The Bounce Bounced

[robzilla]

I started getting a lot of failure notices in my e-mail today. People send spam to non-existent email addresses of my domains (e.g. [e-mail] - i don't have that one set up), the emails bounce, and then the bounce email bounces because, of course, the spammers don't use a valid return email address.

I wasn't sure why I suddenly started receiving these failure notices, until I remembered I had changed one of my server's hostname yesterday. I had to, because I had it set on a domain that wasn't even on the server anymore - oops - which is probably why i never received these emails before).

Now, shall I reject, on all domains, all e-mail that is sent to non-existent addresses, instead of sending bounce messages, or is there a better way?

[txbakers]

I reject everything that isn't a legitimate address in my domain

[robzilla]

Okay, so now I have all domains set to reject email that is not directed at any existing email addresses. I still get failure notices though. They look a bit like this:

Hi. This is the qmail-send program at plesk.**myserverdomain**.com.
I tried to deliver a bounce message to this address, but the bounce bounced!

<anonymous@plesk.**myserverdomain**.com>:
Sorry, no mailbox here by that name. (#5.1.1)

--- Below this line is the original bounce.

Return-Path: <>
Received: (qmail 11190 invoked for bounce); 13 Apr 2006 21:12:16 -0000
Date: 13 Apr 2006 21:12:16 -0000
From: MAILER-DAEMON@plesk.**myserverdomain**.com
To: anonymous@plesk.**myserverdomain**.com
Subject: failure notice

Hi. This is the qmail-send program at plesk.**myserverdomain**.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<******@***.***>:
***.**.**.* does not like recipient.
Remote host said: 550 5.1.1 unknown or illegal alias: ******@***.***
Giving up on ***.**.**.*.

--- Below this line is a copy of the message.

Return-Path: <anonymous@plesk.**myserverdomain**.com>
Received: (qmail 11187 invoked by uid 10008); 13 Apr 2006 21:12:11 -0000
Date: 13 Apr 2006 21:12:11 -0000
<20060413211211.11186.qmail@plesk.**myserverdomain**.com>
To: ******@***.***
From: ****@****.***
Subject: ****

<ORIGINAL EMAIL TEXT>

So, in this case, an e-mail is sent from my server to an email address that isn't available, so the mailer daemon is trying to send a bounce message to anonymous@plesk.**myserverdomain**.com, but that also bounces. Then that bounce message finally arrives at postmaster@plesk.**myserverdomain**.com, which apparently forwards its messages to the email address that I do use on the domain.

I'm confused.

[jbinbpt]

I am fighting the same problem at the moment. There have been other discussions here about SPF records at your host. If I understand this correctly, NOT having a SPF record allows these messages to be sent. Run a report on your domain at dnsreport.com to see how your server is configured. My host want an additional $5.00 to add the record and I have to configure it for them. Not a lot of money, but I would think that it is in the hosts best interest to do this by default.

[pageoneresults]

Not a lot of money, but I would think that it is in the hosts best interest to do this by default.

What? They actually wanted to charge you money for something they should be doing by default? Yikes! $5.00 is not a whole lot of money but if you take that and multiply it by 3,000 sites, it adds up. :(

It takes about 10 seconds to add the SPF file.

From my perspective, they should be doing this by default. If they don't then email spoofing may become a vulnerability. Not only that, but with recent changes at AOL, Hotmail and larger ISPs, not having an SPF may cause your mail to not reach those recipients.

EOC - Email Optimization Consultant
[webmasterworld.com...]

[robzilla]

I set up SPF records for all my active domains as follows:

v=spf1 a mx include:myisp.com ~all

I'm new to SPF, but I believe this should mean that mail from my server can be sent from (1) all A and MX records currently in my DNS for this domain and (2) from myisp.com (e.g. smtp.myisp.com)? My ISP doesn't allow me to connect to smtp servers other than their own on port 25.

So far no changes in the amount of failure notices received. I'm considering creating one catch-all e-mail address for all domains, and just have everything dumped in there.

[jdMorgan]

You might want to dig around in the e-mail configuration, and see if you can simply 'save' those junk e-mails to /dev/null -- Throw them away, in other words.

Jim