Slashdot Mirror

← Back to Stories (view on slashdot.org)

Is A Catch-All Address Worth The Spam?

Posted by timothy on from the so-much-trouble-in-the-world dept.

wildzeke writes "I plan on switching Internet providers this summer to get a faster speed. Since losing an email account is the biggest pain when switching providers, I decided to pay the extra money to have email for the domain I registered. One of the options provided is to make one of your email accounts a catch-all account. In other words, any email sent to this domain with out a valid user name, will be dumped in the catch-all account. The question I have, is this a good idea or not? On one hand, it may catch important email such as admin, or postmaster or simply mis-typed user name. On the other hand, the catch-all will open the flood gates to spam who will send to [all user names in the world]@domain.com."

39 of 579 comments (clear)

  1. No brainer by tarquin_fim_bim · · Score: 4, Insightful

    If the mail is from an intelligent human being they will generally conclude from the returned mail that they have erred, and readdress it accordingly. In the event of any other outcome you are probably better off not receiving the mail.

    1. Re:No brainer by studerby · · Score: 4, Insightful
      I don't think it has anything to do with intelligence, per se. I've seen an MD/PhD with an annual reseach grant total of $100 million struggle with this; I had to go to train his office manager on how to update his mail aliases, 'cause the mail client he liked was funky. If it wasn't in his alias list, and therefore clickable, he'd fubar it about 10% of the time and force the manager to fix it right now , 24/7, and he never understood anti-spam obfuscation (his staff filtered his incoming email for him).

      His time was very valuable and he just wanted it to work.

      Of course, the odds are good that nearly 50% of the people out there are of below-average intelligence, so any plan has to deal with both ends of the bell curve.

      --

      .sig generation error:468(3)

    2. Re:No brainer by geminidomino · · Score: 4, Insightful

      I agree. I bought my own domain as well, and I turned on a catch-all address (called "spamtrap") specifically TO catch spam. That's all it does catch. If someone types your address wrong, they should be smart enough to figure out "55x No such User" (or whatever the error is) and double-check the address. Anyone saying "random" spam is far less than targeted probably doesn't run a mailserver and watch the dictionary attacks mount up in the log file. "adam@domain", "anthony@" all the way up to "zachary@" (not to mention the various permutations of aaabbbccc, etc...). Unless you're trying to track where the spam is coming from (by reading recieved: headers, not "From:" lines), a catch-all address is nothing but a spam-catcher.

    3. Re:No brainer by Anonymous Coward · · Score: 5, Insightful

      Well, frankly I *would* consider that as a measure of intelligence (at least to some degree).

      For instance, if a user:

      - has used a computer for a number of years (by the sounds of it the very same applications for that same time)

      - depends on using the computer for important work

      and still can't use it properly (and won't take the time to actually *learn* to use it properly - eg, basic typing/clicking skills), I consider that an intellectual defect.

      It's like any other field - if you depend on a particular tool, you have to be able to actually use the tool properly or you'll mess things up repeatedly. And if you do mess things up on a regular basis, that's no one's fault but your own.

      Think of all the "valuable time" he has wasted by simply not learning to use his tools.

    4. Re:No brainer by SoupIsGoodFood_42 · · Score: 4, Interesting
      If I send a letter to you, and it's addressed like this (pretending that the following is your address):

      Joe Sixpack
      Street, City etc...

      You'd expect to get it.

      If I sent a letter, but with the name in any of these variations:

      JoeSixpack
      J Sixpack
      Joe T Sixpack

      You'd still expect to get it, right?

      Now do you understand why people are telling you it's spelt correctly, when infact there's an extra space in there?

      Perhaps it's the original designers of the email systems we use, who's intelligence has been overestimated. Because they made addresses far to easy to get wrong.

      Now, as a web designer. I understand why these things are that way. But many--including intelligent--people don't understand these little technicalites. Because the expectations of other things in life has taught them differently.

    5. Re:No brainer by lahi · · Score: 4, Informative

      It is absolutely amazing how people can refer to a standard when they obviously have either not read it or not understood it.

      Chapter 6 concerns itself with address specifications.
      The syntax in paragraph 6.1 specifies:
      addr-spec = local-part "@" domain
      local-part = word *( "." word ) ; uninterpreted, case-preserved

      So the local-part is UNINTERPRETED and has its case PRESERVED, presumably to allow case-sensitive handling locally. Moreover, the use of a "."-separated list of words does not imply any structure imposed or recognised by SMTP, it is merely a conveient way to avoid quotes in a large number of cases ("... such occurences carry NO semantics.").

