Hacker News Reader

Comment by JoshTriplett | Hacker News Reader

Note, though, that catch-all emails will also catch a ridiculous amount of spam. Creating each account name individually avoids that problem, at the cost of some extra trouble when registering a new service.

An intermediate step that may work if you don't expect people to target you individually: have one or more required substrings for the email local part, and catch all mail to addresses containing that substring.

View on HN

I created my catch-all on a subdomain. While it gives a problem with certain websites (don't consider it a valid e-mail address), I barely receive spam on it.

> While it gives a problem with certain websites (don't consider it a valid e-mail address)

Are you saying that there are sites out there which don't accept mailbox@subdomain.example.com a valid email address? If so, that's beyond broken...

My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

>My school's student addresses ended in @u.northwestern.edu. You can imagine this was annoying sometimes when email addresses ending in .edu were used to verify student status.

Sorry, could you repeat that? yourname@u.northwestern.edu certainly matches \.edu$.

Unless you're worried about the false-positive for a non-student with a different subdomain?

It doesnt match \w\.edu$

And you can imagine how maddening it is when 90% of students worldwide don't have a .edu, but some do.

Only one university in Germany has a .edu, and their students obviously manage to get far more benefits than those of us with an @informatik.uni-kiel.de email.

99% of times we need to send proof that we are students, what is interesting is that many companies accept that even if it's not in English. Probably on good faith.

In Brazil, universities can use .edu.br, but we have few universities providing email addresses to students and also, the majority of grad schools in Brazil are not universities but a small college called 'University Center'

One method that I've seen used (heard it described by a guest one of Leo Laporte's podcasts a looooong time ago) is to iterate account names by year. For example, this year the email address would be pyre2016@example.com, and next year it will be pyre2017@example.com. Not sure how well it works, but the idea is that by that every year you start over with a fresh address (that takes a while to get onto spam lists).

I'll note that I don't use this method as it seems too high maintenance and the effectiveness is unclear.

Not a big deal if using a password manager and email acts as username.

Using it as your mail email for personal/business purposes could run you into trouble though. Most people aren't used to a rotating email address.

I believe the real issue here is its not uncommon for spam services to try to locate valid email addresses. Generally, an email server won't accept email to an invalid users and will probably start flagging the incoming server/domain as those attempts start to cross a threshold of some sort. OP is talking about *@example.com as a catchall which means a spammers script will sit there and email a dictionary of usernames against your domain until it crosses it's own threshold. It's not too hard to add an alias for each name as you go along but it really depends whose list your domain gets on.

I was talking about making those actual accounts vs. aliases to the catchall address. That method makes no sense if each pyre<year>@example.com email address was just an alias to the catchall because pyre<previous_year>@example.com would still be caught by the catch-all, even if you disabled the alias.

> Note, though, that catch-all emails will also catch a ridiculous amount of spam

Hasn't been a problem for me.

> Note, though, that catch-all emails will also catch a ridiculous amount of spam.

I haven't found this to be true, or at least Google's spam filters have gotten sufficiently good to prevent it.

I have a catch-all address @morgante.net and rarely ever see spam—maybe once a week.

I receive all mails @ my domain and I get about 1 spam a day. Fastmail's spam filters are pretty good.

Do you have a good idea of the rate of false positives?

No, I don't check my spam folder. Never had any reason to do so in the last couple of years.

Reply on news.ycombinator.com