Hacker News Reader

Comment by jey | Hacker News Reader

Use a whole domain name, e.g. signup for dropbox with dropbox@tokenadult.com. You could do this with Google Apps Gmail by setting a catch-all forwarding address for the domain.

View on HN

It's all fun and games until you get attacked by a spambot that tries blindly sending thousands of messages to <common_user_names>@yourdomain.com

I have a setup like that, I get more spam because of that of course but Google is really good at filtering it. And especially in conjunction with priority inbox, it's a breeze (and very convenient).

Yup. I used to do this with a personal domain. After a while I realized that the spam folder was filling up faster than I could manually empty it!

I use a sub-domain (e.g. @m.mydomain.com) for my catch-all and this hasn't happened to me. There are various easy ways for spammers to find out about domains, but sub-domains can remain relatively obscure.

Hey, that's sharp.

Oh that's a nice trick, I might give that a go - thanks!

Or worse, using <randomchars>@somesubdomain.example.com as the SENDER address on spam to others. I once had spammers find a subdomain that accepted wildcard emails, and the backscatter was just insane. Had to spend a whole day trying to make a list of valid <usernames>@ on that subdomain to whitelist to put an end to it. (Not easy if you haven't already been keeping track of which addresses you've handed out throughout the years)

Wouldn't it be better to setup a new nickname/alias for your account? A bit tedious but then you wouldn't be getting every single xxxxx@example.com

Yeah, I've got postfix setup so I just need to add a line to a textfile with "servicename.somerandomchars[1]@mydomain" and it's starting to route to my inbox.

When an address is "compromised" and starts to receive spam, I move the line to a "banned_recipients" file with an SMTP reject header listing the new email. That way, a human using an old address would get a bounce back with the new email.

[1] so that the argument about bruteforcing "common-service@domainname" can be avoided

That's a nice technique; thanks for sharing it. This kind of flexibility is one of the many benefits of running your own mail server (I'm always happy to see that at least some people here are still doing that).

If you run postfix you can have that even easier; look for smtpd_recipient_restrictions and check_recipient_access in 'man 5 postconf'.

I'm running with this rule in the access map:

   /^from-.*@foobar.com$/ OK

That accepts all mail to an address prefixed with "from-" and (by default) rejects everything else. This way you can just make up the dummy-addresses on the fly.

I remember being slightly worried about using such a simple prefix when setting it up initially. However I have never received mail to a from-* address that I didn't "create". Not once in over 6 years.

And disabling an address that has turned spammy is as easy as:

   /^from-stuffit-expander@foobar.com$/ 554 No thanks.

Reply on news.ycombinator.com