know how these yahoos do their billing, but if any of them base it on what bounces vs. what's read, then having an open address might just mean they'll make more money because of you.
Re:Disagree by macdaddy · 2004-07-17 13:26 · Score: 4, Informative

But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam
On the contrary wildcard spam is extremely common. When was the last time you ever watched the maillog of a busy MTA? I garuntee you it will be riddled with User Unknown errors from dictionary, Rumplestiltskin and wildcard attacks. It's that way on every mail system I've ever administrated, including the ones I administrate now.
Re:Disagree by macdaddy · 2004-07-17 13:28 · Score: 2, Insightful

Turning it off? It's off to begin with. Only a fool would turn it on for any domain with legitimate uses. The only time you ever tunr it on is when you WANT spam. There are very few of us that want hundreds of thousands of pieces of spam per day.
Re:Disagree by Uggy · 2004-07-17 14:28 · Score: 4, Interesting

I actually have an old domain dedicated to just that... collecting 100's of spams a day to train the bayes filters. Identical spams sent a hundred times just help me confirm what spam looks like. I use my other users to train the ham side, and guess what, it works like a charm. We get considerably less spam. So, yes catchall domains are useful... as spam honeypots.

--
Toddlers are the stormtroopers of the Lord of Entropy.
Re:Disagree by whoever57 · 2004-07-17 15:32 · Score: 3, Insightful

But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam:
Well, I think there are wild differences from one domain to another. One of the domains that my company uses for email has been under a sustained dictionary attack for months now. Others get only targetted spam (real or former email addresses plus postmaster@, sales@, etc).
So a catch all may be OK until some spammer decides to make it the target of a dictionary attack. The problem is: what does one do then? At that point, turning off the catch all will probably mean losing lots of non-spam emails.

--
The real "Libtards" are the Libertarians!
Re:Disagree by mcrbids · 2004-07-17 15:42 · Score: 4, Interesting

But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam

Wow. Could you be more wrong? As sysad for two smallish ISPs, I've been seeing serious SPAM attacks as (random string)@domain.com.

As many as 200,000 attempts in 24 hours. Repeatedly, for multiple domains. From hundreds of different sources. (We even put in a double bounce handler to identify source addresses; it was rare to see any single IP addresses attempt to deliver more than 10-20 in a 24 hour period)

While your other points are valid ones, on this one you are dead, dead wrong.

And, to the article poster, NEVER USE A WILDCARD. EVER. A bayesian filter running at 99.98% effectiveness would still not be as accurate as sending all wildcard email to /dev/null !

--
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Re:Disagree by The+Snowman · 2004-07-17 15:58 · Score: 4, Informative

What is the difference of DirectNIC and PairNIC? I have been using DirectNIC 5 years with no probs.

They are just different registrars. pairNIC is very customer-friendly, offers extra features like IPv6 and SPF, allow direct editing of DNS entries for people who are control freaks (most registrars just allow editing contact info, anything else is like pulling teeth). You can do email forwarding with them too, but I also have web hosting through their parent company and this includes an extensive email system including a custom qmail setup and procmail. I can install ClamAV and other software on my server if I want.

These servers run FreeBSD, a dead operating system, so the Slashdot trolls should have fun with this post :-)

--
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Re:Disagree by MadJo · 2004-07-17 22:54 · Score: 2, Interesting

I completely disagree with you there...
I used my old domain (which is still up) only for blogging (and not even adult content), but I now get [per day!!!] about 1000 spam messages, and all of them to a non-existant wildcard address on that domain.

I now only glance through it to see if any email gets through that needs to be forwarded to my new emailaddress...

--
80 CC D8 AF AE D3 AB 54 B7 2E CE 67 C7

So close.... by Groo+Wanderer · 2004-07-17 11:49 · Score: 5, Insightful

You are so close to the right solution. Spam almost universally will have a spoofed address, so sending something back to the 'sender' will not net you any more spam. Sending back is OK.

The trick is to put useful info into the reply. Try setting up a message in the 'this address does not exist' autoreply. Put in something like 'bob@domain.com does not exist. If you are trying to reach Robert Smith, please resend to robert@domain.com. If you want to reach someone in an administrative capacity, send an e-mail to admin@domain.com'.

You can extend this to all the positions that matter, postmaster, webmaster etc, and a few key people at the domain. The bad guys shouldn't get it, and the poor twinks who have their domain name spoofed will probably ignore it.

