Hacker News Reader

Comment by jsmthrowaway | Hacker News Reader

> If you're worried about spam, build in a bounce-back

This is really bad advice. Always disable spam filtering outright on abuse@ and postmaster@, never filter them, never bounce anything. Read every one. I'm not saying hook those mailboxes up to automatically make a JIRA case on each inbound -- there is screening to be done. However, the idea of abuse@ is that spam is often forwarded directly to it if it's originating from you; if you are catching spam to abuse@ or postmaster@, well, do the math.

abuse@, postmaster@, security@ and friends are discussed in RFC 2142, with a couple "must" directives that are important:

> However, if a given service is offerred [sp], then the associated mailbox name(es) must be supported, resulting in delivery to a recipient

Emphasis mine.

https://www.ietf.org/rfc/rfc2142.txt

View on HN

So much this.

I recently ran a port scan of a subset of the internet on a single port. (To get an estimate how many servers with a certain old protocol version were still running, as I wanted to drop it from a client I was working on)

I previously messaged the contact email given by the AS of every affected subnet.

I got over 4 weeks not a single complaint or request to be excluded.

Then I did the scan, and got tons of complaints – and once I pointed out the email I sent them, most got very quiet, but one continued to complain and tell me I should have tried harder to contact them.

I work for an ISP and mails for abuse@ and friends end up in my mailbox. Occasionally, there's a "legit" one that I need to look into but the majority of them are automatically-generated reports that some IP address in our netblocks port scanned them or something stupid. The first one gets ignored, the second one usually gets a response from me to the effect of "please stop sending us these automated notifications", and the third one gets the sending mail server's IP address added to my local blacklists.

My favorite ones to ignore are from a company who allegedly represents Viacom, Warner Bros., TNT, etc., keeping me up to date on what our customers are torrenting.

> if you are catching spam to abuse@ or postmaster@, well, do the math.

Well... the most recent time I've seen abuse@ mentioned, it was Hetzner looking at fake IPs on DDoS traffic and spamming abuse complaints at the wrong people. https://www.reddit.com/r/discordapp/comments/70dwa6/ip_banne...

Hetzner is a long-running social experiment to frustrate other Internet network administrators trying to hail it on all frequencies, so that sort of thing doesn't surprise me. We should all be better actors on the Internet, as this thread underscores, and it's just too bad you sound like you're wearing a sandwich board when you advocate for it. The incentives don't line up with running a business, much like with IPv6 and BCP38.

It'd be cool if we could throw RADb, PeeringDB, RFC 2142 contacts, WHOIS data, the routing table, courtesy phones, spam blacklists, and all the other tools available to administrators in a blender and come up with a nice, centralized way to instant message the right person with root at another Internet company for any possible scenario from any possible identifiable resource involved in the Internet without having to possess the tribal knowledge you pick up after doing it a while. Such a facility doesn't line up with the decentralized nature of the Internet, which is why I think it hasn't happened yet. How would you talk people into using it, too? There's a critical mass problem. I've always wanted to build exactly that thing, but I fear nobody would use it.

Until that exists, it's important to watch your abuse mailboxes. Only point I'm making. The Internet moves fast.

This is great information! Slightly off topic, but I’m curious about your username. Why have you kept on using a throwaway for all of these years?

Reading all mail to postmaster@ has been utterly impractical for many years.

If you're one person with a vanity domain, maybe. If you're running a business that operates mail, it's mandatory.

abuse@: yes. postmaster@: no.

If people have trouble contacting a business by email, they don't try to use email to fix the problem.

They very sensibly go to the web site and try by phone or Twitter or some other medium that isn't the one that isn't working.

I always try postmaster@ first, when reporting mail problems.

Unfortunately, I'd guess that ~75% of the domains I try to contact about that don't have it. (And only slightly better with abuse@, for that matter.)

And then there are the shops who seem to believe that sending mail from bad addresses and publishing no public email addresses for anything is cool. I'm not fond of this solution, but have started considering them spammers and blocking them entirely. (I don't particularly care about them - if they want to send email to my systems they can put their big-pants on and join the rest of the responsible operators; I just don't like seeing services balkanizing like this.)

postmaster@ exists for many, many more reasons than non-deliverability. Again, multiple RFCs dictate its existence and management. Advice to the contrary demands a better rationale than you're providing, and is ill-advised.

If you operate SMTP and I can't get through to you on postmaster@ ("yo, back off your retries," for example), I'm probably going to blacklist you. I'm not unique in the slightest. The decentralized nature of SMTP demands that I have a hotline to you, the MX operator, without having to navigate a Web site to maybe find you.

Deliverability problems may be caused by misconfigured spam filters. Over-aggressive retries won't be.

So I see no justification there for paying staff to manually filter postmaster@ spam.

Reply on news.ycombinator.com