Use these links to choose the section you are interested in

Cyberbay High Speed Internet Services, ISDN, POP, Wireless, Dial up

Web Mail

Use these links to choose the section you are interested in:

General discussion

Definition of spam
Rules of the spam game
What to do if you are on a site that permits spam
How to alert a site that they are hosting a spammer
How to identify a Spammer
Spam do's and don'ts

Write your congressional representatives
How to report fraudulent e-mail
E-mail filtering techniques

How to edit sendmail.cf
How to filter e-mail addresses and sites
How to stop e-mail forwarding on your site
How to test the changes in sendmail
The spammer master lists
Credits

Other anti-spam resources

General Discussion

Here are the facts:

According to some estimates, there are 50 million Americans with Internet accounts.
Nearly all accounts have e-mail service.
It costs virtually nothing to send an e-mail.
There is no meaningful regulation of e-mail.

This is a recipe for exploitation, and you are the target. All an advertiser has to do is obtain your e-mail address – after that, he can spam you again and again.

I recently received two "spam" e-mails. The first offered to put a phone sex telephone number on my site – "Your choice of Straight, Gay, or Fetish lines available" – the second offered to sell me a list of 25 million e-mail addresses. As I read these messages, it struck me that, unless I fought back, I would be daily forced to look into the human sewer that spam e-mail represents, and I would be just one among millions of victims.

To say it in plain English, I am going to fight spam, and I hope you will join me -- let's take the Internet back from the sewer rats.

Definition of Spam

A "spam" e-mail is generally defined as an unsolicited mailing, usually to many people. A message written for, and mailed to, one individual that is known to the sender is not spam, and a reply to an e-mail is not spam, unless the "reply" repeats endlessly.

Spam e-mailers have become a separate part of the Internet, with their own host computers, methods, and politics. Many Internet sites have begun to forbid spamming, for several reasons – one is a sense that it is unethical, another is that, over time, other Internet sites will stop all e-mail from that site and thus prevent legitimate e-mail from getting through. As a result, spammers have begun to set up their own Internet sites -- sites that cater to, or encourage, spamming.

Rules of the Spam game

Your goal as an Internet user is to figure out a way to separate legitimate e-mail from spam. There are several ways to do this. One way, described below, is to set up your mail service so that known spammers are not allowed to deposit mail in your account. This method relies on knowing (1) the return e-mail address of the spammer, or (2) the name of the spammer's host computer.

The spammer's goal is to get around your filtering methods. He can do this by (1) using a different e-mail address for each mailing, or (2) he can forward his e-mail by way of an intermediary, to conceal the actual origin. The second of these methods is often used without the knowledge or permission of the intermediary, and it usually results from an error in configuration – I will show you how to protect your site from this exploitation.

Because it is very easy to simply create a new return address for each of millions of e-mails, filtering by way of return address is only effective when dealing with small-scale, amateur spammers. As a result, many sites simply block all e-mail from a particular spammer-friendly site. What this means is, if you have an account with a site that also welcomes spammers, your e-mail will sometimes not get through. This is why Internet sites are gradually splitting into two classes -- those that welcome spammers and have no normal users, and those that aggressively stop spamming from their sites to protect their legitimate users.

What to do if you are on a site that permits spam

If your e-mail cannot be delivered to a site you write to, it may be that your host site has one or more spammers among its clients. If this happens to you, use this method:

Use a friend's e-mail account to write the destination site and ask whether your host site has been blacklisted, and the reason.
If your site has been blacklisted because of spam problems, write your own site's support address (usually support@yoursite.com or webmaster@yoursite.com ) and demand that all spammers be thrown off the site.
If your service does not cooperate, change services . Canceling an account is one of the most powerful signals you can send -- a loss of revenue.

This problem – blocking an entire site – is why legitimate sites will act to stop spamming if you bring it to their attention. It is also why spammers end up on sites that specialize in spamming, sites that will not listen to your complaints. So, before writing to complain, you need to discover which kind of site you are writing to.

How to alert a site that they are hosting a spammer

If you are writing to a legitimate site, they will usually have a special address ( abuse@sitename.com ) set up to deal with the problem. They may thank you for writing and ask for more information (such as the e-mail header, which shows the actual path the e-mail took through the Internet).
If you are writing to a spam-friendly site, chances are they will not write back, or they will reply with a justification of their practices, or (in some cases) they will simply place you address in their master list of victims (this happened to me).

Be aware that, if the spammer is using forwarding, you may end up writing a complaint to an innocent Internet site that was exploited by the spammer. If this happens, you may want to alert that site that their e-mail server is configured incorrectly and should be reconfigured as shown below.

How to identify a Spammer

You can use my Whois Utility to find the spammer's actual identity. Simply look at the e-mail header, find the source host name (this may take practice because spammers try to hide the actual host name) or address and type it into the "Whois" utility. Or, if you are comfortable using a UNIX shell and have this kind of access, you can issue the Whois command from there.

Do not rely on the e-mail's return address. This is much too easy to fake. The other information in the e-mail header is more useful and more likely to lead to the actual sender.

Spam Do's and Don'ts

Never respond to a spam e-mail. For a spammer, one "hit" among thousands of mailings is enough to justify the practice. Instead, if you want a product that is advertised in a spam e-mail, go to a Web site that also carries the product, inquire there, and tell them you do not approve of spam methods and will not patronize a company that uses spammers.

Never respond to the spam e-mail's instructions to reply with the word "remove." This is just a trick to get you to react to the e-mail -- it alerts the sender that a human is at your address, which greatly increases its value. If you reply, your address is placed on more lists and you receive more spam.

Never sign up with sites that promise to remove your name from spam lists. These sites are of two kinds: (1) sincere, and (2) spam address collectors. The first kind of site is ignored (or exploited) by the spammers, the second is owned by them -- in both cases your address is recorded and valued more highly because you have just identified it as read by a human.

Never mail-bomb spam sites or engage in hacking to stop spammers. This only increases the amount of wasted Internet traffic, creates sympathy for spammers, and makes the Internet even less reliable than it already is.

Take meaningful action to stop spammers. Filter their messages or their sites using the methods described below, write their host sites (without revealing your real e-mail address!) and any sites that are used as relays, write your congressional representatives.

Write your congressional representatives

In the long term, this approach may be the only effective one. Spammers will probably figure out a way around most of the direct, technical methods I describe here, so legislation may be required to stop them.

You may not want to involve government in the Internet, because if one law is passed that regulates an aspect of the Internet, others may follow. I assure you, I understand and sympathize with this position, and there is always a risk in getting government involved in anything. But the spammers are already taking advantage of the methods of government, through lobbying for their own cause, taking advantage of loopholes in existing laws, and relying on governmental inertia and public apathy to help their cause.

By getting involved, we send a signal to government that we won't stand to be abused as we have, and we also send a signal to companies that they will lose public approval if they use spammers to promote their products. Both are powerful reasons to write letters, make phone calls, and send faxes.

If not us, then who, and if not now, when?

Write your congressional representative -- click here.
Write your state's senators -- click here.
Write the Federal Trade Commission, demand action against spammers -- click here.

How to report fraudulent e-mail

Most spam is simply annoying, but some of it is illegal. One obvious category is an e-mail that asks you to send, say, $5 to several addresses in the letter, and promises big returns if you follow the letter's instructions -- this is called a "pyramid scheme" and it is illegal.

There are many other kinds of illegal e-mail, too many to describe here. If you believe an e-mail is fraudulent, you should report it. Here are some addresses that accept fraud reports: