Spammers Using my Domain Name?

rconn · 7 May 2005, 01:37 AM

My domain name is only used for email (for now at least) and is hosted at fastmail. I've suddenly started getting tons of automatic emails from postmasters saying messages have been rejected for one reason or another. The sender of the rejected email is always some weird name @ my domain name. I'm not sending any of these emails.

Do spammers just pick domain names to use as the source address of their emails? Will all this cause my domain name to get blacklisted so I can't send my real emails? Is there something I can do to stop this?

Regards,
Roger

kander · 7 May 2005, 05:02 AM

Hi Roger,

You are most probably being hit by what is known as a 'joe job', the addresses are simply forged to show as being sent from your domain. There is little you can do against this kind of thing. On the bright side of things, there don't seem to be any blocklists that look at the domain used as the forged from-address, simply because that information is just about always forged, so it has no value in blocking spam.

You could temporarily set up a rule to discard mail notifications (don't forget to remove it after a few days, though!)

--K

rconn · 17 May 2005, 03:55 AM

Thanks for the info. I didn't get an email when you posted the reply, so I just found this. At least from what you say I don't have to worry about "rconn.com" being blacklisted.

David · 17 May 2005, 04:37 AM

Quote:

Originally posted by kander
Hi Roger,
You could temporarily set up a rule to discard mail notifications (don't forget to remove it after a few days, though!)

--K

kander: Another solution would be to not create a catchall address , And to create only individual alias addresses.

I believe that the "catchall" is not mandatory.

All mail sent to other addresses (at your domain) will then just bounce.

This removes the problem entirely and is the strategy that I use (for my domain email) not hosted at fastmail.

glennproctor · 17 May 2005, 09:39 PM

Quote:

Originally posted by David
kander: Another solution would be to not create a catchall address , And to create only individual alias addresses.

I believe that the "catchall" is not mandatory.

All mail sent to other addresses (at your domain) will then just bounce.

This removes the problem entirely and is the strategy that I use (for my domain email) not hosted at fastmail.

It's also the strategy I use. I was getting thousands of spams per day to madeuprandomname@mydomain.com ; at FM, without a catchall I get about 100 or so, the vast (99%+) majority of which are caught and dumped into my Junk folder.

Glenn.

spruce · 24 May 2005, 08:49 PM

So, without a catchall at fastmail.fm your bandwidth gets pinged for all your spam? Is there any way to bounce spam from your hosted domain (or virtual domain or even virtual subdomain) hosted at fastmail.fm without adding all those email bodies to your bandwidth count?

David · 24 May 2005, 10:19 PM

Quote:

Originally posted by spruce
So, without a catchall at fastmail.fm your bandwidth gets pinged for all your spam?

It is when one has created a "catchall" that one gets dinged for spam bandwidth. Not when one has not, as all mail for the domain is then accepted by fastmails smtp server.

Without a catchall only messages to "defined" addresses are accepted and charged for bandwidth.

spruce · 25 May 2005, 02:09 PM

Quote:

Originally posted by glennproctor
It's also the strategy I use. I was getting thousands of spams per day to madeuprandomname@mydomain.com ; at FM, without a catchall I get about 100 or so, the vast (99%+) majority of which are caught and dumped into my Junk folder.

Glenn.

What catches your spam and dumps it in your Junk folder? Whatever feature this is, does it prevent the vast majority of email dumped into your Junk folder from being added to the bandwidth you used? If not, is there any filtering feature a user can use to reduce the bandwidth the spammers are using? I don't really need to see it in any Junk folder.

For example, if I have determined that all mail to madeuprandomname@mydomain.com is spam, how can I bounce all incoming mail to that compromised address without the spammer adding to my fastmail bandwidth total?

David · 25 May 2005, 02:25 PM

Quote:

Originally posted by spruce
For example, if I have determined that all mail to madeuprandomname@mydomain.com is spam, how can I bounce all incoming mail to that compromised address without the spammer adding to my fastmail bandwidth total?

You can't (unless you delete the catchall) Sure you can bounce all messages sent to that address, but not before Fastmail's smtp server has accepted them. And once that has happened you will be charged for bandwidth.

spruce · 26 May 2005, 03:54 AM

How unfortunate this isn't implemented yet. I was looking into some of the side effects of bouncing emails at http://www.techzoom.net/paper-mailbomb.asp and I was thinking that instead of just deleting the alias (or plus address) the spammer(s) obtained, I could volunteer it for a Teergrube which would instantly alert fastmail that the SMTP server it is communicating with is now rogue and to stop communicating with it with something like all 550 no such user messages. Then fastmail's SMTP wouldn't even ask for the message body. I undertand that Sieve's refuse command may cross this SMTP boundary on the server, so I suggest considering an additional option allowing users to set up Teergrube plus addresses / subdomain aliases to shut out offending SMTP sessions / servers. Can anyone think of negative side effects this scheme might have? A positive effect would be a degree of control of incoming bandwidth for virtual domains hosted at fastmail.

7 May 2005, 01:37 AM	#1
rconn Junior Member Join Date: May 2004 Posts: 10	Spammers Using my Domain Name? My domain name is only used for email (for now at least) and is hosted at fastmail. I've suddenly started getting tons of automatic emails from postmasters saying messages have been rejected for one reason or another. The sender of the rejected email is always some weird name @ my domain name. I'm not sending any of these emails. Do spammers just pick domain names to use as the source address of their emails? Will all this cause my domain name to get blacklisted so I can't send my real emails? Is there something I can do to stop this? Regards, Roger

24 May 2005, 08:49 PM	#6
spruce Member Join Date: Dec 2001 Location: Boston Posts: 38	re: no catchall So, without a catchall at fastmail.fm your bandwidth gets pinged for all your spam? Is there any way to bounce spam from your hosted domain (or virtual domain or even virtual subdomain) hosted at fastmail.fm without adding all those email bodies to your bandwidth count?

7 May 2005, 05:02 AM	#2
kander The "e" in e-mail Join Date: Jan 2002 Location: The Netherlands Posts: 4,112	Hi Roger, You are most probably being hit by what is known as a 'joe job', the addresses are simply forged to show as being sent from your domain. There is little you can do against this kind of thing. On the bright side of things, there don't seem to be any blocklists that look at the domain used as the forged from-address, simply because that information is just about always forged, so it has no value in blocking spam. You could temporarily set up a rule to discard mail notifications (don't forget to remove it after a few days, though!) --K

17 May 2005, 03:55 AM	#3
rconn Junior Member Join Date: May 2004 Posts: 10	Thanks for the info. I didn't get an email when you posted the reply, so I just found this. At least from what you say I don't have to worry about "rconn.com" being blacklisted.

26 May 2005, 03:54 AM	#10
spruce Member Join Date: Dec 2001 Location: Boston Posts: 38	How unfortunate this isn't implemented yet. I was looking into some of the side effects of bouncing emails at http://www.techzoom.net/paper-mailbomb.asp and I was thinking that instead of just deleting the alias (or plus address) the spammer(s) obtained, I could volunteer it for a Teergrube which would instantly alert fastmail that the SMTP server it is communicating with is now rogue and to stop communicating with it with something like all 550 no such user messages. Then fastmail's SMTP wouldn't even ask for the message body. I undertand that Sieve's refuse command may cross this SMTP boundary on the server, so I suggest considering an additional option allowing users to set up Teergrube plus addresses / subdomain aliases to shut out offending SMTP sessions / servers. Can anyone think of negative side effects this scheme might have? A positive effect would be a degree of control of incoming bandwidth for virtual domains hosted at fastmail.