Proving You Are Not a Spammer?

tfinniga asks: "A spammer has recently started using my domain name as 'From:' addresses when sending out spam. I'm worried about my domain being blacklisted, and I'm annoyed by the bounces — I'm getting about 1000 bounce messages a day. Unfortunately, I give out a different email address to each site I visit: slashdot@example.com, paypal@example.com, amazon@example.com, etc., and the spammer is using a different address for each mail, so simple address filtering doesn't work. What is the best way of avoiding being put on a blacklist, and dealing with the flood of bounces?"

Comments

Procmail helps a lot

[Ted Cabeen]

I've had a lot of luck setting up a procmail script on the address I use for emails that match the domain wildcard. If you drop messages with a null Return-Path, you'll get all true bounces. Add to that some From header matching for things like mailman lists and mails from mailer-daemon (for those mail systems that don't follow the RFCs) and you should be able to eliminate pretty much all bounce traffic from emails that hit your domain wildcard. Don't forget to forward everything that doesn't hit the rules back to your primary email address. An SPF record can also help, although not enough people are using it to make it really helpful, and it breaks mailing lists. Also, most mail admins understand that nearly all spam From headers are forged, and you shouldn't be blacklisted for being the subject of a Joe-Job.

Here are the current regexp lines I have in my .procmailrc for that user (all of these send the offending message to /dev/null):

* ^Return-Path:
* ^From:.*majordomo
* ^Subject:.*Returned.mail
* ^From:.*mailer-daemon
* ^Subject:.*mail.could.not.be.delivered
* ^From:.*(postmaster|devnull)
* ^Subject:.*autoreply
* ^From:.*spamarrest

Re:Procmail helps a lot

[Ted Cabeen]

The first line above should be:
* ^Return-Path: <>

Darn HTML-like comments.

Use whitelisting

[chatgris]

I run my email the exact same way that you do, and I have had the same problems. Fortunately, I've never been rejected as a spammer based on my domain name alone, and if you are hopefully someone else here can help you solve that problem.

As far as stopping the bounces... The only way I've found that works is to use a whitelist system... filter all of the addresses that you know are good (paypal@example.com, etc) into folders, and everything else goes into a generic catchall folder that you give a quick scan to before moving it to a long term keep folder.

Just a note... I highly recommend the keep folder over just trashing the message. When's it's morning and you are groggily mass deleting messages, sometimes good messages get axed accidentally... If you have your own domain, it's likely that you have POP so long term storage shouldn't be a problem.

Josh

SPF, backscatter howto

[Michael Wardle]

If the sender is forging your From address, chances are they're not using your mail server. Most decent blacklists (e.g. SpamCop, Spamhaus) will blacklist the offending server's IP address, not your mail domain.

Consider implementing SPF (home page wiki) so recipient mail servers can drop the message if it wasn't sent from a server authorized to send mail from your domain.

Most bounce messages will not include your outgoing server's signature. You can consider dropping those messages using the techniques described in the Postfix Backscatter Howto.

Re:me too

[lanzz]

no, a joe-job is when a competitor sends spam advertising (in the actual message body) your website/product/service/whatever, in hopes to discredit you. what the original poster complains about is simple from-spoofing; i don't believe anybody would block his domain due to its use in spoofed from: headers. my domain has been used this way by spammers in the past, and i haven't noticed anybody blocking my mails.

Your bad...

[Anonymous Coward]

Unfortunately, I give out a different email address to each site I visit: slashdot@example.com, paypal@example.com, amazon@example.com, etc., and the spammer is using a different address for each mail, so simple address filtering doesn't work.

example.com was a bad choice for a domain name; a lot of spammers would probably use this.

Also you're breaking RFC 2606.

Let's just say this was your poor judgment and move on.

Run a web host

[adamstew]

I run a web hosting business...small but large enough that this happens on a regular (read: daily) basis for the people I host.

all of the good and 99% of the bad network admins will know better than to trust a "From" header in an email. I can't think of anyone that will block a domain based on the From header. Most network admins who setup blacklists blacklist server IPs that email comes from, and not email headers.

As for your catch-all address, you can use some of the techniques that others have mentioned in previous comments. I usually tell my customers to just wait it out. The spammers will stop using your domain after a day or two. give it another couple of days for the mail queue's to empty out, and you'll stop getting bounces.

Joe Jobbed

[bmo]

You are being joe-jobbed. Do not worry about it.

http://www.spamfaq.net/terminology.shtml#joe_job

3.2.22 What's a "Joe Job"?
The act of faking a spam so that it appears to be from an innocent third party, in order to damage their reputation and possibly to trick their provider into revoking their Internet access. Named after Joes.com, which was victimized in this way by a spammer some years ago.

You will not wind up on a blacklist. This is a well known phenomenon among mail admins.

