I had this problem. Back when I finally took action I was receiving 500+ bounce notifications a day. If you fully and correctly implement SPF[1], DKIM[2], and

I had this problem. Back when I finally took action I was receiving 500+ bounce notifications a day. If you fully and correctly implement SPF[1], DKIM[2], and DMARC[3], you'll see a massive improvement as much of the SPAM gets dropped completely at recipient MTAs. To fully solve the problem, you need something to filter the backscatter[4] . At the time I purchased Postini, but now that Google has bought them, Google Apps for Work seems to have this feature built in. There may also be software you can run on your own server, or other proxy services like Postini. I've not looked since I use Google Apps for work. Such filters simply track all outgoing messages you send, and reject bounces from addresses and domains you never emailed. This has complete solved my problem. Now I only get regular SPAM, a fact of life now. In practice, all these things together look like this for kogir.com: @ IN TXT "v=spf1 redirect=_spf.google.com" _dmarc IN TXT "v=DMARC1; adkim=r; aspf=r; p=reject; pct=100; rf=afrf; ri=86400; rua=mailto:dmarc@kogir.com; ruf=mailto:dmarc@kogir.com; sp=reject;" mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCFlfDA1Gpz8BQVpcNsiDkSp6ayVCWKlfeYXhiW0CaCgJJJkBpZj9E9OGMGUSAFFgEhCs8wf/fZCx9jsWkH34joEuylNnBnGt8exPSokLwrtubTQajOZcUgbpUlxwyCkyuE41mbpYUfWkPCOaRTa1VqZVWYs+ZdEkYaKXh9UALYeQIDAQAB" The sp=reject in the DMARC record is very important, but only works if all valid email from your domain will pass both the SPF and DKIM checks. [1] http://www.openspf.org/ http://www.openspf.org/ [2] http://www.dkim.org/ http://www.dkim.org/ [3] https://dmarc.org/ https://dmarc.org/ [4] https://en.wikipedia.org/wiki/Backscatter_(email) https://en.wikipedia.org/wiki/Backscatter_(email)