Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From
address and envelope sender.
The usual best practices are in place: My provider (apparently) uses Bounce Address Tag Validation, and our Sender Policy Framework record ends with -all
. Thus, the amount of "regular" NDRs was a lot smaller than it could have been.
Still, I received about 1-3 auto-replies per minute: "I'm on vacation...", "Thanks for contacting us...", "You message contained malicious content...", "I'm out of office...", "Mr. X is no longer with the firm...", "Our e-mail address has changed...", "Your message has been received and a support ticket has been generated..." - just to name a few. Obviously from around the globe and in a multitude of different languages. Quite an interesting read, actually, if you don't have anything better to do.
Unfortunately, I do have better things to do, and, fortunately, some of the auto-replies included a copy of the original message, allowing me to determine the spammer's IP address and get him (or the poor guy whose server he hacked) shut down by his hosting provider.
Still, I was wondering: 1-3 unsolicited mails per minute I can handle next to my "regular" work, but if the spammer had used more hosts (or even a bot network), my mail account would have effectively been DDOS'ed into uselessness.
Is there anything one can do to defend against this kind of "backscatter auto-reply attack"?