See you later, spam!

SPAM!

When I first started hosting my own domain five or so years ago, I was happy to discover this really neat thing called a catch-all email account. Basically, I can set up as many static email addresses as I want or need, but any unrouted mail, no matter who it’s addressed to, is redirected into the main catch-all account.

This comes in handy for tracking who I’ve given my email address to (among other obvious reasons). For instance, if I were dealing with a fictional company called Wally’s Widgets, Inc., I might give them the address, [email protected]. That way, if I start getting a lot of junk mail pointed to that address, I know it’s either coming from Wally’s Widgets, or Wally’s Widgets has sold my email address to the evil spammers. Over the years that’s happened with a few of the addresses I’ve given out, and when it does I simply add that address to a server side filter that bounces those emails.

Unfortunately, the spammers have developed new tactics in recent months. Perhaps as early as a year ago, I started getting a low volume of mail addressed to random names at my domain, like [email protected] or [email protected]. I also started seeing strange addresses like [email protected] and [email protected]1. A few months later, really weird ones started coming in, like [email protected] and [email protected]. The stranger they got, the more I realized my blacklist system wasn’t good enough anymore. As of last month, I was getting around a thousand junk emails a day to random addresses like these.

All this madness stopped as of last night, when I switched from using a blacklist system to using a forwarding whitelist. I compiled a hopefully comprehensive list of the 200 or so addresses I’ve given out over the years, created forwarding rules so each of them is redirected to my main account, and nuked the catch-all. As of this morning, I’ve got 72 junk emails in my account, which is a very happy improvement from the thousand I’ve been getting each day.

The main reason I’m blogging about this is to let friends and family know they can no longer make up random addresses to send me email. I’ve very much enjoyed getting mail to [email protected] over the years (that never actually happened, but a few similar ones did), but unfortunately that also must stop as of last night. I’d actually prefer to switch as much of my personal correspondence over to my Gmail account as possible. If you don’t know my Gmail address, feel free to shoot me an email using my contact form and (assuming I know who you are) I’ll be happy to give you my contact info.

Oh, and by the way, as I was searching for a good Spam image for this post, I came across Spam’s official website. It’s hilarious! 


  1. This is actually somewhat clever. It appears that when they get an address they know is legitimate, they are assuming either one of two scenarios: either (1) the address is a last name, and adding random letters of the alphabet to the front of it might allow them to stumble across other legitimate addresses, or (2) the address is a first letter and last name, and dropping the first letter or changing it to a different letter may help them stumble across more legitimate addresses. I’m confident this is what they’re doing, because I’ve had mail come to almost every address from [email protected] down to [email protected]
  • Hugh

    Great idea!

  • Tom

    Did you ever try activating SpamAssassin? It’s one of the most effective spam filters out there and it’s already installed on the server. You just have to enable and configure it via cPanel.

  • Joey

    I’ve never used SpamAssassin. I’ve known it was on the server the whole time but I guess I always assumed it would throw the mail away before I saw it, and I like to skim through my junk mail before it’s deleted just in case something bad goes in there.

    Now that I’ve looked into exactly how SpamAssassin works, I’ve gone ahead and enabled it. I have it configured so it adds a junk-identifying header and passes the mail through, and I’ve configured Thunderbird to trust the header added by SpamAssassin. I can still skim through my junk folder for my own peace of mind, but now hopefully this will notch up the accuracy of my whole filtering scheme. Thanks for the suggestion, Tom.

    As an aside, I nuked my catch-all not because I felt my current spam filtering wasn’t meeting expectations—on the contrary, Thunderbird’s bayesian filter is very accurate—but more so to cut off the sheer volume of junk I was receiving.