Did you know that if a spammer uses your email address as the FROM: address, which is easy to do, all the bounce messages will go to your email address? If the spammer really hates you, they will send millions of emails with your FROM: address and you will get a million bounce messages.

Can you stop this or prevent this? No

Why would a mail provider send you a bounce message, knowing you’re innocent? Because that’s how someone wrote the protocol back then, and nobody changes it or does it differently because … reasons.

Does the spammer get a bounce message? Nope, not one.

Does the SMTP sending account owner whose credentials were stolen be notified about bounces so they can stop the spam? Nope.

Just millions of emails sent every day to poor schlameels who have no idea why they are getting them and who can’t do anything about them.

The more I learn about the email protocols, the more I realize how terrible the design is.

#emailsecurity #spoofing #cybersecurity #spam

    • Jerry on Mastodon@hear-me.socialOP
      2·
      3 days ago

      @lautreg SPF and DKIM are only used by the destination IMAP or POP3 servers to see what to do when they receive the email. In this case they reject it.

      The delivery failure message is coming from the sending server as a courtesy message to the sender to let them know their email was not delivered. The protocol is to tell the FROM: address that the email could not be delivered. The SMTP, sending server, doesn’t look at SPF, DKIM or DMARC or any DNS records or any other configuration related to it. It simply tells you the millions of emails sent with your FROM: address could not be delivered, one by one.

      People keep bringing up SPF, DKIM, and DMARC, but it’s not relevant to this problem.

      • LautreG@pouet.chapril.org
        2·
        3 days ago

        @Jerry@hear-me.social
        Oh yes.
        I can’t check, but I think there is setting to refuse connexion with the sender server if SPF doesn’t mach.
        Like the policy in the DMARC?

        Or, in spamd/spamassassin, to just drop the incoming email in these case?

        (I’m on phone, I may write more wrongly than usual)