How do you deal with spam when using a catch-all email address?

Question

What strategies do you use to combat spam coming into a catch-all address?

I've noticed that some non-existent addresses seem to get picked up and hit hard by spammers. These, I redirect to an old, unused webmail account (last time I logged in: 86,583 unread emails).

I also use spam assassin to reject obvious spam, but I still get a few a day that make it through.

I've tried moving a domain to google apps, and that seems to work pretty well.

Any other strategies I'm missing?

Solution 1

The whole point with catch-all addresses is that you get everything, but you only need to attend to addresses you are interested in. I do a few things:

1. if I give out an email to anyone, it's site-specific. For instance, superuser would know me as superuser.com@mydomaincom. That way I can figure out who's selling what.
2. All mail that is sent to a known, good address is considered good.
3. All mail that is sent to an unknown, suspicious address (so it's NOT one of twenty addresses I actually get mail from) gets filtered (using Gmail) to a "probably-spam" bin. I check that when I can, and rescue good mail from there.
4. Addresses that are good get added to the no-filter list.

It definitely takes me longer to answer if a new friend writes me at "[email protected]" because it gets marked as suspicious. But that's fine...

Solution 2

I gave up on using a catch-all address. I never actually got anything important in it and it was just a waste of time trying to maintain it.

Solution 3

Simple!

Use the standard DNS, SURBL and Greylisting techniques that you would use on normal email addresses.

I use a catch all on a few domains and I do not get any more spam that I do on a standard single address.

Solution 4

These user names seem to attract spam and have been banned from my catch all address:

• root
• info
• sales
• admin
• microcenter (They apparently sold my rebate address to spammers!)

The first 4 tend to get the same spam within minutes of each other (@^%$ BOTS!). The last is a disposable that has been disposed of due to abuse.

View more solutions

Comments

[zildjohn01]

True, but it's the principle of the thing... :P

[Chris Nava]

I use a catch all address as a disposable address system. For example, when I need to provide an address to sign up for a service I use {service}@mydomain.com which by default is caught and ends up in my catch all box. I can then receive the verification email (and some small number of notifications that I deem acceptable.) I can later disable that one address manually if it becomes a spam bucket.

[Ryan Bolger]

I use a third party site for managing my disposable addresses. Specifically, sneakemail.com.

[fretje]

Ow, I just see that you already use Google Apps (shame on me for not reading the whole question before answering). Well, then I think your problem is already fixed ;-)

[chris]

I've moved one domain over to google apps, but it looks like I'll be moving the rest over soon.