      The exception is the local-part "Postmaster" which is required to be recognized using any mixture of case.

      So SMTP-servers are not case sensitive, but case preserving when it comes to the local part. The delivery or non-delivery of a message to a recipient however, is a local matter, and SMTP doesn't care about what happens, and whether case-sensitivity is used for this.

      It just so happens that local mail systems these days are not case sensitive, although I believe the broken SVR2.2+some bsd+some SVR3/4 based A/UX system I used in the early nineties might very well have been.

      (Quotes typed manually from the copy of RFC-822 which I printed out in about 1991 or so. Yes, about the same time some Berners-Lee guy made a few grave mistakes which would end up as the mess we now know as WWW.)

      -Lasse

  2. No big problems here by andyrut · · Score: 5, Insightful

    Buying your own domain is a smart move. As long as you keep paying for the domain, your e-mail address can travel with you, even when you change ISPs.

    From personal experience, I've found that only a very small percentage of spam I get comes from using the catch-all address. I get only a few junk e-mails to "webmaster", "postmaster", and other generic usernames. A far greater portion of it is addressed to the "real" e-mail address I use that's been plastered all over the web for years and years.

    Judging only from my inbox, it would seem that spammers are more likely to use lists of known e-mail addresses than trying to guess valid usernames for a domain. My advice would be to use the catch-all address and just wait and see if spam becomes a problem. Turning off the catch-all wildcard, if need be, is a very simple operation.

    1. Re:No big problems here by Oloryn · · Score: 4, Interesting
      From personal experience, I've found that only a very small percentage of spam I get comes from using the catch-all address.

      My experience doesn't match. I've got my own domain, hosted on my home computers. I don't use a catch-all address, but my mail logs show anywhere from 400 to 1200 emails daily bounced because they're addressed to invalid email addresses. Roughly 80% of these come with an envelope from address of (null, supposed to be used only by bounce messages). Because spammers are sometimes known to use as an envelope from address on spam, I can't be sure that these are all bounce messages. I am pretty sure, though, that they represent either spammers using a dictionary attack on my domain, or spammers using @mydomain> as a From address for that spam. And the other ~20% are pretty well for sure dictionary attacks on my domain.

      Now, I'll admit that while I'm by no means a big-time anti-spammer, I have done my share of reporting spammers to their ISPs and posting on nanae. It's possible that I've gotten on a list of 'known anti-spammers' that spammers use for generating spam from addresses, just for harrassment potential. My experience may apply mostly to those who go beyond filtering in fighting spam. But it is another data point.

  3. Your shouldn't worry about that by toetagger1 · · Score: 4, Insightful

    If you use a spam filter, you sould not have to worry about it. You are not exposed to more kinds of spam, just more instances. And since spam filters currently have no issue with volume, you should be ok.

    --
    who | grep -i blond | date cd ~; unzip; touch; strip; finger; mount; gasp; yes; uptime; umount; sleep
  4. Isn't that the POINT? by SuperRob · · Score: 5, Insightful

    What does it matter if it opens you up to spam. It's a catch-all account right, isn't that what it's supposed to do?!?

  5. Here's one way to get the most from it by quinxy · · Score: 5, Informative

    As someone who has been using a catch-all account for years, and has enjoyed the benefits and suffered the consequences, I would suggest you do it (though not without some warnings and recommendations). I do receive a fair amount of SPAM for accounts which have never existed on the system. I have also endured several periods when some SPAMmer referred to fake accounts at my domain in the return-to of the SPAM they were sending out (they were not using my mail server, they simply made up random usernames for my domain). Since they were random (both the names they used and the content of the SPAM) it was impossible to easily filter out. That sucked. I would receive hundreds of bounce messages per day. Ultimately I was able to make it stop by writing a script to post every bounce message I received through to the support form on the websites being advertised (modifying for each of the three or four sites which were involved), making the normal "cease and desist" legal threats. It seemed to work, since the SPAMs did stop soon after (presumably those sites complained to the SPAMmer they employed), and the SPAMmer no doubt moved on to some other fake accounts. Bastard. One of the best features of the catch-all is that you can totally control to whom you give out your "real" e-mail address, as well as track who is using the e-mail addresses you are giving out. For example, if you want to register at example.com for something, you give them the address me.example@yourdomain.com (or some structure which has a prefix or postfix, the 'me.', and the site name for which you are registering). You'll be able to receive that sites mail until you either don't want to, or until you see that they have abused the privilege of e-mailing you. Often I will see six months after registering to some site, I start getting tons of SPAM from the e-mail I gave to that site, and I can then simply block that on the mail server, bouncing them or sending them to /dev/null (via aliases, for example). This is the greatest strength in using catch-all addresses. To mitigate the danger I mentioned previously of fake usernames, one should (though I am no sendmail expert and don't know how) set up a rule that any incoming recipient address must correspond to an existing account/alias, OR the catch-all structure you want (the whole PREFIX.SITENAME@yourdomain.com). Q