--
BMO

Easy

[Anonymous Coward]

This is an easy one ... just send an email to everyone explaining the situation. And I just happen to have some mailing lists of people who opted-in to receive just this kind of notification, which I can provide to you at a very reasonable costs.

DomainKeys and DKIM

[jediknil]

This has happened to me not once but twice, and I really was at a loss at what to do. Well, and angry and annoyed. The second time I decided enough was enough and set up DomainKeys and DKIM (both because DKIM hasn't quite caught on enough yet). Both of them are ways to sign your e-mail so the receiving server can be sure that it actually came from your domain. It's not yet a real solution because not enough people/sites use it or validate against it, but encouraging adoption is always a good thing.

Of course, signing mail isn't really enough to stop it, so you may have to turn off the "catch-all" feature of your mail just to avoid mail bounced to "xycjdfedf@mydomain.com"

Re:me too

[Amiga Lover]

This isn't entirely on topic, but it's related to my experience of having spammers use my domain in the From: field.

Dealing with the hundreds or thousands of bounces was inconvenient, but I noticed one string of bounces was coming from a regular user who had a script set up to bounce about a hundred spammy messages of their own in response to each spam they detected.

I mailed them telling them what a useless idea that was, and all I got back was the same bounce - a hundred messages all with the line "PISS OFF WITH YOUR SPAM AND TAKE IT ELSEWHERE", and my original message quoted.

Figuring it was email from my domain (now blacklisted on their server/client somehow), I emailed from another email account, telling them the same thing, and got the same bounces. Third time I tried, I emailed them without describing my domain anywhere in the email, letting them know their spam bounces weren't going to real spammers, rather to the email addresses of those that the spammer had spoofed.

The string of abuse I got back was essentially two pages of ranting, telling me a spammer couldn't fake a From: address, my domain must have been hacked, calling me an idiot who should be banned from the net. The usual teenager response.

The simple fix? Sending email to their account with my domain listed in the body so it triggered their hundred-message spam bounce, but with the From: field set to the idiot's own email address.

I only had to send one. My next message to them reminding them their From: address could indeed be faked bounced back with a mailbox full message from their ISP. Seems his spam-bounce script had seen my email to him with my domain listed in the body, sent back 100 rude messages all to the From: field address (which was himself), each of which also carried my domain in the text. those hundred emails to himself also each must have triggered his spam bounce script, making 10,000 emails to himself from himself... and so on.

Gave me some amusement to make up for having spammers using my domain :)

Next time, prefix them

[Wordplay]

It's a little late now, but the real problem is how you picked your email aliases. Start them all with the same prefix. Like, if I'm wordplay@foozle.com (I'm not, btw, so don't mail me), I might use wp-paypal@foozle.com, wp-ebay@foozle.com, etc. Then I can filter anything that's not addressed to wordplay or wp-*.

Re:Use Google Apps (Gmail for your own domain)

[Anonymous Coward]

Umm.. Google Apps has POP access for all accounts, including the free stuff.

It is easy if you live in Washington State

[doug]

Apparently if you are in Washington, all you have to do is sue yourself for being a spammer. The judge will chew you out for wasting the court's time, and then drop the charges without even opening the documents. Once the court has vindicated you, you can demonstrate to everyone how non-spammy you are. I don't think you'll even need a lawyer, although you may need some antacid after seeing the US judicial process up close and personal.

If you don't live in Washington, I think you'll need to move there first.

Good luck. Let us know how the trial goes.

- doug

Filtering is your only problem

[trumplestone]

Domain blacklisting probably isn't a problem---Every sane sysadmin these days know that the address in the "From" field of a spam email has nothing to do with the origin of the spam.

You might want to investigate "Sender Policy Framework", which allows you to add a DNS record to your domain specifying who (in terms of IP addresses) is allowed to send emails that claim to come from your domain. You will probably find that it doesn't decrease your spam bounces, however.

The other option that may be feasible depending on your setup is ensuring that all outgoing emails have a Message-ID with some sort of token in it that you can recognise. All incoming bounces that are not replying to a Message-ID with your token in it are spam.

Just some ideas.

Sorry you can be blacklisted

[lunatick]

To all the people saying domains don't get black listed. Sorry you are wrong.

I posted this exact question to slashdot about 4 years ago, back then you were just pretty much screwed.
I was actually recieving threating return mail for sending spam, which is why I posted here.

My domain did end up on a bunch of black lists and is still on a few to this day.

I will say that the better ISP's use a mailserver based black list and not a domain based one, but there are still some out there.

Now what you can do.

Go to the FTC ID theft complaint form

https://rn.ftc.gov/pls/dod/widtpubl$.startup?Z_ORG _CODE=PU03

Yes spoofing your e-mail is a form of ID theft.
The company advertised is just as legally responsible as the spammer.

If you keep fileing complaints the spammers learn not to use your e-mail. The ones in the US and Canada you can actually sue to recover damages.

Good luck