Backscatter spam: bounce messages abused by spammers
Why a well-behaved mail server can still spam strangers.
- Answers
- What is backscatter spam?
- Topics
- cloud · cyber-security · howto · linux · networking · server
- Full article on willem.com
- https://willem.com/en/2019-09-10_fighting-backscatter-spam-at-server-level/
Summary
Backscatter spam is incorrectly automated bounce messages sent by a mail server, usually as a side effect of incoming spam: spammers forge the sender address, so the bounce delivers their message to an innocent third party.
Full text
Spammers send messages they expect to be bounced, with somebody else's address forged as the sender. When the message bounces, the server dutifully returns it to the falsified sender and effectively delivers spam for them. The simple scenario is solved by never bouncing: respond with an SMTP error code during the connection instead. The hard scenario is forwarding. A user on your server forwards mail to another server whose stricter spam filter blocks the message, and your server then informs the forged original sender that forwarding failed. You do not control that second server, and the delay between accepting and forwarding makes waiting for its verdict impossible. Send enough of this and your server lands on the backscatterer.org blacklist, after which other servers treat your legitimate messages as suspicious.