Recently the email system that has served me well for many years has begun to fail me. A variety of the email addresses that I have used legitimately in the past have started turning up as receiving SPAM.
I suppose a good place to start is at the beginning, since not everyone may be familiar with my email system. My personal domain, curtis.kularski.net was implemented several years ago with an email system allowing wildcard access, meaning that I could use whatever username I wanted on the domain for a particular use, for example if I was to conduct a transaction with Acme Rockets Inc, I might use AcmeRockets@curtis.kularski.net as my contact address for them, which gets forwarded back to my main email box. Up until now, trusted companies have never turned up as having their assigned address used for SPAM. This is not a dictionary attack as would be suspected with the way my mailboxes are operated, but certain specific addresses have been attacked. I do not have reason to believe that the databases of those companies were breached, but I do believe that some of the unencrypted email traffic has been sniffed somewhere at some common point in order to determine those addresses. I am not sure what I am going to do as a long term approach to correcting that specific problem, but for the moment I am intending to reassign those organizations to new addresses and hopefully get the recent waves of SPAM to stop.
At the moment I am also evaluating a greater change in my e-mail configuration, for one I am considering moving to a system that only accepts pre-specified addresses as valid delivery addresses and using mail rules, the mail will be sorted into folders. I am presently experimenting with how well this works with my subscribed email. It is quite a slow experiment to conduct, but once it is finished I should be able to implement it pretty easily, as I will have generated a list of addresses that are needed and such. At the moment the experiment is on a separate domain that previously did not have email support, in an attempt to minimize disruptions and any false positives or conflicts with existing email configuration. This is fairly complicated as it requires me to reverse nearly my entire email system. I have to remove my blacklist and create a whitelist in its place.
I must say that the system I have utilized so far has worked pretty well and is only lately falling victim to some strange circumstances, including receiving email to addresses that seem to be pretty random (Donovan_shultz@curtis.kularski.net for example), and address that have been used publically before that are being picked up by bots and such and used against me. I have tried a variety of things, including using a single purpose email account on my other domains to try to have all of my junk mail in once place, but that didn’t take hold too well and was too hard to manage (some places still send email from a lot of different addresses). When this system was initially created it was created with the idea of both human mail as well as machine mail going to the same place, only separated by the address issued to each party, but it became too confusing for the humans, so the systems had to split. I have grown to like the two (actually, now 3) places for email, it makes things make more sense when I am working on a particular task. Human, machine and academic mail are now all separate, but it doesn’t bother me anymore.
I find it funny that when the existing email system was put into place many years ago people told me I would get bad dictionary attacks, but so far nothing even close has occurred. A few random addresses, and a few companies misusing information, but otherwise not a bad run for a system that the IETF (Internet Engineering Task Force) said was a bad idea. No address, not even my main account address (which is pretty simple) has been victim to any kind of logical or systematic attack.