    --
    Don't vote for Eugene Papansanovich for Congress!
  6. the whole /point/ of a catchall address is spam by luge · · Score: 5, Insightful

    It is great. You never have to worry about giving out an indiscriminate address again. Signing up for a fantasy league on cnn/si? I used cnnsi@mydomain. cnnsi sold it and now I get several hundred spam a day there. And I can trivially filter and nuke them, with the added bonus that I know never to send them my business again. amtrak has amtrak@mydomain, I get all the mail from it, and can easily track that they have never violated their TOS. It's the greatest thing- I heartily recommend it to anyone who can.

    --

    IAAL,BIANLY

    1. Re:the whole /point/ of a catchall address is spam by Zocalo · · Score: 4, Informative

      Alternatively you could also flip that on its head and proactively add new accounts as required, which is what I do. So, if the scumbags at "Foo Corp." decide to sell my email address, I simply delete the "foo@mydomain" entry from my aliases file and both the spammer and Foo Corp. just get a User unknown from the MTA. It avoids all the pain of having a catch-all address and as a bonus it makes sorting email into folders a snip because "To:" is always unique and relevent!

      --
      UNIX? They're not even circumcised! Savages!
    2. Re:the whole /point/ of a catchall address is spam by KingJoshi · · Score: 4, Interesting

      I do this as well. I used to have an email address from MailBank (later changed to NetIdentity). They buy up domains with last names so you can do firstname@lastname.com. They started off charging $5 a year for email and now it's $25/year. I got fed up with it and bought my own domain name.

      Best move I did. I have greater control over it and feel more security about it as well.

      There is a free DNS service held by ZoneEdit. If you only use it for one domain, it allows free email forwards, web forwards, etc. It has about all the services I could ask for (except hosting) for free (assuming you don't go over a quota).

      I have emails redirected to my gmail account as well as comcast (which also hosts my personal website). I could host this on my own computer or elsewhere and I have a lot of freedom to do what I want.

      And as the parent said, being able to create email addresses on the fly allows you to catch businesses that sell your email address, or find out where the spammers mostly target (and as another poster said, Slashdot is worst of all the ones I've created). It also makes it easier to filter with gmail and do searches and so forth.

      I know I'm being mostly redundant as others, but I can't emphasize enough how valuable this is, especially to a computer geek. And I'm only paying $7/year for all this! I can't mod the parent up any more so I just want to re-iterate the value of catchall addresses and owning your own domain name.

      --
      In times like these, it is helpful to remember that there have always been times like these. - Paul Harvey
    3. Re:the whole /point/ of a catchall address is spam by luge · · Score: 5, Insightful

      This is a good approach, and the one I'd use, /if/ I had an easy admin interface to add accounts. But most don't (and it certainly sounds like the questioner on the original question doesn't.)

      --

      IAAL,BIANLY

  7. I gave it up after a year by killbill · · Score: 5, Interesting

    I fought it for a year or so, coding up custom filters, using spam assassin, you name it, and finally just gave up and blackholed it.

    Spammers are trying dictionary attacks against domains to try and guess live accounts. I would get 500+ copies of the same message to made up names in alphebetical order a day.

    That being said, I have since gotten on the Gmail beta, and just forward all my mail there now. It has a far better spam rejection rate then anything else I have tried, so if you forward all your mail to a google account and let them try and sort out the spam, it would probably be usable (and maybe even helpful to them to train their filters).

    --
    Mathematically impossible requirements are technically not against policy.
  8. Speaking from experience by Bradee-oh! · · Score: 5, Insightful

    I have a catch-all address at my domain. YES, there are huge amounts of spam. BUT, it is definitely worth the trouble IMHO, and here's why.

