Spam bounces and SPF records

A common question asked by small organisations is whether there is anything that can be done to stop their domain name being "stolen" or forged by spammers.

Unfortunately, there is nothing GreenNet or anyone else can do to stop spammers using whatever "From:" address they choose. Nowadays most spam is actually sent from a network of "zombie" infected Windows PCs all over the world, so there is little value in even blocking the "IP address" that specifies the computer they are sent from. Just in the last few weeks these distributed spamming networks have taken to faking a whole range of email addresses at .org addresses, and this means that all the "backscatter", that is bounces, "out of office" messages, and so on come to you even though you had nothing to do with the original spam.

However, one thing GreenNet can do is to provide a little more information publicly which will allow the receiving servers which produce the backscatter to tell that the original was spam and not from you or your domain. We can also attempt to stop the backscatter
reaching you.

Firstly, do you have a list of valid email addresses at that domain - ones which you have ever advertised or used to reply to email with? If so, we can block email to all other addresses - not only will this stop the backscatter getting to you, it may allow receiving servers to prove
the spam is not from a valid address and discard it.

Secondly, do you know if all valid outgoing email using an address at your domain is sent through our outgoing servers? That is, for each e-mail account that sends from addresses at the domain, in the relevant email program's account settings, is the outgoing server set to 'smtp.greennet.org.uk', 'mail.gn.apc.org' or similar?

Are there any other workers who might be sending through, say, servers associated with a broadband connection? If we had this information, we could set up what is called an "SPF record", which should also discourage spammers from using your address in future, since it is associated with a restricted range of IP numbers corresponding to the mail servers.

If the problem becomes really severe, we can block all bounces to you, although this is not recommended as you would then receive no notification if for example you had genuinely misspelled an email address.

If you are an advanced user, you could also try setting up a filter in your email program on the header 'X-Spam-Status', looking for the phrase 'BACKSCATTER' (this is not possible in Outlook Express, but we can add it to the subject line if you like). This is currently a GreenNet experiment, and conceivably might catch the odd genuine message or genuine bounce as well. For more information on filters, please see
http://www.gn.apc.org/support/filter/