4 ms·

IMO, this is a good reason to use a provider that will let you use your own domain. I recommend Fastmail. I've been using them for a while and have been very ha

IMO, this is a good reason to use a provider that will let you use your own domain. I recommend Fastmail. I've been using them for a while and have been very happy with them. The chances of some spammer spoofing you@somerandomdomain.com are much smaller than with username@gmail.com.

derekp7 11y ago
True, unless you have a wildcard user for your domain. Whenever I give out my email, I typically add a unique identifier to the user name, so I can have something like "xyzHN@example.com". Then if I start getting spam, I know who leaked my email address. The problem that happened then is someone was using random users@example.com causing the blowback spam to fill up my mail box. Until I added SPF, then hadn't had an issue since.
- varjag 11y ago
  There is a standard syntax for subaddresses with '+' suffix, e.g. foo+oneoff@bar.com: the replies will end up at foo@bar.com. Wildcards in email domains are a bad idea and been so for many years. https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
  - justinlardinois 11y ago
    The problem with using a standard convention for this sort of thing is that it's easy to detect and subvert (in this case, drop the + character and everything following it from the username). If I sign up for, say, a Sears mailing list with the address sears@justinlardinois.com, it's not possible to divine what my "real" email address is. What are the arguments for this being a bad idea?
    - vhost- 11y ago
      This is exactly what I do. I point everything in google apps to my primary account and then when an email from <service>@mydomain.com gets leaked, I just create an account for it in google apps and send everything to the trash.
      - derekp7 11y ago
        I like to track down where I used the given email from -- you'd be surprised who leaks your email. Was going through my spam folder, found a bunch of virus-laden phishing emails sent to an address I used one time on Equifax's site to get my credit report.
    - varjag 11y ago
      You can just use one subscription address for all unimportant services, thus using e.g. subscription+sears@justinlardinois.com. > What are the arguments for this being a bad idea? It enables spammers and makes you vulnerable to their backscatter, and there is no good way around it.
      - icebraining 11y ago
        You can just use one subscription address for all unimportant services, thus using e.g. subscription+sears@justinlardinois.com. Yes, but if they drop the "+sears" part, you lose the tracking information. What do you mean by wildcard emails enabling spammers? Backscatter is not really a problem, I just filter non-whitelisted addresses to another folder which deletes them after a short while. Known problematic address get filtered to /dev/null. This is really easy to do with Sieve.
notahacker 11y ago
Unless they've got a very specific purpose in mind (like spoofing an email address associated with a particular domain for phishing purposes), don't spammers just spoof a random real email address from the list of harvested email addresses they're sending the mailshot to? I've definitely received generic spam emails purporting to originate from colleagues (whose email addresses would have been published in the same place) and I think I've even received one or two with my email as the spoofed originator...

derekp7 11y ago

True, unless you have a wildcard user for your domain. Whenever I give out my email, I typically add a unique identifier to the user name, so I can have something like "xyzHN@example.com". Then if I start getting spam, I know who leaked my email address. The problem that happened then is someone was using random users@example.com causing the blowback spam to fill up my mail box. Until I added SPF, then hadn't had an issue since.

varjag 11y ago
There is a standard syntax for subaddresses with '+' suffix, e.g. foo+oneoff@bar.com: the replies will end up at foo@bar.com. Wildcards in email domains are a bad idea and been so for many years. https://en.wikipedia.org/wiki/Email_address#Sub-addressing https://en.wikipedia.org/wiki/Email_address#Sub-addressing
- justinlardinois 11y ago
  The problem with using a standard convention for this sort of thing is that it's easy to detect and subvert (in this case, drop the + character and everything following it from the username). If I sign up for, say, a Sears mailing list with the address sears@justinlardinois.com, it's not possible to divine what my "real" email address is. What are the arguments for this being a bad idea?
  - vhost- 11y ago
    This is exactly what I do. I point everything in google apps to my primary account and then when an email from <service>@mydomain.com gets leaked, I just create an account for it in google apps and send everything to the trash.
    - derekp7 11y ago
      I like to track down where I used the given email from -- you'd be surprised who leaks your email. Was going through my spam folder, found a bunch of virus-laden phishing emails sent to an address I used one time on Equifax's site to get my credit report.
  - varjag 11y ago
    You can just use one subscription address for all unimportant services, thus using e.g. subscription+sears@justinlardinois.com. > What are the arguments for this being a bad idea? It enables spammers and makes you vulnerable to their backscatter, and there is no good way around it.
    - icebraining 11y ago
      You can just use one subscription address for all unimportant services, thus using e.g. subscription+sears@justinlardinois.com. Yes, but if they drop the "+sears" part, you lose the tracking information. What do you mean by wildcard emails enabling spammers? Backscatter is not really a problem, I just filter non-whitelisted addresses to another folder which deletes them after a short while. Known problematic address get filtered to /dev/null. This is really easy to do with Sieve.

notahacker 11y ago

Unless they've got a very specific purpose in mind (like spoofing an email address associated with a particular domain for phishing purposes), don't spammers just spoof a random real email address from the list of harvested email addresses they're sending the mailshot to? I've definitely received generic spam emails purporting to originate from colleagues (whose email addresses would have been published in the same place) and I think I've even received one or two with my email as the spoofed originator...