1

I have a linux box email server with Postfix as the MTA, Dovecot as the IMAP server and Apache with Roundcube as webmail.

In my /etc/postfix/aliases I have just above a hundred different aliases which makes as many email addresses on my domain. I use one address per website so I easily can shut down spam infested addresses.

During the half a year or so that I have had this setup, I have received 3 spam from 2 sources. As I know exactly where I entered this address, it should be easy to pinpoint email leaking websites and services.

However, these sources are, according to me, not likely email sellers. And for one of them to sell my email twice? I contacted one of the sources and they are adamant that their system is tight. They suggested the possibility that it is my server that is doing the leaking.

So, my question is:

How likely is it that my box is leaking email addresses, and how?
  • I don't store fully qualified email addresses anywhere in my system except in my maildir.
  • I use SSL connection to IMAP
  • I do not use https on webmail

2 Answers 2

2

The only thing I can think of is the SMTP verify command which allows a remote server to check if an email address is valid or not. See http://www.postfix.org/postconf.5.html#disable_vrfy_command.

2
  • I was surprised to find that on my system (a stock, up-to-date Debian install), Postfix was happily replying to the VRFY command, which seems ridiculous. Definitely check this out.
    – Dan Udey
    Apr 28, 2010 at 4:55
  • cr.yp.to/smtp/vrfy.html deems rejecting VRFY as "dangerous" as there are clients that use it. Still, when disabled, the address is verified against local recipients at the RCPT TO command anyway. And bruteforcing email addresses does not seem plausible as most of my addresses include a ten character random string. Apr 28, 2010 at 10:11
2

I've never heard of an MTA "leaking" email addresses, unless the entire server is compromised, in which case they will get all your addresses, not just two alias's.

Personally what I feel is far more likely is:

  1. The spammers just hunted randomly for an email address
  2. The company that knows of these email addresses has made an honest mistake

Of course no company is ever going to admit to leaking your email address, but sometimes these things happen by accident. Maybe they copy/pasted your email address that was in a big block of text onto a web form, or maybe an your email address was in the "cc" section of an email that got forwarded to half of the earths population.

Hell, it could even have been an infected router somewhere in the world that your email happened to pass through and the person who had access to the router was scanning packets for email addresses.

All in all, 3 individual spam really isn't just too bad at all. If only we could ALL have that little spam.

1
  • 1. As stated in another answer, I include a ten character random string, so randomly hitting a valid alias seems unlikely. 2. It would mean that this company which states that their system is tight, have accidentaly published my email address twice. At least this would mean that the wrong is not on my end. I have considered the possibility that someone got the addressed from the internet itself; that somewhere along the way, someone caught my address as I entered it at their website. Twice. Or glimpsed my addresses or password as I login or use my non-SSL webmail. Very local connections. Apr 28, 2010 at 10:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .