3 ms·

A catchall on my domain was all fun and games till the second dictionary spam run.

jawns 9y ago
The way I get around that is by having a static keyword that must also appear on the user side of the email address. So, if I'm dealing with Walmart, I would give them: [keyword].walmart@example.com or walmart.[keyword]@example.com Then I configure my catch-all settings to reject any email addresses that don't have that keyword. Of course, the keyword is not secret, so it's possible for someone to infer what I'm doing and construct an email address that passes my spam check, but in practice, nobody goes through the trouble, because I'm not a big enough target.
- wiredfool 9y ago
  Yeah, I wound up using name-tag@domain, but because I used a dash rather than plus, I'm forever doomed to run my own mailserver. (fwiw, this domain is almost 20 years old, so that's forever in internet years)
  - lorenzhs 9y ago
    I use my domain with FastMail, they support aliases and catch-all and lots of other nice things on custom domains. They also do DKIM, SPF, etc. So you don't have to run your own mail server if you don't want to ;) https://www.fastmail.com/help/receive/domains.html https://www.fastmail.com/help/receive/domains.html https://www.fastmail.com/help/receive/domains-setup-mxonly.html https://www.fastmail.com/help/receive/domains-setup-mxonly.h... https://www.fastmail.com/help/receive/alias-catchall.html https://www.fastmail.com/help/receive/alias-catchall.html https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/domains-advanced.html https://www.fastmail.com/help/receive/domains-advanced.html
    - wiredfool 9y ago
      Fastmail uses a +, I use a -. So, either I'd have to go in and alias all of them, or give up on the useful ones. Besides, there are 30 or so that I have black holes, from back when comment systems leaked email addresses.
- pavel_lishin 9y ago
  Sounds vaguely like the way email addresses work in Ender's Game - typically, all mail would go to user%SECRET@server, and if you don't know SECRET, the email presumably bounces.
Xylakant 9y ago
I haven't had any issues with that and I've been using a catch all setup for about 7-10 years. Most spam arrives on the actual primary email address.
- wiredfool 9y ago
  This was a while back, and I'm guessing that now there are enough gigantic lists of verified emails that the technique lost it's minimal rate of return. It was a massive headache at the time tho.
dspillett 9y ago
I've heard that being a problem, though I've never had that issue using a sub-domain for the catchall (company@sub.domain.tld). Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.
- lorenzhs 9y ago
  Lots of sites also strip the "sub." part from the domain. I have no idea why they think this is a good idea, but a friend of mine does this and he's got at least ten companies in his main domain's alias table because they silently stripped the "sub." part.
- linsomniac 9y ago
  Gmail allows you to do extension addresses like "myname+company@gmail.com", which I've used since switching away from my own mail server where I did the catch-all. Some places are rejecting "+" in the address though. I was trying to give on to Dell and the tech I was talking to told me the system wouldn't accept the address, but that the "+dell" was just an extension "so can I put it in without that?" The combination of them knowing that this was valid and just wanting to strip off the extension kinda blew my mind for some reason.
- medmunds 9y ago
  I can confirm exactly this. I started with a root catchall on my personal .com (~15 years ago), and it was quickly overwhelmed with dictionary spam. Switched to a subdomain catchall, and haven't seen a dictionary run since. Picking a short preposition for the subdomain can even help when you have to communicate the email to a clueless phone rep: "That's right, it's yourcompany@for.myname.com"

The way I get around that is by having a static keyword that must also appear on the user side of the email address. So, if I'm dealing with Walmart, I would give them: [keyword].walmart@example.com or walmart.[keyword]@example.com Then I configure my catch-all settings to reject any email addresses that don't have that keyword. Of course, the keyword is not secret, so it's possible for someone to infer what I'm doing and construct an email address that passes my spam check, but in practice, nobody goes through the trouble, because I'm not a big enough target.

wiredfool 9y ago
Yeah, I wound up using name-tag@domain, but because I used a dash rather than plus, I'm forever doomed to run my own mailserver. (fwiw, this domain is almost 20 years old, so that's forever in internet years)
- lorenzhs 9y ago
  I use my domain with FastMail, they support aliases and catch-all and lots of other nice things on custom domains. They also do DKIM, SPF, etc. So you don't have to run your own mail server if you don't want to ;) https://www.fastmail.com/help/receive/domains.html https://www.fastmail.com/help/receive/domains.html https://www.fastmail.com/help/receive/domains-setup-mxonly.html https://www.fastmail.com/help/receive/domains-setup-mxonly.h... https://www.fastmail.com/help/receive/alias-catchall.html https://www.fastmail.com/help/receive/alias-catchall.html https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/domains-advanced.html https://www.fastmail.com/help/receive/domains-advanced.html
  - wiredfool 9y ago
    Fastmail uses a +, I use a -. So, either I'd have to go in and alias all of them, or give up on the useful ones. Besides, there are 30 or so that I have black holes, from back when comment systems leaked email addresses.
pavel_lishin 9y ago
Sounds vaguely like the way email addresses work in Ender's Game - typically, all mail would go to user%SECRET@server, and if you don't know SECRET, the email presumably bounces.

Xylakant 9y ago

I haven't had any issues with that and I've been using a catch all setup for about 7-10 years. Most spam arrives on the actual primary email address.

wiredfool 9y ago
This was a while back, and I'm guessing that now there are enough gigantic lists of verified emails that the technique lost it's minimal rate of return. It was a massive headache at the time tho.

dspillett 9y ago

I've heard that being a problem, though I've never had that issue using a sub-domain for the catchall (company@sub.domain.tld). Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.

lorenzhs 9y ago
Lots of sites also strip the "sub." part from the domain. I have no idea why they think this is a good idea, but a friend of mine does this and he's got at least ten companies in his main domain's alias table because they silently stripped the "sub." part.
linsomniac 9y ago
Gmail allows you to do extension addresses like "myname+company@gmail.com", which I've used since switching away from my own mail server where I did the catch-all. Some places are rejecting "+" in the address though. I was trying to give on to Dell and the tech I was talking to told me the system wouldn't accept the address, but that the "+dell" was just an extension "so can I put it in without that?" The combination of them knowing that this was valid and just wanting to strip off the extension kinda blew my mind for some reason.
medmunds 9y ago
I can confirm exactly this. I started with a root catchall on my personal .com (~15 years ago), and it was quickly overwhelmed with dictionary spam. Switched to a subdomain catchall, and haven't seen a dictionary run since. Picking a short preposition for the subdomain can even help when you have to communicate the email to a clueless phone rep: "That's right, it's yourcompany@for.myname.com"