4 ms·

I wonder if most sites maintain any of the following addresses or not for externally incoming mail: hostmaster@<domain> postmaster@<domain> webmast

I wonder if most sites maintain any of the following addresses or not for externally incoming mail: hostmaster@<domain> postmaster@<domain> webmaster@<domain> dns-admin@<domain> info@<domain> contact@<domain> root@<domain> (And if they do, if anyone is actually reading the mail coming to those addresses.) I used to but I got so much spam and 0 actually legit mails to these addresses on my own domains so I stopped accepting externally incoming mails for those names/aliases.

bitbang 4y ago
I will often provide the email address postmaster@hashbang.com for people insisting they need an email address who have no legitimate reason doing so. (hashbang.com resolves to localhost. Thanks twocows...)
- c0wb0yc0d3r 4y ago
  Anyone know why I would get some "random" addresses if I run `nslookup hashbang.com`, but if I run `nslookup hashbang.com.` I get localhost?
- mixmastamyk 4y ago
  Why would this work?
dsl 4y ago
Every email to legal@ has to be read by any legitimate site, thanks to GDPR/CCPA. Not that you'll get a response.
- logifail 4y ago
  Could you give references for this?
- edm0nd 4y ago
  I do not believe that is how the joke laws that are GDPR/CCPA operates.
- urda 4y ago
  Hardly, and especially no to the GDPR. As a US citizen operating my own US site, doing no business with the EU, I do not care nor am I required to comply with EU law that has no bearing on a US citizen like me.
  - legitster 4y ago
    > As a US citizen operating my own US site, doing no business with the EU, I do not care nor am I required to comply with EU law that has no bearing on a US citizen like me. It's actually a bit more complicated than that. Our expensive GDPR lawyers have made it clear there is still some amount of risk. The example was of a German citizen booking American hotels for their vacation. Under the wording of the GDPR law, if their data was breached, the hotel could be held liable under a German court. Now, the realisticness of this actually going to court or there being any meaningful penalty has not really been tested, but it's our corporate policy not to be the first ones to do so. So even for signup forms targeting Americans for American events, legal has asked us to specify to always collect country information (so we know what GDPR rules to process this person under) or include a dumb disclaimer that people from certain countries should not sign up.
- powersnail 4y ago
  How can this possibly be enforced? What if there’s no email service on that domain? What if the business has no email address at all?
aendruk 4y ago
I suspect spammers might have given up on that. I get almost nothing for webmaster at a domain that receives plenty of spam and phishing attacks on other email addresses, and a constant barrage of spam into the web contact form.
- Avamander 4y ago
  Not given up, I'd expect them to avoid those addresses to avoid blocklists and abuse reports.
- davidgerard 4y ago
  I can assure you that they have not.
  - aendruk 4y ago
    What would explain my experience? My first guess is that spammers aren’t proactively probing these anymore, and just hit them if they’re found like any other address.
legitster 4y ago
These types of addresses are actually used by corporate anti-spam software and they are called "honeypots". The idea being you setup a inbox with no public email address and report any IP Addresses sending it emails. There is no legitimate reason someone should be emailing these addresses, so it's an obvious flag that someone is being naughty.
- iamacyborg 4y ago
  There are plenty of legit reasons to be mailing some of those addresses.
  - ithinkso 4y ago
    There were*
    - iamacyborg 4y ago
      No, there are. I still see masses of businesses signing up for b2b products using contact@ or info@ addresses.
      - 2000UltraDeluxe 4y ago
        Indeed. Lots of businesses rely on such email addresses in their day-to-day work.
      - justsomehnguy 4y ago
        As much as I hate it one company I work with has not just a functional info@ adress, but it is the main adress they interact with everyone. Just works.
    - NullPrefix 4y ago
    - thallium205 4y ago
      Don't sites still use these emails to verify domain ownership?
djbusby 4y ago
I still run those names for many domains I operate. Only info@ gets the spam. The others are quiet - but I've actually gotten real emails (in 2022 even) to postmaster and hostmaster.

bitbang 4y ago

I will often provide the email address postmaster@hashbang.com for people insisting they need an email address who have no legitimate reason doing so. (hashbang.com resolves to localhost. Thanks twocows...)

c0wb0yc0d3r 4y ago
Anyone know why I would get some "random" addresses if I run `nslookup hashbang.com`, but if I run `nslookup hashbang.com.` I get localhost?
mixmastamyk 4y ago
Why would this work?

dsl 4y ago

Every email to legal@ has to be read by any legitimate site, thanks to GDPR/CCPA. Not that you'll get a response.

logifail 4y ago
Could you give references for this?
edm0nd 4y ago
I do not believe that is how the joke laws that are GDPR/CCPA operates.
urda 4y ago
Hardly, and especially no to the GDPR. As a US citizen operating my own US site, doing no business with the EU, I do not care nor am I required to comply with EU law that has no bearing on a US citizen like me.
- legitster 4y ago
  > As a US citizen operating my own US site, doing no business with the EU, I do not care nor am I required to comply with EU law that has no bearing on a US citizen like me. It's actually a bit more complicated than that. Our expensive GDPR lawyers have made it clear there is still some amount of risk. The example was of a German citizen booking American hotels for their vacation. Under the wording of the GDPR law, if their data was breached, the hotel could be held liable under a German court. Now, the realisticness of this actually going to court or there being any meaningful penalty has not really been tested, but it's our corporate policy not to be the first ones to do so. So even for signup forms targeting Americans for American events, legal has asked us to specify to always collect country information (so we know what GDPR rules to process this person under) or include a dumb disclaimer that people from certain countries should not sign up.
powersnail 4y ago
How can this possibly be enforced? What if there’s no email service on that domain? What if the business has no email address at all?

aendruk 4y ago

I suspect spammers might have given up on that. I get almost nothing for webmaster at a domain that receives plenty of spam and phishing attacks on other email addresses, and a constant barrage of spam into the web contact form.

Avamander 4y ago
Not given up, I'd expect them to avoid those addresses to avoid blocklists and abuse reports.
davidgerard 4y ago
I can assure you that they have not.
- aendruk 4y ago
  What would explain my experience? My first guess is that spammers aren’t proactively probing these anymore, and just hit them if they’re found like any other address.

legitster 4y ago

These types of addresses are actually used by corporate anti-spam software and they are called "honeypots". The idea being you setup a inbox with no public email address and report any IP Addresses sending it emails. There is no legitimate reason someone should be emailing these addresses, so it's an obvious flag that someone is being naughty.

iamacyborg 4y ago
There are plenty of legit reasons to be mailing some of those addresses.
- ithinkso 4y ago
  There were*
  - iamacyborg 4y ago
    No, there are. I still see masses of businesses signing up for b2b products using contact@ or info@ addresses.
    - 2000UltraDeluxe 4y ago
      Indeed. Lots of businesses rely on such email addresses in their day-to-day work.
    - justsomehnguy 4y ago
      As much as I hate it one company I work with has not just a functional info@ adress, but it is the main adress they interact with everyone. Just works.
  - NullPrefix 4y ago
  - thallium205 4y ago
    Don't sites still use these emails to verify domain ownership?

djbusby 4y ago

I still run those names for many domains I operate. Only info@ gets the spam. The others are quiet - but I've actually gotten real emails (in 2022 even) to postmaster and hostmaster.