At Groovy Web Services, it's been our practice to allow all emails that aren't specified with a real email account to be delivered to a 'global' or 'catch all' email account, usually the primary account for our clients' services. This would allow for typos (ifno@domain.com for example) to still be delivered. For the following information, assume that you are the owner of domain.com.

With a 'global' or 'catch all' email account, anyone can send an email to any address at domain.com (hi-there@domain.com, makeoneup@domain.com, etc) and it would be delivered to your email account.

Unfortunately, tying that in with a common tactic that spammers will use called a 'dictionary attack' results in big problems. Spammers will have a list of common names and will try to send their spam to this list (alice@domain.com, allen@domain.com, dan@domain.com ... zachary@domain.com, etc) as it costs them nothing and statistically their odds are good that they will get some spam delivered. With a 'catch all' email account, you would have gotten them all!

Recently another tactic they've started using is to send spam out to people in their lists using a fake reply-to address, created by using random names with an existing domain name. There's no rhyme nor reason as to what domains they choose. Now, keep in mind, they're sending emails out with a fake reply-to address with your domain, for example 'stockalert@domain.com' using a dictionary attack I mentioned above. When the spam arrives at the recipient's email server, and the email address does not exist (which is most often the case in a dictionary attack), the recipient mail server is obliged to send an 'undeliverable' message back to the sender. However, because the spammer used a fake reply-to address, and the recipient email server doesn't know any better, the 'undeliverable' email gets delivered back to you, not the spammer (they don't care). So you can see how a 'catch all' email account can really be a problem when you get one or two spammers picking on your domain name when they send their spam.

Right now, unfortunately, there's not a lot that our system administrators can do beyond removing the 'catch all' accounts and running spam filters and controls on our servers, but the sysadmin community is working hard to combat this problem (it's estimated that 80% + of all emails sent worldwide on any given day is spam now!).

To help alleviate the problem, I'd advise you to have the global account settings removed from your Groovy Web Services account. Please send me an email to admin@groovy-web.com or call me at 1+ 604.417.1021.

Krys Wallbank
Director
Groovy Web Services