The people who DO need to contact you and did either screw up or guess wrong will simply get the info that they need to do right. Win/Win.

-Charlie

Re:So close.... by nyseal · 2004-07-17 12:21 · Score: 2, Insightful

Or, if someone REALLY needs to contact you, they can always pick up a phone and at least leave a message.

--
[SIG] Remember Mattel handheld games?
Re:So close.... by Brad+Oliver · 2004-07-17 12:55 · Score: 5, Insightful

Try setting up a message in the 'this address does not exist' autoreply. ... The bad guys shouldn't get it, and the poor twinks who have their domain name spoofed will probably ignore it.
As a "poor twink" on the receiving end of a lot of spam, I've found that my filters are effective against everything but auto-replies.
Getting a ton of auto-replies from people on vacation, with invalid addresses, support addresses that have changed, and the ever-helpful "you've sent us spam and we've rejected it but our spam filter is too stupid to realize the sender was forged" really gets old after the first week.
Don't use an autoreply and turn your problem into my problem.
Re:So close.... by LynXmaN · 2004-07-17 12:56 · Score: 2, Funny

Sending back is OK.

Well if the domain that you're bouncing the message back is actually a little one and a spammer is sending like... millions of messages spoofing that domain you're collaborating to a DDoS against that mail server.

So sending back is ok, up to some point ;)

--
May the source be with you!
Re:So close.... by NoMercy · 2004-07-17 13:00 · Score: 5, Insightful

Ideally the mail server shouln't accept the emails, not construct a nice reply, just send the relevant code and a short single-line message that the server is unable to relay/deliver the email.

The spammer's SMTP engine will get a mark against the email as bad, and valid ISP's relaying emails for there customers will generate a nice email for you saying that the address is invalid.

Use subdomains by gregmac · 2004-07-17 12:01 · Score: 4, Informative

For example, if you want to register at example.com for something, you give them the address me.example@yourdomain.com (or some structure which has a prefix or postfix, the 'me.', and the site name for which you are registering).

What I've been doing for the last couple of years is using a catchall at a subdomain of my actual domain. The typical dictionary spams (postmaster, sales, etc) don't come in, because they only work on top level domains (otherwise spammers would be wasting a large amount of time spamming "sales@www.domain.com" which pretty much never exists..

When I sign up for an account at example.com, I just register as example.com@catch.mydomain.com. If I get spam, I can block it, and it doesn't interfere with my actual domain. If I decided one day I get too much spam to it, I could just switch to another subdomain name.

--
Speak before you think

Use Mailinator! by popo · 2004-07-17 12:05 · Score: 4, Informative

Forget the "Catch All" e-mail address. Use Mailinator.

FYI -- mailinator is a non-passworded public catch-all system. Perfect for temporary site registrations. I use it frequently and its an unbelievably good service...

--
------ The best brain training is now totally free : )

Catch All != Your Friend by shadwwulf · 2004-07-17 12:13 · Score: 2, Informative

From experience in operating multiple servers hosting many(read 10,000+) domains each, I can say that the catch all account is a VERY BAD thing.

Spammers recently have turned to more use of the random username approach and the catchall catches, well, all. This can in some cases total to more than 4500 emails a day in some cases. Hardly something you want to pull through a POP3 connection if your ISP doesn't have effective spam filtration.

Quite honestly the catch all serves little purpose if your email transactions are done in a correct manner. mailto: links have NO BUSINESS being on a web site for a company(or personal user for that matter) a simple CGI based contact form shields access from spam bots getting your email address and you can make sure ahead of time that your email address is properly configured.

Secondly, if you are emailing somebody else, most people use a context menu on the email you sent to add you to their address book. Again that eliminates the human error factor.

Also as others have already mentioned, a human will be able to read a mailer daemon response telling them that there was a mistake should they send directly.

My $0.02

SW

Whatever you do... by Fweeky · 2004-07-17 12:15 · Score: 5, Informative

Make sure addresses like postmaster@ and abuse@ work. They're unlikely to get spammed, but may well receive important messages.

postmaster@ is actually required by rfc2821, btw.

As for the subject of the discussion; my catch-all addresses have been fine, but YMMV. If I was that worried about dictionary attacks, but still wanted the ability to give a new address out to each company, I'd do something like *-signup@mydomain or *@signup.mydomain or similar, but you might not have that level of control (in which case I'd recommend finding somewhere better to host your email, but *shrug*).

