Catchall Spam

For those of us lucky enough to have our own email domains, one useful way to catch spam is to inspect the catchall account's contents.

A catchall account is an account that most email servers use to put all mail addressed to the domain that don't have a valid email address (there is no mailbox matching the name given). Most servers are set up to simply discard such emails after sending a nondelivery receipt (NDR). However, instead it is becoming more common to drop all these messages into an account set up specifically for these undeliverable messages. When spammers send spam, one technique is to try to guess email account names. The result is that many times the catchall account has many copies of a particular spam message.

The difficulty with catchall is that it is server-side technology, so whoever is running your email system needs to implement it. However, after a catchall account is implemented, setting up Thunderbird to handle it is fairly simple:

1. Have the email system administrator create a catchall account. You will need access to this account to use it to train Thunderbird's adaptive spam filter.

2. Create an account for the catchall account. In my system, I've named the catchall account catchall. (Use something like [e-mail].)

3. Create a filter for this account. This filter must mark everything that comes into the catchall account as spam. I've found that a filter that checks the email date and flags all emails dated after 1/1/1945 as spam work well. (Prior to this time, spam was always sent as food in cans and not as messages.)

4. In the filter, also specify that the emails are to be moved to your junk mail folder for this account.

5. It can be worthwhile to occasionally check the catchall junk mail folder for messages that are nonspam but were misaddressed. However, in my experience this is very rare.

Using the catchall account to train Thunderbird's junk mail filters can lead to much improved performance. I have noted on my system that virtually all junk mail to existing user accounts appears in the catchall account as well. Often the catchall account ends up with many copies of the spam, a sure indicator that the message is spam and not desired email.