I got a cry for help from a fellow Norwegian whose domain had been used as the forged from addresses in a spam run. Since I’m acquiring more of an interest in e-mail spam these days, for various reasons, I decided to address that scenario.

First of all, if you’re drowning in bounces, chances are you’ve got catch-all set on your domain. You should familiarize yourself with your admin functions, and at least temporarily disable catch all (unless you’re as anally interested in statistics as I am…). I’ll post how to do that with cpanel, and maybe others will help us post howtos for other admin panels?

Disable catch-all e-mail in cpanel:
Locate and click on Default Address
(cpanel comes with lots of different skins, so I can’t tell you exactly where that link is. Usually along with the other mail controls)
Click on Set Default Address
If you want the mail to silently disappear, write in:
:blackhole:
If you want mail to bounce, write in:
:fail:
Click Change.
My skin also tells me I can route the mail to several addresses, which means I can receive the mail AND bounce it. Interesting…
But before you get this far, you should have set up POP3 mailboxes or forwarders for those addresses you actually use. Otherwise ALL mail will be lost. Most will probably have done this a long time ago, but some still only use catch-all.

OK, once you’ve freed yourself from the avalanche of bounce messages, it’s time to think about the damage:

Most domains will probably be misused this way at one time or another. Both of my oldest domains have been misused at least once. I don’t know if the spammers are even interested in how your mailserver is configured. Probably not. The point is deflecting the bounces to someone else, and making the mail seem more legitimate. So they won’t misuse your domain for a long period of time. Which brings me to the next point:

During the spamrun, some mailservers WILL blacklist your domain name. I’ve seen it happen, so I know it happens. Usually large servers that have automated blocking systems, and enough statistical material to actually make use of that. But as you’ll see from the bounces, the IP numbers are usually from all over the globe, and the HELO or message ID is usually faked (well, on the last such spamrun I had a chance to study in detail the message ID was faked, while the latest virus to make the rounds has a faked HELO).

And don’t sneeze at the number of bounces you could suffer from a forged from domain spamrun. If you’ve got catch-all, it could reach many thousand messages. I’ve got a mailbox with the combined mails from two domains misused in such a way (same time period), as well as other mail not addresses to the any existing address. In the course of about 14 days, that mailbox numbers just over 8000 mails! (and the bounces are still coming in).

There’s one thing you can do to distinguish between spammers’ use of the domain, and your legitimate users: Sender Policy Framework. I haven’t tested it out. It would require semi-cluefull users… Any comments from other geeks on SPF?

One last issue: Expect more incoming spam as a result of the spamrun. I see spam addressed to the forged addresses now.

This entry was posted on Saturday, October 1st, 2005 at 10:31 am and is filed under Mail spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.