CATCHALLS equals a BOMB = Harmless until exploding by mdrejhon · 2004-07-17 12:34 · Score: 2, Insightful

Catchalls are harmless until they explode. The results were not pretty. All it takes is to be targeted as a potential ISP goldmine of email accounts, and then be dictionary-attacked by a spammer, then lots of your email addresses are put on huge numbers of spam lists. Then you've moved from no spam to near infinite spam. Over one thousand spam per day, gobbling up your download bandwidth and slowing your Internet connection even if your spam filter filters 98% of it which still lets a couple dozen through, it becomes living hell!

while (true); do cat /dev/random | mail myself@mydomain.com; done

It'd be like filtering a firehose by MDMurphy · 2004-07-17 12:41 · Score: 3, Informative

If you have 1000s of messages coming to a person computer it doesn't mean squat what your filtering scheme is. Even if you don't "see" these messages, you machine is still going to have to read messages to evaluate them, or at the least download the headers (though header analysis isn't going to get you 100% filtered spam )

Accepting email from 1000's of possible email addresess @ your domain when you know they're all bogus is just asking for punishment.

Re:a benefit of catch-all addresses by lewko · 2004-07-17 12:53 · Score: 4, Informative

I used to use my catchall for precisely that (e.g. slashdot@mydomain.

It DID help me bust someone for passing on an address which was instantly traced back to them.

Spam however has completely ruined it though for the problems outlined in this article. Unfortunately I can't turn off the catch-all as there are so many 'legacy' addresses from which I might only hear once a year but don't want to miss their email.

I now use http://www.spamgourmet.com/ instead to create disposable accounts as I have the luxury of being able to kill them (or let them die) if need be. It's free and I highly recommend it.

--
Do you or your partner snore? - Visit www.snoring.com.au

try this username: spam@example.com by microcars · 2004-07-17 12:55 · Score: 2, Insightful

getting a little OT here, but after experimenting with the * or "catchall" email address on several domains, I have found the best username to be....SPAM

So many people use things like:
johnNOSPAM@example.com john@NOSPAMexample.com johnREMOVETHIS@example.com...

that the SpamHarvest bots seem to harvest emails and then REMOVE words like:
SPAM
REMOVE
THIS
NOSPAM

before adding the names to their "fresh" list of email addresses to sell.

but if they remove SPAM from SPAM@example.com, they are left with.....
@example.com
which should be undeliverable.

so if your email is SPAM@example.com, you should get email from your friends, but my extensive use of that username on USENET has shown me that it does in fact work! I received only ONE spam email to that address in the past year of using it.

getting back On Topic for a minute, see if you can "disable" the "catchall" or "*" email function at some point. While I have not been hit with a dictionary attack, its obvious from the other posters that it is not uncommon. If you can route all non-assigned usernames to null when you discover this to be a problem, you will save yourself some headaches.

--
I like microcars

Re:So close.... and yet so far by Scryer · 2004-07-17 13:00 · Score: 2, Interesting

>... the poor twinks who have their domain name spoofed will probably ignore it.

This is *such* annoying advice. I have a long-duration (approximately 1993) very public email address, and it's spoofed a lot and one of my main annoyances is this auto-replied "You've reached a bogus address or domain" message.

DO NOT send any auto-replies for anything.

DO NOT send messages saying that the (probably spoofed) sender has sent you a virus.

Re:a benefit of catch-all addresses by harlows_monkeys · 2004-07-17 13:04 · Score: 2, Informative

It allows you to have multiple identities and thus determine where spam comes from. Want to subscribe to a free registration website that requires a valid email address? It the site is yourfreepron.com log in as yourfreepron@yourdomain.com.

You don't need a catch-all for that. You just need a hosting service that lets you set up forwarders. So, in your example, I'd simply set up a forwarder for yourfreepron@mydomain.net to forward to myrealaddress@mydomain.net. My hosting service adds an "Envelope-To" header line that tells what address the mail was for, so I can then easily filter it on my end.

This gives me all the throw-away addresses I want for spam protection and other purposes, without having to deal with the spam to a catch-all address.

