Email Fun: Catch-alls, Joe Jobs, SPF and Spam

I no longer have a catch-all email address. For years the email (qmail) server that I run was set up to receive anything @eecue.com. So if you sent an email to asdflakhjflakjsf@eecue.com or daveisameanperson@eecue.com I would receive it. This was helpful as it allowed me to create addresses for every site that I submitted my information to, such as target@eecue.com, amazon@eecue.com, etc. That way if those companies sold my address to a list I would know they were responsible for the spam.

This seemed like a good idea until I started getting dictionary Joe Jobbed a few years ago. A Joe Job is when someone sends emails from your account to discredit you. In my case it was just a spam bot sending spams from random addresses @eecue.com. I don't think it was an attack on me, I just have a short domain name that has a catch-all address.

The joe-jobbing caused me to receive thousands of bounce messages. Today I finally decided to turn off the catch-all functionality in my email server. First I dug through my archived mail to find any important addresses that I still needed to receive mail at. I added aliases for the ones that would be hard to change. Any address that was easy to change I just logged into the site it corresponded to and changed it to my main address.

After getting rid of the catch-alls I set up a Sender Policy Framework (SPF) record on my DNS server. SPF is a record on a name server that tells mail servers which IP addresses are allowed to send email for that domain. Luckily I only ever send email from my personal mail server so that was easy to fix.

These changes should greatly reduce the amount of spam and joe-job bounces I receive.