E-mail issues

[SGirl]

I'm having a Problem.

Someone is using my domain for sending out crap. The return e-mails along the lines of "user not recognised" are driving me round the bend. So I checked the mails, and it seems they all use randomly generated strings of characters for the username.

Well! Not a problem, thought I, and promptly disabled the catchall.

But here's my real Problem. I have 2 users (among others!) defined: sian and admin. Both are defined as separate users and "sian" mails go automatically to the "admin" account. But when I disable the catchall, sian mail sends out a bounce notice, while also delivering the mail to my inbox.

What have I done wrong? How can I fix this? I've re-enabled the catchall for now, but if I go on getting spam bounces in droves, I'll have to disable it again.

Thanks in advance for any help you can offer! But please keep it simple, 'cos I is a computer numpty.

[sneakyneil]

Does the text of the bounce notice give any more information? If it's 'user doesn't exist' or similar despite the fact that it does exist in your control pannel then try deleting and recreating the account after disabling the catchall. Failing that a quick call/email to the provider might be in order. Most providers respond to the first email with a generic and uphelpful reply, but if you persevere they'l probably help you

[SGirl]

Thanks Neil. It didn't work, but thanks for the effort anyway.

I think I need to change a VDS setting, but I can't remember my password for the VDS and for some reason Forgotten password is producing the grand total of 0 e-mails. Jamieeeee! Are you there?

[miniman]

Are you sure it's actually your domain that is sending out the original emails?? I get huge volumes of "returned message undeliverable" spam on all of my domains, including the domains that have no mail running at all. Doesn't solve your specific problem, of course

You could set up a manual redirect from sian to admin and leave the catch-all switched off - so all mail actually sent to sian@ would get routed to admin, and anything else wouldn't.

Edited by miniman on Tuesday 2nd January 19:36

[2 sMoKiN bArReLs]

Yep, I'm getting about 100 a day of returned mails I've never sent. I've told outlook to send 'em straight to deleted items.

[sneakyneil]

SGirl said:

Thanks Neil. It didn't work, but thanks for the effort anyway.

I think I need to change a VDS setting, but I can't remember my password for the VDS and for some reason Forgotten password is producing the grand total of 0 e-mails. Jamieeeee! Are you there?

Oh! didnt realise you were one of Jamie's lucky customers, just call them then I beleive they've very good at sorting things out.

[ThePassenger]

Either your server is running an openproxy and letting all and sundry send mail through it (unlikley). Or... it's people, in effect, forging the return address. Which is very easy to do.

Basically they send out 1000's of e-mails with [e-mail] as the return address, the mail server on the other end goes "I don't know who [e-mail] is" and throws the mail back at the return address, with a "unknown user" error attached.

Problem is, this isn't actually spam. Ok, I admit, being swamped by bounce messages is pretty much the same thing, but it's supposed to be a useful thing to recive (i.e. you're message was rejected due to reason X, you can correct that and resend).

[rant]It actually pses me off when server admins set their machines to supress these replies. E-mail just vanishes in to the ether, did they get it? You don't know, so you end up phoning them up to make sure the message arrived. So what was the point of sending the damn e-mail, you might as well phone and fax them [/rant]

[JamieBeeston]

ThePassenger said:

Either your server is running an openproxy and letting all and sundry send mail through it (unlikley). Or... it's people, in effect, forging the return address. Which is very easy to do.

This'll be it.. People simply using SGirls domain as a 'reply to' address just to deflect all the abuse reports from the real open relay / compromised machine..

It's akin to burgling someone, and leaving a card implicating someone completely random!

a royal PITA and nothing you can do to stop them, the best option is simply to junk them all ;(

I note you've been in touch with support and all seems in order, but do let me know if you have any more queries.

J

[SGirl]

miniman said:

Are you sure it's actually your domain that is sending out the original emails?? I get huge volumes of "returned message undeliverable" spam on all of my domains, including the domains that have no mail running at all. Doesn't solve your specific problem, of course

You could set up a manual redirect from sian to admin and leave the catch-all switched off - so all mail actually sent to sian@ would get routed to admin, and anything else wouldn't.

Thanks Miniman, I feel better knowing someone else is suffering too.

To be honest, I've never had this problem before - I'm pretty sure it's just someone using the domain name rather than an open relay at Register1. PITA though. The manual redirect was what I was doing when my mails were apparently bouncing but being received. I think I know why, but I don't really want to disable the catchall because I use it for generating "new" account names if I have to register with websites - I can catch them then if they start to spam me.

