Community Email Lists: experience reducing Spam, Barron Park (Neighborhood) Association

Index

• Obscuring the Addresses of Your Lists
• Blocking Spam Messages that Find Your Lists
• Reactions from List Members
• Other Resources
• bottom of page

Obscuring the Addresses of Your Lists

• Generating all possible addresses at major ISPs and send messages to all of them. It doesn't matter to the Spammer that many of them will bounce (not reach a real person).
• Some sites have mailers that provide "completion" on any incomplete addresses received. For example, if a message addressed to "a" is received and there is no user with name "a", the mailer sends a copy of the message to all users whose name begins with "a". In the early days of the Internet, those sites regarded this as "helpful" for senders who did not get the name exactly, for example, sending mail to "john" instead of "johnsmith"
• Havest email address from Web pages and other online sources.

Techniques:

• Do not use mailto tags and write address in a way that people can read but that are not easily recognizable to programs. Example: instead of having address jsmith@NoISP.com, use, user jsmith at host NoISP.com.
  I recommend against this because I tried this and got myriad complaints that people didn't understand what a user was and how to create an email address from that info (yes, this was boggling to me).
• Use alternate encodings of characters. These alternate encodings are handled by browsers, but experience indicates that many Spammers don't bother with doing these translations. For example, you can encode jsmith@NoISP.com as %6A%73%6D%69%74%68%40%4E%6F%49%53%50%2E%63%6F%6D. There are multiple encoders on the web. The one I use is http://www.robertgraham.com/tools/mailtoencoder.html (because I know the author by reputation). (Locally cached copy).
  Beware: Some advertised encoders are reputed to be provided by Spammers as ways to collect email addresses.

  At the simplest level, you can replace just the "@" characters with "@" (decimal encoding) or "%40" (hex encoding).

• Break up the address string by inserting a comment in the middle of the string, especially a multiline comment. For example, jsmith@NoISP.com could become

  	jsmith<!-- this is a comment to obscure the address from robots
  	this is line 2 of the comment
  	and line 3 -->&#64;NoISP.com
  	

  However, this cannot be used inside the mailto, only the text label.
• For contact addresses on each page, use the non-standard SUBJECT addition in the mailto URI. This element has been supported in Netscape since 2.x but in Microsoft Internet Explorer only since version 5.0. Use the absence of the subject field as a coarse identification of potential Spamming of that address. For example, <a href="mailto:jsmith@NoISP.com?SUBJECT=MyWeb:">...</a>

    <a href="mailto:%6A%73%6D%69%74%68%40%4E%6F%49%53%50%2E%63%6F%6D?SUBJECT=MyWeb:">
    jsmith<!--clutter to obscure from robots
    more clutter
    -->&#64;NoISP.com</a>
    

A variant is to give the SPAMmer's robot an address that throws away all mail it receives:

    <a href="mailto:%6A%73%6D%69%74%68%40%4E%6F%49%53%50%2E%63%6F%6D?SUBJECT=MyWeb:">
    jsmith.no<!--clutter to obscure from robots
    more clutter
    -->spam@NoISP.com</a>
    

To see how your browser handles the above form, here it is: <a href="mailto:%6A%73%6D%69%74%68%40%4E%6F%49%53%50%2E%63%6F%6D?SUBJECT=MyWeb:"> jsmith.nospam@NoISP.com After seeing the window produced, dismiss (exit) it without sending the message.

Blocking Spam Messages that Find Your Lists

• There are various resources on the Internet that your mailer daemon can consult on a message-by-message basis. The documentation of your mailer daemon will give you a starting point. See also:
  • Fight Spam on the Internet!
    Blocking mailed spam
  • Netizens Against Gratuitious Spamming (Fight Junk Email)
  • Filtering Spam Mail
  • UXN Spam Combat
  • Join the Fight Against Spam!
  • Filtering Spam Mail
  • Anti-Spam Configuration Control (for sendmail)
• If you block mail from sites on the Open Relay lists or on lists of sites that have failed to respond to SPAMmers using their computers, be aware that some of the popular ISPs are on those lists, a significant faction of your group may be blocked because some of the popular ISPs are on the list because they have persistently failed to fix this problem.

  In conventional UNIX sendmail setups, you can cause these filters to be shortcircuited for specific hosts using the access database. A common location for this database is /etc/mail. I modified the Makefile to have the access database include all domains used by list members.

  For a UNIX system using GNU make, I renamed the default access file to access.base and then added the following lines to the Makefile

  # MLISTDIR: Location of files containing mailing lists
  MLISTDIR = /var/lib/majordomo/lists
  
  # Alternative 1: explicitly list mailing lists
  #MLISTNAMES = bpa bpa-misc bpa-news bpa-donkeys
  #MLIST_ACCESS=${MLISTNAMES:%=access-%}
  
  # Alternative 2: discover mailing lists based upon presence of
  #       the majordomo configuration file.
  MLISTNAMES = $(shell ls ${MLISTDIR}/*.config )
  MLIST_ACCESS=${MLISTNAMES:${MLISTDIR}/%.config=access-%}
  
  access : access.base
  access : access-user-domains
  	@cat access.base > $@
  	@{ echo '' ; echo '#' ;						\
  	   echo '# Domains for members of mlists: ' ${MLISTNAMES} ;	\
  	   echo '#' ; echo '' ;						\
  	   sort -u -f access-user-domains ; } >> $@
  
  access-% : ${MLISTDIR}/%
  	@sed -e 's;^.*<\([^>]*\)>.*$$;\1;'				\
  		-e 's; ;;g'						\
  	        -e 's;$$;               OK;'				\
  		$< > $@
  
  access-user-domains : ${MLIST_ACCESS}
  	@sed -e 's;^.*@;;' ${MLIST_ACCESS} > $@
  		

  • You will probably need to manually add some entries, because the mail servers of ISPs will be in different domains from their users. This situation can arise in multiple ways:
    • The ISP was merged with, or acquired by, another and the customers kept their old addresses but the mail servers migrated to another domain.
  • A member has his own domain name, but is using the ISPs mail server. This is typical for dial-up users and not uncommon for users with DSL or Cable connections.
  • Arbitrary decision by the ISP. For example, customers of Pacific Bell Internet have their mail addresses in domain pacbell.net but the mail servers are in domain pbi.net.

Reactions from List Members

• Some members will believe that the Spam is going from the list owner.
• Some members will blame the list owner for passing Spam through to the list. The explanation of an unmoderated list does not register.
• Some members will hit the Reply button and not understand that they are responding to the list owner, instead of the purported sender of the Spam.
• Some list members will have a very low tolerance of Spam, for example, two messages in a week after weeks of no Spam messages. Part of this is that they haven't learned how to quickly identify Spam and then ignore it. This is very similar to people who complain about the volume of e-mail because they haven't grasped how to handle quoted sections of previous messages in replies - they read the quoted passages as if it were new information.