Comment by MrApathy | Hacker News Reader

Comment by MrApathy | Hacker News Reader

Parent Full thread

I've been a FastMail customer for about four years and overall I'm really pleased with their service. Like you I have my own domain, previously used Gmail, and provide custom email addresses to every site I register with. Interesting to see who has sold my email or may have been hacked when a rogue email ends up in my inbox (hi, Sunspel!).

I have one issue with FastMail that I didn't have with Gmail. Every few days/weeks I'll get a wave of backspatter from someone spoofing my domain to spam. I've researched and it doesn't look like there's anything I can do about this. Most of the backspatter ends up in my spam folder, but not all of it does. I don't know if Gmail automatically removed backspatter -- not even sending it to my spam folder -- or if this only started after I transferred my domain.

By backspatter, do you mean things like message bounce alerts? Or replies from the people who received spam messages spoofed from your address?

Backscatter is (I think) when the target server of a spam mail bounces the email back to me, the rightful owner of the domain, typically because the address is not valid (though I sometimes also get out-of-office messages or mailbox full errors).

It works like this: the spammer forges their headers to make it look like the from address is under my domain. My domain has DKIM/SPF set up, so a good recipient will compare the email to the authentication records, see they don't match, and then trash the email. But there are still a lot of mail servers out there that don't have that set up, so they accept the email as valid, process it, then return it to me when the account doesn't exist on their server. Like I said, annoying, but not a lot I can do other than set up rules to trash messages with a subject of "Undelivered Mail Returned to Sender."

Did you also setup DMARC? I've had good luck with that to reduce the amount of backscatter. Although some recipients don't check it, those that do will fast fail anything coming in that doesn't pass SPF or DKIM.

Reply on news.ycombinator.com