Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my e-mail customers is currently on the receiving end of massive amounts of delivery failure notices as a "Nigerian scammer" seems to be using her address as its MAIL FROM field.

A lot of it is marked as spam by the SpamAssassin running on the inbound server (if they include the original message).

I added a manual content filter which removes more of the stuff.

I also temporarily blacklisted a few of the most active sources of bounce emails as they weren't servers any of my customers were likely to exchange actual e-mail with.

That has reduced the amount of spurious delivery failure notices my customer receives, however she's still getting ~1-2 such notices per minute.

Is there anything more I can do to help her get rid of this?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

The mail your customer is receiving is called backscatter. Simply knowing that people call it that might help your Google searches for potential fixes. Here's a ruleset for SpamAssassin that might help.

share|improve this answer
add comment

The other main thing that can be done to prevent backscatter is to publish SPF records for your customer's domain. The format is detailed at the OpenSPF project's website, but in essence you publish through the DNS a list of servers that are authorized to send mail from your customer's domain, and then make it clear that no others are permitted to do so (-all).

It's up to the recipient to check the SPF records before accepting a spam forged as coming from your customer's domain, but many do, and a hard failure (-all) will cause those recipients to reject the incoming email before it ever gets as far as making a bounce message.

I found that publishing SPF records for my domains immediately cut the backscatter by a big fraction - perhaps 65%? - and it fell much further over time, probably because intelligent spammers will avoid picking fake-sender domains that are going to be instantly rejected by mailservers with clue.

share|improve this answer
    
When I began receiving backscatter, I setup SPF records. Backscatter dropped significantly, and use of the domain for Spma stopped. I also setup an email alias for the problem userid and forced a failure on it. After years the userid still receives occasional spam addressed to it. –  BillThor Apr 8 '11 at 14:29
    
I already have SPF records which only permit email from my outbound gateways and deny the rest - but thanks. –  E.Benoît Apr 10 '11 at 7:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.