Proving You Are Not a Spammer?

tfinniga asks: "A spammer has recently started using my domain name as 'From:' addresses when sending out spam. I'm worried about my domain being blacklisted, and I'm annoyed by the bounces — I'm getting about 1000 bounce messages a day. Unfortunately, I give out a different email address to each site I visit: slashdot@example.com, paypal@example.com, amazon@example.com, etc., and the spammer is using a different address for each mail, so simple address filtering doesn't work. What is the best way of avoiding being put on a blacklist, and dealing with the flood of bounces?"

Comments

Procmail helps a lot

[Ted Cabeen]

I've had a lot of luck setting up a procmail script on the address I use for emails that match the domain wildcard. If you drop messages with a null Return-Path, you'll get all true bounces. Add to that some From header matching for things like mailman lists and mails from mailer-daemon (for those mail systems that don't follow the RFCs) and you should be able to eliminate pretty much all bounce traffic from emails that hit your domain wildcard. Don't forget to forward everything that doesn't hit the rules back to your primary email address. An SPF record can also help, although not enough people are using it to make it really helpful, and it breaks mailing lists. Also, most mail admins understand that nearly all spam From headers are forged, and you shouldn't be blacklisted for being the subject of a Joe-Job.

Here are the current regexp lines I have in my .procmailrc for that user (all of these send the offending message to /dev/null):

* ^Return-Path:
* ^From:.*majordomo
* ^Subject:.*Returned.mail
* ^From:.*mailer-daemon
* ^Subject:.*mail.could.not.be.delivered
* ^From:.*(postmaster|devnull)
* ^Subject:.*autoreply
* ^From:.*spamarrest

Re:Procmail helps a lot

[Ted Cabeen]

The first line above should be:
* ^Return-Path: <>

Darn HTML-like comments.

Re:me too

[lanzz]

no, a joe-job is when a competitor sends spam advertising (in the actual message body) your website/product/service/whatever, in hopes to discredit you. what the original poster complains about is simple from-spoofing; i don't believe anybody would block his domain due to its use in spoofed from: headers. my domain has been used this way by spammers in the past, and i haven't noticed anybody blocking my mails.

Run a web host

[adamstew]

I run a web hosting business...small but large enough that this happens on a regular (read: daily) basis for the people I host.

all of the good and 99% of the bad network admins will know better than to trust a "From" header in an email. I can't think of anyone that will block a domain based on the From header. Most network admins who setup blacklists blacklist server IPs that email comes from, and not email headers.

As for your catch-all address, you can use some of the techniques that others have mentioned in previous comments. I usually tell my customers to just wait it out. The spammers will stop using your domain after a day or two. give it another couple of days for the mail queue's to empty out, and you'll stop getting bounces.

Joe Jobbed

[bmo]

You are being joe-jobbed. Do not worry about it.

http://www.spamfaq.net/terminology.shtml#joe_job

3.2.22 What's a "Joe Job"?
The act of faking a spam so that it appears to be from an innocent third party, in order to damage their reputation and possibly to trick their provider into revoking their Internet access. Named after Joes.com, which was victimized in this way by a spammer some years ago.

You will not wind up on a blacklist. This is a well known phenomenon among mail admins.

--
BMO

DomainKeys and DKIM

[jediknil]

This has happened to me not once but twice, and I really was at a loss at what to do. Well, and angry and annoyed. The second time I decided enough was enough and set up DomainKeys and DKIM (both because DKIM hasn't quite caught on enough yet). Both of them are ways to sign your e-mail so the receiving server can be sure that it actually came from your domain. It's not yet a real solution because not enough people/sites use it or validate against it, but encouraging adoption is always a good thing.

Of course, signing mail isn't really enough to stop it, so you may have to turn off the "catch-all" feature of your mail just to avoid mail bounced to "xycjdfedf@mydomain.com"

Re:Use Google Apps (Gmail for your own domain)

[Anonymous Coward]

Umm.. Google Apps has POP access for all accounts, including the free stuff.

Filtering is your only problem

[trumplestone]

Domain blacklisting probably isn't a problem---Every sane sysadmin these days know that the address in the "From" field of a spam email has nothing to do with the origin of the spam.

You might want to investigate "Sender Policy Framework", which allows you to add a DNS record to your domain specifying who (in terms of IP addresses) is allowed to send emails that claim to come from your domain. You will probably find that it doesn't decrease your spam bounces, however.

The other option that may be feasible depending on your setup is ensuring that all outgoing emails have a Message-ID with some sort of token in it that you can recognise. All incoming bounces that are not replying to a Message-ID with your token in it are spam.

Just some ideas.

Sorry you can be blacklisted

[lunatick]

To all the people saying domains don't get black listed. Sorry you are wrong.

I posted this exact question to slashdot about 4 years ago, back then you were just pretty much screwed.
I was actually recieving threating return mail for sending spam, which is why I posted here.

My domain did end up on a bunch of black lists and is still on a few to this day.

I will say that the better ISP's use a mailserver based black list and not a domain based one, but there are still some out there.

Now what you can do.

Go to the FTC ID theft complaint form

https://rn.ftc.gov/pls/dod/widtpubl$.startup?Z_ORG _CODE=PU03

Yes spoofing your e-mail is a form of ID theft.
The company advertised is just as legally responsible as the spammer.

If you keep fileing complaints the spammers learn not to use your e-mail. The ones in the US and Canada you can actually sue to recover damages.

Good luck

Re:SPF

[blowdart]

Not true. They can send; but recipient mail servers which use SPF can check the records and reject accordingly. Unfortunately with SPF, and DomainKeys/DKIM the majority of servers don't bother.

Your real problem is the backscatter

[Slashdot Parent]

As others have pointed out, everyone knows that spammers forge the From: header, so your domain would not be blocked except by the dumbest of mail admins.

Your real problem is the backscatter (those 1000 bounce messages you get per day). My solution follows:

I still have all of my mail logs since time immemorial, so I wrote a script to parse out all of the From email addresses in outgoing email and made a list. Going forward, each outgoing email from my server gets its From address added to that list.

In other words, I have a list of every possible From address ever used to send email from any of my domains (and the domains of the folks I host because they were jealous of my spam filtering).

Part of incoming email processing is a rule that if your envelope sender is <> (that is the envelope sender for bounce messages), and the envelope recipient is not on that magic list of my outgoing senders, then the message must be blowback, and you get an SMTP rejection code and a message that explains why your email was backscatter and to please fix your server.

Before you respond and say, "What about email addresses that you put in webforms? Hello!" Remember, I only apply this rule to envelope sender <>. If you're bouncing email to an address that has never been used to send email, then you are sending blowback.

A desperate plea to mail admins out there: For the love of all things holy, stop sending delayed bounces! When you reject a message, reject it during the SMTP session! Do you have any idea how much pain you are causing others? More information here.