    1 - most of the spam seems to come to 5 or 6 addresses only - admin, root, sales, webmaster, etc etc. That's cake to filter out straight to trash.

    2 - The convinience of being able to sign up for random websites with a different address on the fly is great. For example, signing up on ebay to buy something and using the address "fromebay@mydomain.com" means you KNOW that only one person in the world has your email address so you know who to blame if spam starts coming in, and it is also a piece of cake to automatically filter those ebay emails straight to an ebay inbox, for example.

    3 - Not as significant as my first 2 points but still a nice perk in my setup is that I'm able to create email addresses for family and friends on the fly and just setup my own server to split the addresses out into their own inboxes.

    So if you will be running the server(s) yourself over slow dsl or cable, the volume of spam MAY be a concern to you. I get about 600-700 spams a day to the common webministrater addresses I mentioned, but it's no concern to me because I don't run the incoming email server and my dsl is more than fast enough to d/l them in a few seconds.

    But in any other case, I'd say it's well worth it! And on a slightly different note, I have been very impressed with the honesty and adherence just about everywhere has to their privacy policies regarding email addresses. over 2 years of using my system with about 50 "from@domain.com" addresses, only one of them screwed up and got the address on a spam list somehow - cancelling my account with them and filtering those spams straight to trash solved the problem.

    --
    "This is Zombo Com, and welcome to you who have come to Zombo Com" - www.zombo.com
  9. No catch-all problems by GrouchoMarx · · Score: 4, Informative

    I've been running my own mail account off of my own domain for about 2.5 years now, and I don't regret it. I do have the catch-all set to dump to my personal account, and it's not been a major problem. Most of the spam I get is addressed to a "real" address (either mine or one of my older accounts I have forwarded to me), and there's a lot of that, so the amount I get from the catch-all is negligible.

    In practice, actually, most of the spam-related stuff I get is mail bounces attempting to a random address with a faked from line of 63745624573@mydomain.com (or something like that). I really should look into implementing SenderID, but that would require hosting the server myself on a my dynamic IP instead of letting my web host take care of it. :-)

    --

    --GrouchoMarx
    Card-carrying member of the EFF, FSF, and ACLU. Are you?

  10. In a word... by Vellmont · · Score: 4, Informative


    is this a good idea or not?

    No, it's not a good idea. Looking through my mail server (and other mail servers I administer) I've seen A LOT of attempts by spammers to harvest email addresses by just trying a lot of common names on the domain (and some strange not so common addresses). If you had a wildcard address, you'd get all that spam to that box.

    With no wildcard email address if people miss-spell a name on your domain, they'll get a prompt bounce message (and they'll probbably figure out the miss-spelling). With a wildcard they'll never figure out the miss-spelling, and may continue to use that wrong address.

    There's also the problem of auto-generated virus bounce messages from other peoples servers. Most viruses lie about their from address, and can even make up a @yourdomain.tld. If you had a wildcard all those erroneous "you sent a virus" messages would go to your wildcard box instead of just bouncing.

    Unless you want an account that's deluged with spam and like wading through it every so often on the off-chance someone sent a message to admin or postmaster, I'd not create a wildcard box.

    --
    AccountKiller
  11. Just dump non-existent users by kstumpf · · Score: 4, Interesting

    I think it's best to just reject mail addressed to non-existent users during the SMTP transaction. My outside relay uses Postfix's relay_recipient_map to validate all recipients before relaying inside... anything not matching gets rejected with a 550. This saves my content filters (amavis/clamav) alot of work since we get TONS of spam to non-existent recipients.

    relay_domains = mysql:/etc/postfix/mysql-relaydomains.cf
    relay_re cipient_maps = mysql:/etc/postfix/mysql-recipient.cf,
    mysql:/etc/postfix/mysql-alias.cf
    relay_transport = relay:mx2.somethingawful.com

    If you don't validate recipients, then you probably SHOULD use a catch-all address. The alternative to this would be bouncing spam back to the (usually forged) sender, in which case you become part of the problem and can cause yourself major queueing problems.

  12. Spam not a problem if forwarding also included by Diamon · · Score: 4, Informative

    I recently switched to using e-mail from my registar/hosting company, they included one free address and I paid for an additional 5 mailboxes.

