A Catch-All Inbox Full of Spam

Every address, delivered

When a domain's email is set up, the host often offers a convenience: mail sent to any address at the domain arrives in one inbox.

Sales, info, the owner's name misspelled, a staff member who left in 2011. All of it lands.

It is called a catch-all, or in many control panels the default address. It was switched on years ago so that nothing would be missed.

Spammers send to thousands of invented addresses at domains like yours. A catch-all accepts every one, so the inbox fills with mail to names nobody uses, and the enquiry that mattered sits on the fourth page.

Where the junk comes from

• Guessed names such as admin, sales and john, tried in bulk.
• Random strings generated by the thousand.
• Bounces of spam forged to look as if you sent it.
• Old addresses collected from websites and directories years ago.
• Misspellings of real addresses, a few genuine and most not.

The third surprises owners. Spammers often put a made-up address at your domain in the sender line; when their mail bounces elsewhere, the bounce comes back to you, and the catch-all takes it in.

What it costs

Time, first. Someone scrolls past hundreds of messages a day looking for the few that matter, and eventually stops looking carefully.

Then the mailbox limit. Hosted mailboxes have a size limit, and a catch-all can reach it in weeks. After that new mail bounces, including the enquiries.

And if the catch-all forwards to an outside address, such as a personal Gmail account, it forwards the spam too. The receiving service can start treating your server as a source of spam, and genuine forwarded mail suffers.

Look before switching it off

Do not switch it off blind. Spend half an hour looking through the catch-all for mail that real people sent, and note which addresses they used.

Typical finds: an old role address still printed on a van or an invoice, a former employee's name, a common misspelling of the owner's name, and an address a supplier has used for years.

Each of those becomes a deliberate address or forwarder pointing to the right person. Everything else can go.

Refuse, do not swallow

Turning the catch-all off usually offers a choice of what happens to mail for unknown addresses. Choose the option that refuses it with an error at the moment it arrives.

With refusal, a genuine customer who mistypes gets a bounce within a minute and tries again. Deleting such mail silently instead loses that customer without either of you knowing.

Refusing at arrival also means your server never sends bounces of its own to forged senders, which keeps it off the lists of servers that do.

Control panels do not always word these options clearly. Your host can tell you which one refuses at arrival, and set it for you.

Old staff addresses

A former employee's address is the most common reason a catch-all was left on. Nobody wanted their mail lost.

Give each one a forwarder to a role address or to their replacement, and a date, six months or a year out, to decide whether it is still needed.

An automatic reply on the old address can tell senders where to write in future.

A worked example

A roof snow clearing company in a mountain town clears roofs, decks and walkways for chalet owners and strata buildings from November to March, with two crews and a lot of rope.

Its domain had a catch-all from the start, so bookings, the owner's name and anything else would arrive in one mailbox he read on his phone.

Last summer nobody watched it closely. By October it held tens of thousands of messages to invented names, and a steady stream of bounces for spam the company never sent.

The mailbox hit its size limit in the first week of November, just as property managers were emailing to book the season. Their messages bounced, and some hired someone else.

This month, well ahead of the next season, the owner went through the catch-all for real senders.

He created bookings and accounts addresses, set forwarders for a former partner's address and two misspellings of his own name, and switched unknown addresses to refusal.

The mailbox now holds only mail sent to someone who exists, with months to spare before the first snowfall.

Addresses for jobs, not people

Use role addresses for anything printed or published: vans, invoices, the website and directory listings. A role address can be pointed at whoever does the job this year.

When someone leaves or a job changes hands, the change is one forwarder, not a reprinted van or a new batch of cards.

Personal addresses are for people already dealing with that person.

Keep a short written list of every address at the domain, who reads it, and where each forwarder points. It is the list the catch-all was quietly standing in for.

Checking it worked

Send a message from a personal account to a made-up address at your domain. It should bounce within a minute with a clear error.

Then write to each real address and forwarder and confirm the mail arrives where it should.

For a few weeks, if someone says they emailed and you never saw it, ask exactly which address they used. Add it if it deserves to exist.

The counter-case

A few businesses use a catch-all on purpose, for example giving each supplier or each website sign-up its own address to see which one ends up with spammers. That works when the owner chose it, reads it and filters it.

A very new domain that receives little spam can also run one for a while without much harm.

For most businesses it was a default nobody revisited. Turn it off, create the addresses people really use, and refuse the rest with an error.

This week

1. Check whether catch-all is on in your hosting panel.
2. Search it for real senders from the past year.
3. List the addresses they actually used.
4. Create those deliberately as addresses or forwarders.
5. Set unknown addresses to refuse with an error.
6. Test with a made-up address from outside.
7. Write down every address and who reads it.

Step five is the change that matters. Refusing at the door ends the flood and the forged bounces, and anyone genuine who mistypes is told at once.

Another kind of mail aimed at whoever owns a domain is covered in the urgent email about your name in foreign domains.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.