To bounce or not to bounce?

That is the question of spam...

[BwanaZulia]

Our server gets pounded daily with thousands of dictionary type spams ([e-mail], [e-mail], [e-mail], etc, none of which exist).

The question is, should we bounce those messages at all or just delete them as obviously the ones that are not bounced are a clear indication that the email address is valid.

Thoughts?

Opinions?

BZ

[PatrickDeese]

I personally blackhole all that stuff because bouncing it causes avalanches of "bounce spam" to innocent site owners who's domain was selected for the forged "sender" headers.

[BwanaZulia]

I guess my concern would be that legitimate bounces (real people, sending real email with real bad addresses) would also get thrown in the black hole.

BZ

[wheel]

I'm speaking out my left ear here so take it for what it's worth. In my server config, we only allow connections from valid userids. If it's not in the list, the connection isn't allowed. That's better than a bounce and better than accepting the emails and blackholing them.

(that's what I understand is happening from what I can see in the server logs).

[BwanaZulia]

Allowing connections is for sending/retrieving emails, but obviously in order to receive emails from the internet it is not based on authenticated users.

We just implemented the SMTP check to make sure any incoming mail was going to a valid mailbox before going through any other process (mail queue, spam assassin, etc). This has really kept the amount of traffic down.

We are bouncing those emails, and that was the original question, now just how to not bounce them.

BZ

[EVOrange]

I had the same problem because i had my email server set with a 'catchall' email, i.e. [e-mail]

I closed the catchall and only accept emails to legitimate emails addresses

EVO

[py9jmas]

We are bouncing those emails, and that was the original question, now just how to not bounce them.

Are you bouncing them? Or just refusing to accept them in the first place? Your server should only generate bounces for messages it has accepted, and is then unable to deliever (mailbox doesn't exist, etc). If it didn't accept the message in the first place (ie refused at the MAIL TO/RCPT FROM stage of the SMTP transaction), the message is the responsibility of the mailserver that tried to give the mail to you. If that server generates a bounce or not is not your problem.

[BwanaZulia]

We are bouncing them based on the "Mailbox does not exist".

They are valid domains, just not valid mailboxes. I would like to configure it to NOT bounce them as it does create a lot of traffic, we are talking thousands a day.

BZ

[py9jmas]

What you should do is configure your server not to accept mail to non-existent mailboxes in the first place.

In the SMTP transaction, the sender server issues a

MAIL FROM: <[e-mail]>

command and a

RCPT TO: <[e-mail]>

command. At this point, your server can check to see if [e-mail] is a local mailbox and if it exists. If it doesn't, it returns the appropriate error message and drops the connection. No bounces are needed on your part, and the message itself is never transmitted so doesn't use your bandwidth.

If your mailserver blindly accepts the TO/FROM addresses, the message is then transmitted, and your server accepts responsibility for it.

How you configure this depends on your mail server.