My problem is the bounces from being joe jobbed by Mustang+Matt · 2004-07-17 13:16 · Score: 2, Informative

I don't get so much generic spam to @mydomain.com but I do get tons of bounces from spam that's sent out with a spoofed from @mydomain.com

--
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin

Absolutely not by macdaddy · 2004-07-17 13:24 · Score: 2, Interesting

If you ever plan on using that domain for any legitimate purposes then do not EVER give it a catchall address. A catchall address blatently invites spam. Rumplestilskin and dictionary attacks will find an infinite amount of valid email addresses in your domain and your influx of spam will grow exponentially. At some point your provider will proclaim "Enough!" and either tell you to take your business elsewhere or will start charging your by how much email you send and receive. Don't doubt this. It will happen. If you provider had any sense whatsoever they wouldn't give you the option of having a wildcard recipient.

There is but one valid reason for ever having a catch-all address. That reason is if you actually, honestly, truely WANT spam. "Who wants spam?"/I you say? I do. I have a handful of domains that have no other purpose in life but to collect spam. I've seeded addresses from those domains into dozens of spammers' "remove" forms. I built a list of 525,000 proper pronouns and used that to compile a list of userid@spamme-domains.tld addresses to seed those remove forms with. The end result is hundreds of thousands pieces of spam per day flowing into those domains. I archive much of it and automatically report the rest to the FTC as spam. Oh happy day. That's the only valid reason for ever using a catchall address that's publicly exposed to the Internet.

One word: greylisting by hedronist · 2004-07-17 13:29 · Score: 5, Interesting

Checkout Greylisting.

I run a friends-and-family hosting site (DNS, mail, web) for about 50 domains, almost all of which have catchall enabled. One user was getting 500+ spams a day, day in and day out. I was seeing 200-300 per day myself.

Four weeks ago I built the latest sendmail with Milter turned on and installed relaydelay.pl. The next day that user received two (2) emails, both of which were from friends. I got 7 emails, only one of which was spam.

Greylisting is the single most powerful anti-spam system out there. It blocks over 95+% of the spam and it doesn't "false positive" because it isn't doing pattern matches, Bayesian filtering or anything like that. It simply gives a TEMPFAIL to any email that has an unknown (from, to, server-IP) triple. If they come back more than X minutes later and less than Y minutes later, they are let through. Spammers almost always are using fire-and-forget SMTP servers so they don't retry, and so you never see their garbage. Positively elegant.

If you are the sysadmin, check it out and install it. Otherwise, hound your admin/ISP to install it. It saves bandwidth, aggravation, and time.

The corks just don't come out the way they used to.
-- My Wife, dealing with one of the new Corqs(tm)

Tremendous mistake by Big+G · 2004-07-17 13:36 · Score: 2, Informative

Not only do you get spam addressed to random accounts on that domain but all the Undeliverable Mail bounced back to spoofed addresses on that domain.

Re:a benefit of catch-all addresses by macdaddy · 2004-07-17 13:44 · Score: 4, Informative

There are better ways to do this. First off there's Sendmail "plus notation," also known as "user+detail" format. If you haven't heard about this you should do some research on Sendmail's website. The other method if you own your own domain, which obviously you do if your using a catch-all address, is to simply use aliases. Add your custom alias to your local aliases file, rerun newaliases, and you're set. Personally I use a little of both. I use aliases all the time. I can add an alias in a matter of seconds at any given point and time. A quick look at my current aliases file shows me aliases for dictionary.com, outdoorsuperstore.com, The Wall Street Journal, The New York Times and more. The best part about aliases is I can turn off the flow of spam by simply removing the alias. To stop the flow of spam to an address using plus notation I have to whip up a procmail recipe. I've seen more than one spammer strip the plus notation from outgoing addresses though so it isn't always going to stop the flow of spam. Not all web forms accept the plus sign as a valid email character. YMMV, no, I take that back. I can guarantee your mileage won't vary. Catch-all addresses have only one valid use: to collect spam. Plus notation will work much of the time. Aliases will work all of the time.

I use catch-all on three domains by tisme · 2004-07-17 14:41 · Score: 2, Informative

I do it mainly to see what websites are spamming me. For example, when I subscribe to the NYTimes, I would subscribe using nytimes071704@mydomain.com and could then see what advertising and spam comes from that signup. (If I get tired of mails to an address, I will make a rule so that all mail to that address goes straight to my trash).

My domains are not popular so I rarely get spam to emails that I never signed up anything for. Occasionally I will get an email to webmaster@mydomain or info@mydomain, but nothing more than a dozen a week. I say use it until you get too much spam, and then you can drop it while activating the emails that you still want to keep.