    I set up an account for myself and my wife, and used the free account for a spam bucket. My account is set up as a catch-all. Whenever I sign up for something I use and address in the form slashdot.org@<mydomain>.com so if it does start getting spam I know who sold my e-mail address.

    If any spam comes in being caught by the catch-all I set up a forwarder to my spam account. For example dns@<mydomain>.com gets forwarded to spam@<mydomain>.com I then just set up my e-mail client to dump anything that comes in via the spam account directly into the trash.

    To date I have received spam on three addresses that didn't really exist (dns@, sales@ and info@), but overall it works very well.

  13. Automatically sorting out SPAM by SmoothTom · · Score: 4, Funny
    "Most of the spam these days is ovbious spam like Subjects which make no sense and often have lots of spelling errors in the body."

    Uh, sorry, but that sounds just like the legitimate e-mail I get from some of my friends... :o)

    --
    Tomas

  14. Disagree by Uber+Banker · · Score: 4, Interesting

    But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam:

    If it is a personal domain with perhaps a couple of description pages and even a blog then, like me, you will get no more (from personal experience) than 10+ random (random in the way they are sent to webmaster/admin or anything that * catches other than regular) messages/week. No big deal

    A better known site seems to get a greater ranking in auto-traffic (let me generate logos, banners, security, etc for your website). But an email address listed on the site (my site) gets far more spam than a generic catch-all (e.g., I have "email webmonster@....com" as the auto admin address, more emails come to that than webmaster coz it's googled/harvested on those lists).

    But the original statement said "I decided to pay the extra money to have email for the domain I registered" WFT?! Go to something like directnic.com, get your domain for $15/yr and get mail forwarding included (including wildcard)!

    1. Re:Disagree by studerby · · Score: 4, Interesting
      I suspect your domain hasn't been out there long enough yet.

      My company's primary domain is registerd with technical contacts of "hostmaster@[our_domain.com]" and for years we never got a spam. Then about 2 years ago, somebody must have included it in a big master list; now it takes about 30-50 spams a day on average, mostly true "bottom feeder" crap like cialis and vicodin and *adult* crap.

      My work email's been out there a lot longer, but doesn't draw nearly the number of spams and about 80% of them are financial/economic scams - mortgage and stock touts, lottery, 419, etc.

      Upstream filters are blocking emails with virus attachments; I have no idea how many of those are coming in...

      --

      .sig generation error:468(3)

    2. Re:Disagree by MDMurphy · · Score: 5, Informative

      Catch all will kill your inbox. I had a catch all from 1996-2002. All of a sudden, around Labor Day 2002 I started getting up to 3000 spams a day. The vast majority were to bogus addresses. Even with local spam filtering my email client was spending near 100% of the time downloading mail.

      I eventually killed the catch all, resulting in losing email from some places I'd given unique email addresses to. Also went with a 3rd party spam filter ( spamcop.net ) so most spam never makes it to my desktop at all, getting filtered upstream.

      Recently I got a Gmail account. Just for grins I thought I'd test their spam filtering capabilities before using it for anything "real". I reactivated my catch all, forwarding it to my Gmail account. In the last 3 weeks my Gmail spam folder has accumulated 163MB of spam, or almost 27,000 individual messages. Gmail is only catching 30-50 percent of it, I've had to manually tag the remainder.

      So while all my catch all addresses bounced these past two years the flow has reduced from 3k a day to about 1k a day.

      The only reason to have a catch all is if you want lots of untargeted spam. I don't know how these yahoos do their billing, but if any of them base it on what bounces vs. what's read, then having an open address might just mean they'll make more money because of you.

    3. Re:Disagree by macdaddy · · Score: 4, Informative
      But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam

      On the contrary wildcard spam is extremely common. When was the last time you ever watched the maillog of a busy MTA? I garuntee you it will be riddled with User Unknown errors from dictionary, Rumplestiltskin and wildcard attacks. It's that way on every mail system I've ever administrated, including the ones I administrate now.

    4. Re:Disagree by Uggy · · Score: 4, Interesting

      I actually have an old domain dedicated to just that... collecting 100's of spams a day to train the bayes filters. Identical spams sent a hundred times just help me confirm what spam looks like. I use my other users to train the ham side, and guess what, it works like a charm. We get considerably less spam. So, yes catchall domains are useful... as spam honeypots.

