Block E-Mail Bounces with BATV
Opinion: A new standard, implemented in IronPort hardware, can nip blowback in the bud.Imagine your incoming e-mail volume suddenly leaping 360 times above normal. Its not spam, not strictly speaking. Its a misdirected bounce attack. Bounces used to be a good and useful thing. When you send an e-mail to an invalid address or make some other sort of error, you want to know that it didnt go well. But along the way, bounces got abused just like everything wholesome about e-mail to the point where you had to avoid them as a matter of course. First, bounces became accomplices to spamming through directory harvest attacks. In this attack, a spammer picks a domain and sends out a large number of messages, guessing at the user name portion of the e-mail address and probably pulling a lot of them out of a directory of names (e.g., firstname.lastname@example.org, email@example.com, etc.). If the spammer gets a bounce on a message, then its not an address in that domain. The messages that dont bounce are real addresses, and then you spam them. Because of this threat, many domains dont send back bounces for wrong addresses anymore.
Another threat these days is what is sometimes called spam blowback. As most of you know, when an e-mail is sent on the Internet from firstname.lastname@example.org to email@example.com, there is no mechanism with which the folks at bar.com can confirm that the message was in fact sent by firstname.lastname@example.org, or from anyone at foo.com.