Here's what I use it for by airjrdn · 2004-07-17 16:00 · Score: 2

When I purchase something, I use @mydomain.com. This let's me track if they begin sending me spam or selling my address to someone who does.

For instance, let's say I buy something at Office Depot online. For my email address I enter officedepot@mydomain.com. If I start getting spam at that address, I know it's from them and can act accordingly.

I even had one company phone me thinking I'd screwed up entering my email address. Once I explained "why" I did that, they thought it was a really good idea.

I can't take credit for it though, I got the idea from my internet hosting company www.3-95.com.

--

My Tech Posts on Twitter

My catch-all spam control method by LinuxWhore · 2004-07-17 18:02 · Score: 3, Informative

I own the domain of my last name, for example jones.com. Most spammers guess that a catchall will be placed upon that root domain. However, I create an MX record for my full name, john.jones.com, and then do a catchall of (at)john.jones.com pointing to my account. Spammers seem less aware (zero guesses so far) of MX domains. Then, wherever I have to give out my email address for a registration, I give a "unique" address used just for that site, such as slashdot(at)john.jones.com. This way, if any one address becomes abused, I just put a nouser entry in virtusertable for that address.

I just hope this doesn't catch on too well ;-P . That would really reduce the effectiveness of this method as spammers would catch on. In which case, unique addresses would have to be explicit (many aliases) as opposed to implicit (via catchall). Slightly more time consuming.

--

I am MuchTall

It will increase your spam. period. by digital+photo · 2004-07-17 21:16 · Score: 2, Informative

Having done the same thing before, I can say that without a doubt, it will increase your spam.

The thing is that alot of spammers seem to literally shotgun a domain with information harvested, then use those plausible usernames as email addresses. The end result is that your primary email account will get flooded with email not originally destined for it.

If you do intend to do this, I would suggest the following:

Turn off java/javascript/vb/vbscript
Turn off auto-download of remote links
Turn off image preview
Turn off return-receipt

Having these on when you check and go through your mail will cause an increase of spam above what you are getting.

Best bet, have the domain name. Use one address, then close it and switch to another, within the domain. Have the original address just junk any future mails it gets once you are sure people have moved to your new address.

Seriously, it's just not a good idea.

--

Winged Power Photography

Catch-all is usable if you block some usernames by Vadim+Makarov · 2004-07-17 23:26 · Score: 2, Informative

I control several domain names.

In my experience, you need to block sales@, info@ and webmaster@. After that, most of the email (and spam) will be coming to the single @ wich you are actually using. There will be occasional bounces to random usernames (from spam spoofing from: addresses), but not very many in my experience.

By the way there is no spam to unpublished postmaster@ addresses, probably because this is not an address spammers want to irritate :)

Some other users have complained that they got under a dictionary attack like you describe. But not me.

--
17779 eligible voters in a district, 17779 'vote' as one. This is Russia.

Re:If I understand correctly, ... by gerardrj · 2004-07-18 12:31 · Score: 3, Informative

You don't understand correctly, I'd suggest you read the RFCs regarding SMTP.

When an SMTP session is started, two pieces of data MUST be sent before the message. Those fields amount to "from" and "to" fields and are sent sequentially by "MAIL FROM:" and "RCPT TO:" fields in that order. The "from" portion may be forged, but the "to" field must be correct as it is the address that the server delivers the message to or uses for further forwarding/processing. If the server does not recognize the to field, it will usually return a simple error (550) and may the session at that point. Also, if the server does not like the "from" field (for any reason you can program for), an error can be returned and the session ended.

Again, this is all before the body of the message is sent with the "DATA" command, thus saving potentially megabytes of data transfer. This does note require the "return" address to be correct, as this is happening at the time of delivery and the servers are talking directly about the message.

The body of a message may (but is not required to) contain other headers such as subject, to, from, received, date, content-type, message-id etc, but these fields in the data area have nothing to do with delivery as far as the receiving server is concerned.

Now.. it's possible to configure a server to operate differently, accepting all mail blindly, buffering the messages, then later figuring out where they should go.

My personal server takes the "MAIL FROM:" data and parses it, checking that the remote domain exists and there is an SMTP server that accepts mail for that domain. If any of those checks fail, I return a "not available" error (421) and close the connection.

--
Article X: The powers not delegated... by the Constitution...are reserved...to the people

Slashdot Mirror

Is A Catch-All Address Worth The Spam?

110 of 579 comments (clear)