[SGirl]

ThePassenger said:

Either your server is running an openproxy and letting all and sundry send mail through it (unlikley). Or... it's people, in effect, forging the return address. Which is very easy to do.

Yep, that'll be it. I don't understand why people send out so much spam anyway. Can't we just take off and nuke them from orbit or something?

[SGirl]

JamieBeeston said:

[
a royal PITA and nothing you can do to stop them, the best option is simply to junk them all ;(

I note you've been in touch with support and all seems in order, but do let me know if you have any more queries.

J

Cheers Jamie, that's just what I wanted to know! Yep, support were good yesterday - turns out the forgotten password notices were heading for the account that I used when I registered with you, rather than the account I used now. I actually junked the old e-mail account when the company I registered the domain with wanted £85 (!!) to renew for a year. You can see why I junked it, I suppose.

Is there any way of training SpamAssassin to recognise returned e-mails? Thunderbird is doing a reasonable job of mopping them all up, but if I could just route them directly to my Spam folder before I download them all, that would be ideal.

[anniesdad]

SGirl said:

miniman said:

Are you sure it's actually your domain that is sending out the original emails?? I get huge volumes of "returned message undeliverable" spam on all of my domains, including the domains that have no mail running at all. Doesn't solve your specific problem, of course

You could set up a manual redirect from sian to admin and leave the catch-all switched off - so all mail actually sent to sian@ would get routed to admin, and anything else wouldn't.

Thanks Miniman, I feel better knowing someone else is suffering too.

To be honest, I've never had this problem before - I'm pretty sure it's just someone using the domain name rather than an open relay at Register1. PITA though. The manual redirect was what I was doing when my mails were apparently bouncing but being received. I think I know why, but I don't really want to disable the catchall because I use it for generating "new" account names if I have to register with websites - I can catch them then if they start to spam me.

Problems here too.......strangely they only started on my return to work on the 2nd Jan.

I've emailed UKBob who hosts our domain for advice but IIRC their office is closed at present.

[SGirl]

anniesdad said:

Problems here too.......strangely they only started on my return to work on the 2nd Jan.

I've emailed UKBob who hosts our domain for advice but IIRC their office is closed at present.

Funny you should say that. Same here. Maybe even idiot spammers need their Christmas break. But I thought the Russians didn't celebrate until the first week of January?

I started to get the things over the break, though. Just a few a day, 5 or 6, maybe. It's only since yesterday that there's been a big increase in them.

[ThePassenger]

SGirl said:

ThePassenger said:

Either your server is running an openproxy and letting all and sundry send mail through it (unlikley). Or... it's people, in effect, forging the return address. Which is very easy to do.

Yep, that'll be it. I don't understand why people send out so much spam anyway. Can't we just take off and nuke them from orbit or something?

Serious answer: Profit margins.
It costs nothing to blast them out by the thousands, if 1 or 2 people buy the product... profit.

[SGirl]

ThePassenger said:

Serious answer: Profit margins.
It costs nothing to blast them out by the thousands, if 1 or 2 people buy the product... profit.

Really? People are dim enough to actually read these things and buy the crap they're selling?

I'm amazed. I never knew that.

[meeja]

[redacted]

[JamieBeeston]

SGirl said:

Is there any way of training SpamAssassin to recognise returned e-mails? Thunderbird is doing a reasonable job of mopping them all up, but if I could just route them directly to my Spam folder before I download them all, that would be ideal.

If you log in to your VDS, then click 'users' in the left menu, then click on any additional users you have added, you will be logged in as them and can edit their individual spam assassin settings (tag / delete / syntax to block) you could then just add some of the more common bounce message syntax, but this means any legitimate bounces you get will likely be unreported to yourself!

If this is just for your admin account, then the spam assassin prefs file is located in /home/admin/.spamassassin/user_prefs iirc, you can download / edit with file manager and tweak.

J

[ThePassenger]

meeja said:

SGirl said:

ThePassenger said:

Serious answer: Profit margins.
It costs nothing to blast them out by the thousands, if 1 or 2 people buy the product... profit.

Really? People are dim enough to actually read these things and buy the crap they're selling?

I'm amazed. I never knew that.

Co-incidentally, a scan of the firewall logs in the office this morning showed some URLs that it had blocked. One of them was a site selling Viagra and the like, and looking at the attempts made from the same machine/user, I would suggest that the user had clicked on a link in a spam email.

So yes.... I suspect people do actually buy from spammers!

From the various interviews with spammers it seems to run at 1% - 2% per batch. The really lucky ones often get a 3% return, which is just utter utter gravy.