      --
      Toddlers are the stormtroopers of the Lord of Entropy.
    5. Re:Disagree by mcrbids · · Score: 4, Interesting

      But I think it depends on what you are using your domain for; wildcard spam is minor/rare compared to targetted spam

      Wow. Could you be more wrong? As sysad for two smallish ISPs, I've been seeing serious SPAM attacks as (random string)@domain.com.

      As many as 200,000 attempts in 24 hours. Repeatedly, for multiple domains. From hundreds of different sources. (We even put in a double bounce handler to identify source addresses; it was rare to see any single IP addresses attempt to deliver more than 10-20 in a 24 hour period)

      While your other points are valid ones, on this one you are dead, dead wrong.

      And, to the article poster, NEVER USE A WILDCARD. EVER. A bayesian filter running at 99.98% effectiveness would still not be as accurate as sending all wildcard email to /dev/null !

      --
      I have no problem with your religion until you decide it's reason to deprive others of the truth.
    6. Re:Disagree by The+Snowman · · Score: 4, Informative

      What is the difference of DirectNIC and PairNIC? I have been using DirectNIC 5 years with no probs.

      They are just different registrars. pairNIC is very customer-friendly, offers extra features like IPv6 and SPF, allow direct editing of DNS entries for people who are control freaks (most registrars just allow editing contact info, anything else is like pulling teeth). You can do email forwarding with them too, but I also have web hosting through their parent company and this includes an extensive email system including a custom qmail setup and procmail. I can install ClamAV and other software on my server if I want.

      These servers run FreeBSD, a dead operating system, so the Slashdot trolls should have fun with this post :-)

      --
      24 beers in a case, 24 hours in a day. Coincidence? I think not!
  15. So close.... by Groo+Wanderer · · Score: 5, Insightful

    You are so close to the right solution. Spam almost universally will have a spoofed address, so sending something back to the 'sender' will not net you any more spam. Sending back is OK.

    The trick is to put useful info into the reply. Try setting up a message in the 'this address does not exist' autoreply. Put in something like 'bob@domain.com does not exist. If you are trying to reach Robert Smith, please resend to robert@domain.com. If you want to reach someone in an administrative capacity, send an e-mail to admin@domain.com'.

    You can extend this to all the positions that matter, postmaster, webmaster etc, and a few key people at the domain. The bad guys shouldn't get it, and the poor twinks who have their domain name spoofed will probably ignore it.

    The people who DO need to contact you and did either screw up or guess wrong will simply get the info that they need to do right. Win/Win.

    -Charlie

    1. Re:So close.... by Brad+Oliver · · Score: 5, Insightful
      Try setting up a message in the 'this address does not exist' autoreply. ... The bad guys shouldn't get it, and the poor twinks who have their domain name spoofed will probably ignore it.

      As a "poor twink" on the receiving end of a lot of spam, I've found that my filters are effective against everything but auto-replies.

      Getting a ton of auto-replies from people on vacation, with invalid addresses, support addresses that have changed, and the ever-helpful "you've sent us spam and we've rejected it but our spam filter is too stupid to realize the sender was forged" really gets old after the first week.

      Don't use an autoreply and turn your problem into my problem.

    2. Re:So close.... by NoMercy · · Score: 5, Insightful

      Ideally the mail server shouln't accept the emails, not construct a nice reply, just send the relevant code and a short single-line message that the server is unable to relay/deliver the email.

      The spammer's SMTP engine will get a mark against the email as bad, and valid ISP's relaying emails for there customers will generate a nice email for you saying that the address is invalid.

  16. Use subdomains by gregmac · · Score: 4, Informative

    For example, if you want to register at example.com for something, you give them the address me.example@yourdomain.com (or some structure which has a prefix or postfix, the 'me.', and the site name for which you are registering).

    What I've been doing for the last couple of years is using a catchall at a subdomain of my actual domain. The typical dictionary spams (postmaster, sales, etc) don't come in, because they only work on top level domains (otherwise spammers would be wasting a large amount of time spamming "sales@www.domain.com" which pretty much never exists..

    When I sign up for an account at example.com, I just register as example.com@catch.mydomain.com. If I get spam, I can block it, and it doesn't interfere with my actual domain. If I decided one day I get too much spam to it, I could just switch to another subdomain name.

    --
    Speak before you think
  17. Use Mailinator! by popo · · Score: 4, Informative


    Forget the "Catch All" e-mail address. Use Mailinator.

