Lots of bounced emails!

[mystic]

For the last day or so I have been getting lots of bounced 'undelivered' email on one of my inboxes which were not sent from it. Most likely these are email with a forged 'From'.

Just wanted to check if anyone else has been any recent spike in such emails. I usually get one or two a week but last day Postini caught at least 50 and around 20 were delivered to my inbox!

[AndrewT]

Those would in fact be due to a spammer spoofing your address as the FROM address in their spam.

If you would like, we can setup a filter for you which will automatically discard all bounce messages sent to a particular e-mail address or domain. Just note that this will catch legitimate bounces that you might receive as well. This can be setup temporarily for a few days until this traffic goes away. Submit a ticket if you would like this done.

[mystic]

Thanks for the reply Andrew. If it gets worse, I'll bother you guys. For now it is ok.

[schors]

Having the same problem since around the February. The "Returned Mail: Message Could Not Be Delivered" and similar messages usually come in waves: 100-300 messages in several hours then just regular spam for couple of days, then another wave starts.

Also, several months ago the e-mails I sent to rambler.ru (free Russian e-mail service) were not reaching the addressee. When I asked their support for help, this is what I got from them:

Djudging from our logs, the mail server of the sender at cpanelxx.gzo.com [75.126.x.x] does not follow the SMTP specification - in particular, it incorrectly processes 4yz errors. We have turned off some elements of the spam protection for the 75.126.x.x IP-address, so soon the letters from the server will be delivered.

I am not sure that two problems are/were interconnected, but just in case...

[schors]

P.S. Right at this moment I am being hit by another wave of bounced notifications.

[AndrewT]

Unfortunately backscatter has been globally increasing over the past few months.

I doubt your two problems are related at all but it is hard to say without further information from that mail provider. If you ever experience problems like that again you need to submit a ticket.

[schors]

I doubt your two problems are related at all but it is hard to say without further information from that mail provider.

Since they now allow my messages to get to the destination it does not bother me now. If that may be useful I can forward their e-mail (I will have to translate it, because their response was in Russian). The "4yz" error-code is exactly what they had in their e-mail. Probably it was just a template and they forgot to add the real error-code.

Unfortunately backscatter has been globally increasing over the past few months.

This is the most important part. If that's a global trend, then at least I personally don't have much to worry about

Thanks for the information!

[ZYV]

I am being hit by a massive wave of delivery notification messages for the past few days. Apparently those &$%! spammers started using my e-mail address as From: string. Too bad I can't do anything about it, but I foresee that I will start experiencing problems with undelivered e-mails It's stupid, that whole spam thing is so pointless...

On the other side, it's fun to watch the self-destruction of humanity.

[AndrewT]

The vast majority of the backscatter has to do with the way in which the mail server is bouncing the message. These are supposed to be returned to the sending server during the SMTP transaction. Not after the fact to the FROM address. Further complicating things is that many of these servers will also remove the message body from the bounce so there won't really be anything there to catch as spam.

I noted this above but just in case it was missed:

If you would like, we can setup a filter for you which will automatically discard all bounce messages sent to a particular e-mail address or domain. Just note that this will catch legitimate bounces that you might receive as well. This can be setup temporarily for a few days until this traffic goes away or you can leave it active permanently. Submit a ticket if you would like this done.

[ph23man]

This happened to me last month. All of a sudden I got flooded with about 180 bounces. It kept trickling in at about 10-15 a day for a couple days afterwards, but after that it stopped. I still a few periodically but it's not a big deal. At first I thought a form on my site was compromised and being used to spam but it turns out my email address was being used in the From: headers.

My main concern is also whether my email address will get blacklisted, causing my legitimate emails to get blocked or filtered. But I suppose there's nothing we can really do when spammers spoof our addresses .