Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure notices which I believe show that my mail system has not been exploited -- it's all hosted by Google Apps and all of the accounts seem to be unaffected. Furthermore, the headers seem to indicate all email is being originated in middle eastern and south asian countries). However, my domain is clearly being abused in a way that I cannot seem to protect against.

I fear that my domain may be placed onto blacklists or other problems.

Is there anything I can do except wait for it to subside? How long does that usually take?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

I can't personally comment on the chance/timing of it subsiding on its own.

Are your servers being loaded down by the extra traffic? If the From address is random, I would think that your servers would drop it.

I think the only concern you have is being blacklisted by spam filters. Is this correct?

Every spam filtering system will have its own methods. I would also point out, that were domain-level blacklists in effect as you describe, major corporations (UPS/USPS/FedEx/DHL, for example), as well as major email services (Gmail/Yahoo), would have already been blocked, because (it stands to reason) that these domains would already have been filled out in the From area of countless spam emails. This is not your problem if your domain is blacklisted, nor is it Gmails problem if their domain is blacklisted by a spam filtering service. It would only be the problem of the spam filtering service that blocks you.

  1. You should: tell the recipients it isn't actually from you, using SPF on your DNS servers to indicate whether the originating IP address (or block) is yours/legit or not (either white-list or black-list methods are supported). However, SPF is not fully respected, because if it was, there would be a large number of false positives due to the mistakes of a significant number of those configuring the SPF rules (things like hard-blocking legit addresses). This (if you avoid those mistakes) will not eliminate the problem on its own, but it may help the spam filters determine what to ignore, or it might help prevent a full fledged blacklisting of your domain.

  2. You might want to make sure you know how to explain the situation clearly. Something like someone writes a random from address in your home town, to address of the recipient, and drops it in the mailbox in New York, or even China. The "return to sender" feature that the post office will provide, is completely ignorant of the Postmark (in this case, IP Address). There's nothing here that is hard to understand.

  3. You could: report abuse to those ISPs who control the IP address blocks that are being used. I don't know if these measures are effective in actually stopping the abusive traffic, especially overseas, across multiple ISPs.

share|improve this answer
    
Thanks. I will look into SPF side of things. I haven't had to explain the situation yet, but it's still pretty early. I was originally concerned that one of my user's accounts might have been compromised, but from what I can see, Google Apps for my domain is reporting nothing out of the ordinary for any user, and this was confirmed by sampling the DNF bounces for originating IPs. So right now, yes, blacklisting is my only concern. –  logicalscope Jun 29 '12 at 17:21
    
I should also mention that I have no servers. It is all hosted by Google Apps in their environment. I have a catch-all address defined which is why I am seeing these failure notices. –  logicalscope Jun 29 '12 at 17:23
    
well what about removing catch-all? That would make this email to work, and about the confirmations you dont need to worry as long you've got the SPF record. Soon, he will be banned, but you rather not, because there is no of your ip numbers in the mail header. –  Andrew Smith Jun 29 '12 at 19:08
add comment

I receive more than 1000 mail every day and this is completely normal and all of them are rejected because there is no catch-all, this is essential not to bloat your mail server and mailbox.

share|improve this answer
1  
Reason for -1 is lack of useful information. –  George Bailey Jul 9 '12 at 21:47
add comment

What you're getting is called backscatter, and it's annoying. Because email need not be authenticated, spammers will send email using a forged return address. When the spam delivery fails, the recipient will sometimes send a falure report back to the forged return address. The (real) recipient of that failure notification message can get understandably very angry about this, since he was never actually involved in this mess to begin with until the hapless spam recipient sent the failure notice to an innocent bystander.

The solution is for everybody to quit sending these failure notifications unless you can conclusively prove that it's going to someone who actually sent you the message you're notifying about.

If you're part or the problem then for the sake of everyone's sanity, quit it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.