    FYI -- mailinator is a non-passworded public catch-all system. Perfect for temporary site registrations. I use it frequently and its an unbelievably good service...

    --
    ------ The best brain training is now totally free : )
  18. Whatever you do... by Fweeky · · Score: 5, Informative

    Make sure addresses like postmaster@ and abuse@ work. They're unlikely to get spammed, but may well receive important messages.

    postmaster@ is actually required by rfc2821, btw.

    As for the subject of the discussion; my catch-all addresses have been fine, but YMMV. If I was that worried about dictionary attacks, but still wanted the ability to give a new address out to each company, I'd do something like *-signup@mydomain or *@signup.mydomain or similar, but you might not have that level of control (in which case I'd recommend finding somewhere better to host your email, but *shrug*).

  19. Re:a benefit of catch-all addresses by lewko · · Score: 4, Informative

    I used to use my catchall for precisely that (e.g. slashdot@mydomain.

    It DID help me bust someone for passing on an address which was instantly traced back to them.

    Spam however has completely ruined it though for the problems outlined in this article. Unfortunately I can't turn off the catch-all as there are so many 'legacy' addresses from which I might only hear once a year but don't want to miss their email.

    I now use http://www.spamgourmet.com/ instead to create disposable accounts as I have the luxury of being able to kill them (or let them die) if need be. It's free and I highly recommend it.

    --
    Do you or your partner snore? - Visit www.snoring.com.au
  20. Re:Been there, done that by lewko · · Score: 5, Funny
    The only thing I really had to do was notify my friends, who are long used to typing whatever they want into the username section of the domain, tailored to whatever it is they want (eg boywhowillfixmycomputer@, bikemechanicmanwhowillalsofixmycomputer@ etc).



    The worst thing is when your so-called friends figure out for themselves that you have a catchall set up, so you start receiving emails to pigfucker@yourdomain, grabass@yourdomain etc... and it's not even spam, it's from your friends!


    I now use the free http://www.spamgourmet.com/ for my disposable addresses and highly recommend it.

    --
    Do you or your partner snore? - Visit www.snoring.com.au
  21. One word: greylisting by hedronist · · Score: 5, Interesting
    Checkout Greylisting.

    I run a friends-and-family hosting site (DNS, mail, web) for about 50 domains, almost all of which have catchall enabled. One user was getting 500+ spams a day, day in and day out. I was seeing 200-300 per day myself.

    Four weeks ago I built the latest sendmail with Milter turned on and installed relaydelay.pl. The next day that user received two (2) emails, both of which were from friends. I got 7 emails, only one of which was spam.

    Greylisting is the single most powerful anti-spam system out there. It blocks over 95+% of the spam and it doesn't "false positive" because it isn't doing pattern matches, Bayesian filtering or anything like that. It simply gives a TEMPFAIL to any email that has an unknown (from, to, server-IP) triple. If they come back more than X minutes later and less than Y minutes later, they are let through. Spammers almost always are using fire-and-forget SMTP servers so they don't retry, and so you never see their garbage. Positively elegant.

    If you are the sysadmin, check it out and install it. Otherwise, hound your admin/ISP to install it. It saves bandwidth, aggravation, and time.

    The corks just don't come out the way they used to.
    -- My Wife, dealing with one of the new Corqs(tm)

  22. Re:a benefit of catch-all addresses by macdaddy · · Score: 4, Informative

    There are better ways to do this. First off there's Sendmail "plus notation," also known as "user+detail" format. If you haven't heard about this you should do some research on Sendmail's website. The other method if you own your own domain, which obviously you do if your using a catch-all address, is to simply use aliases. Add your custom alias to your local aliases file, rerun newaliases, and you're set. Personally I use a little of both. I use aliases all the time. I can add an alias in a matter of seconds at any given point and time. A quick look at my current aliases file shows me aliases for dictionary.com, outdoorsuperstore.com, The Wall Street Journal, The New York Times and more. The best part about aliases is I can turn off the flow of spam by simply removing the alias. To stop the flow of spam to an address using plus notation I have to whip up a procmail recipe. I've seen more than one spammer strip the plus notation from outgoing addresses though so it isn't always going to stop the flow of spam. Not all web forms accept the plus sign as a valid email character. YMMV, no, I take that back. I can guarantee your mileage won't vary. Catch-all addresses have only one valid use: to collect spam. Plus notation will work much of the time. Aliases will work all of the time.