what's the point?

don't understand what the spammer is trying to accomplish

[LifeinAsia]

Every day our server gets probably a few dozen spam e-mails of the form:
From: [e-mail]
To: [e-mail]

It's always the same InvalidUserName and it's not even remotely close to what might be a common username (like john or dave or even webmaster).

It's not going to be a valid user, so the e-mail will never be received and read by someone. I can understand the trick of using a valid From username, so that a real person gets the bounced message and opens it up to see why it bounced. But I just don't get the point in this situation.

Am I missing something obvious?

[lammert]

A number of site owners use a catch-all email setup. In that situation all emails for example.com are accepted, independent of the username part of the email address.

[kaled]

Someone may have used your domain name as part of a made-up email address when signing up to a service - that's certainly happened to me (I know because I contacted one site owner and got some of it stopped). That's why many services require the email address to be validated.

Kaled.

[piatkow]

Once a domain name gets into the wild it seems normal to get spam at [e-mail]

Until I ditched the account that had an automatic catch all I didn't know what was worse. The spam in the inbox or the bounces where the spammers had spoofed randomname@mydomain on the outbound messages (and no the originals weren't coming from my PC)

[LifeinAsia]

lammert- So true. We get hundreds of random [e-mail] attempts every day.

kaled- True, but I don't know of any that would use the user's own e-mail address as the from address.

piatkow- I know that also. But it's the SAME [e-mail] over and over.

[Hoople]

One trick done with a particular windows based email server is to create an empty distribution list. Add the spammed address to the list's email attribute (not as members in the list).

Instant black hole!

[lammert]

Black holes are part of the problem, not the solution. By adding a black hole to your mail server (or any post-reception spam filter), the spammer will conclude that the delivery completed successfully and will therefore continue to spam that email address. The only possible solution is to send a 5xx type error response when the spammer attempts delivery and reject the message. This can be accomplished by using a list of existing email addresses, rather than a catch-all configuration.

[piatkow]

The only possible solution is to send a 5xx type error response when the spammer attempts delivery and reject the message.

And the bounce goes back to the spoofed "from" address while the spammer carries on spamming.

[kaled]

The whole email system is flawed by virtue of being 100% push. I've said it before but...

The only sensible way to ensure email can be authenticated is to push an "I'm here" message to the recipient who can then download the full message from the originating server. Would this stop spam entirely? Probably not, but address spoofing would be impossible and spam detection would be trivial. Email clients would have to work differently behind the scenes but there needn't be much difference as far as the user is concerned. Services like Hotmail could continue without users being able to see any difference whatsoever.

Kaled.

[lammert]

And the bounce goes back to the spoofed "from" address while the spammer carries on spamming.

No. A 5xx error response is not a bounce. It is sent directly to the sending SMTP server after the headers are received but before the message content is uploaded to the receiving mailserver. A 5xx error message goes straight to the spammer, not to the spoofed email address.

[jedz]

I feel for you mate.

We also experienced the same thing. We are receiving spam emails everyday and it's so annoying. We emailed the person handling our server email to fix this problem.