Is the email addy burned? Can I save it?

Forum Moderators: phranque

Message Too Old, No Replies

Is the email addy burned? Can I save it?

tangor

1:04 am on May 13, 2019 (gmt 0)

Email address from one of my domains (over 25 years old) has recently been "hijacked" by spoofers, intense enough that even major isps and Spam Assassin are taking note EVEN THOUGH NONE of the sending IPs are even remotely similar to my dedicated.

Something new to me ... never seen anything like this before.

Thoughts?

Any way to save it? (need steps)...

Or do I just kill it and rebrand a different version of the same addy?

Might know a thing or two about websites/spam/hacks, but email servers and addressing this FROM AN EMAIL POINT OF VIEW is new to me.

phranque

1:21 am on May 13, 2019 (gmt 0)

is it one of the typical functional email addresses?
e.g. admin@example.com, webmaster@example.com, etc...

tangor

1:57 am on May 13, 2019 (gmt 0)

Nope .. a personal I have used for more than 25 years. If it makes a difference, April I had to change hosts (which resulted in a different dedicated IP) and it appears this stuff surfaced about the same time.

engine

9:06 am on May 13, 2019 (gmt 0)

Sorry to hear that.
It may simply have been a coincidence of the change in April; You'll probably never know.

Spoofed addresses are commonplace, and you're lucky to have gotten away with it for so long, imho.

Solution: If it's not a critical address, change it and move on.

dstiles

10:13 am on May 13, 2019 (gmt 0)

I get a lot of spam claiming to be FROM me as well as to and from arbitrary addresses at my domains. I've dropped old, unused addresses but I refuse to dump functional ones as my customers, friends and family contact me on some of them.

Do you have SPF, DKIM and DMARC set up for your domain? If not, I strongly advise doing so. I set the DMARC DNS entry to "reject", which tells the more compliant mail servers (eg google, oath) to ignore anything which is not signed and from my server.

As to receiving mail, I use postfix and have set it up to reject a variety of random senders using HELO tests. I reject unknown DNS response, dynamic and static rDNS (which are indicative of broadband) and a number of other stupidities. Today, for example, I got a LOT of HELOs using my own IP, which is a definite no-no.