Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

What additional security issues does an MTA and email client face if a catch-all email address is setup on an sub-domain (that isn't published/publicly listed anywhere) compared with setting up individual email forwarders to the same address (as needed). Stakeholders are administrator of MTA and email user.

share|improve this question
What security risks do you envision? – joeqwerty Sep 25 '12 at 1:24
Spam is probably the main one. – Jay Sep 25 '12 at 1:35
3  
Spam is not really a security risk. – EEAA Sep 25 '12 at 1:38
Let me rephrase a bit using proper risk assessment language: what vulnerabilities does such a configuration cause and what are the risks of those vulnerabilities being exploited? – Jay Sep 25 '12 at 1:42
3  
Then you need to drastically re-work your question. Please edit it to clarify what you're really asking. – EEAA Sep 25 '12 at 1:59
show 2 more comments

closed as not a real question by Michael Hampton, EEAA, John Gardeniers, HopelessN00b, mailq Sep 25 '12 at 21:53

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 2 down vote

Uh, none.

I don't know why you'd want to set up a spam collector, but that's really all a catch-all email address will do. No security risk, so long as you have an anti-spam/email security solution in place and/or the users know better than to open nakedcoedsxxx.zip.exe and the like.

share|improve this answer
One reason to have a catch-all address is to ensure the system doesn't bounce invalid addresses, such as those randomly generated addresses used by spam systems. Whether or not that has a real benefit for reducing spam is very open to argument. – John Gardeniers Sep 25 '12 at 4:47
@JohnGardeniers Yeah, not the method I'd use to suppress bounces to invalid addresses, but that would be a use for a catch-all address. – HopelessN00b Sep 25 '12 at 12:01
As I said, open to argument. Also not the method I would use but certainly one I've seen promoted for that purpose. It is the only way to avoid bounces while strictly adhering to the RFCs, which demand a bounce for invalid addresses. – John Gardeniers Sep 25 '12 at 12:06
The email security solution doesn't make it a higher or lower risk. It only exposes a bigger probability of catching an unsolicited mail. A virus to one address or a catch-all-address in both cases requires a user to just delete it. – mailq Sep 25 '12 at 22:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.