1

Got a question about blacklisting behaviour. Internet MX records for "mydomain.com" point to my anti-spam gateways. The anti-spam gateways then relay the email to my mail server. If someone sends an email to ,say, nosuchperson@mydomain.com the email is first accepted by the anti-spam gateway, but it will then be rejected by the downstream mail server because the recipient does not exist.

Now, my colleague says that he's seen this behaviour result in a mail relay getting blacklisted (he gave AOL as an example). I have not seen this myself, but I'm not sure if its because I've been lucky or if its because he's wrong. Can anybody clarify this?

2

Maybe. This is called backscatter, and some services do take it into account in computing IP reputation, and some blacklists operate exclusively based on backscatter.

2

Your colleague is right. As Michael Hampton said, that behaviour generates backscatter mail, which is seen usually as spam.

Frequently, spammers forge the "mail from" address, and also many times they bruteforce addresses to send to. You will likely get lots of spam of this kind: a forged remitent and a bruteforced non-existent mailbox as destination at your domain. Your system will then generate a NDR to the remitent, but if it exists it isn't the real remitent, so she will get an unsolicited NDR because she didn't really send that spam mail to you. That's how backscatter works, and that's why your configuration might get your server blacklisted.

  • I'm not sure backscatter is applicable here. I'm talking about a valid ,non-forged, sender sending an email to my organization but to an invalid recipient (perhaps there was a typo in the email address). The anti-spam gateway is the first hop because MX records say so. The gateway accepts the email from the sender's mail server and relays it to my mail server. My mail server then rejects it because the recipient address does not exist. Will such behaviour get my gateways or mail server blacklisted? – FuzzyWuzzyBear Sep 11 '14 at 2:21
  • In that case it won't, at least not with good reputation blacklists (there are some out there that are better avoided). But if your server does that with legitimate mail, it will do the same with spam mail with forged senders. Of course, your anti-spam is there to avoid getting such e-mails but I doubt it is 100% effective. Then you could end up being blacklisted. – Migtor Sep 12 '14 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.