Jan Wildeboer 😷3d ago

When spammers don't like you reporting their spam, they will:

- set up a forwarding email address on one of their servers with good DKIM/SPF/DMARC, typically on a domain that will expire soon
- Run a script that spams hundreds of support addresses/web forms with nonsense content using that forwarding address
- Forward all the confirmation receipts to your email address

That stuff is easy to block, but can be quite a nuisance to the affected support teams.

#SelfHost #MailAdmin @homelab

Show threadJulian3d ago
@jwildeboer It's probably not related to you reporting them. Most often I'm too lazy to do that and I still get the same kind of spam recently.
Show threadJan Wildeboer 😷3d ago
@julian I tracked deep enough to make the connections between reports I made, the sending domains of that spam, the domains used for these support tickets etc. I am 90+% confident it is more causation than correlation.
Show threadJan Wildeboer 😷3d ago
@julian But I also wanted to document in the open how these support ticket spams work. Regardless of the why. The forwarding address is in all cases a google account, so it comes in via google mail servers. I report these domains to google and that's all I can do. The spammers know that Google typically doesn't care, especially when the domains used expire in a few days/a week.
Show threadJulian
@jwildeboer Google Account as in Gmail? I'm getting lots of spam forwarded through Google Groups (maybe I should just start filtering that).
Mar 20 at 6:12pmWeb
Show threadJan Wildeboer 😷3d ago
@julian As in that spam domain uses Google mail services, as you can see when looking up the MX entry in the DNS of said domain.