does ME support mail aliases?

Discussions on webmail and the Professional version.
merk
Posts: 423
Joined: Sun Oct 12, 2003 2:50 pm

does ME support mail aliases?

Post by merk »

Hi all,

this is something i asked about a while back (before 2.0 was released).

I'm wondering if 2.0 supports mail aliases? for example, if you have a gmail address of something@gmail.com, you can also use something+abc@gmail.com as your address. You can append anything after the plus mark and it will be sent to your mailbox.

I'd like to know if ME has something similar. When ever i submit my email address to a website, i usually create an email alias in ME so if i start getting spam, i know where it originated from.

its kinda of a pain though to do this for every single site. So it would be MUCh nicer if ME would let me do something like gmail does. It would also be nice if this was configurable on a post office by post office basis or even better yet, on a domain by domain basis.

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Re: does ME support mail aliases?

Post by fmaxwell »

merk wrote:Hi all,

this is something i asked about a while back (before 2.0 was released).

I'm wondering if 2.0 supports mail aliases? for example, if you have a gmail address of something@gmail.com, you can also use something+abc@gmail.com as your address. You can append anything after the plus mark and it will be sent to your mailbox.

I'd like to know if ME has something similar. When ever i submit my email address to a website, i usually create an email alias in ME so if i start getting spam, i know where it originated from.

its kinda of a pain though to do this for every single site. So it would be MUCh nicer if ME would let me do something like gmail does. It would also be nice if this was configurable on a post office by post office basis or even better yet, on a domain by domain basis.
I do something similar, except that I use an underscore to preface the individual e-mail addresses. For example, "_Ameritrade@{my domain}." I use a catchall, but that's caused a big problem:

A spam gang is sending out spam with addresses forged to look like the mail came from my domain. So I end up getting bounce messages for the spam.

I have been asking for wildcard matching in mailboxes for several years (see http://forum.mailenable.com/viewtopic.p ... highlight=). With that, I could disable the catchall and specify "_*@{my domain}" as going to a particular mailbox. Then I would not be splattered with bounce messages or dictionary attacks by spammers.

Although I like the feature, I definitely do not like the way that gmail implemented it. The way that they did it, any spammer can strip off the + and everything following up to the @ sign and they have your primary gmail address.

merk
Posts: 423
Joined: Sun Oct 12, 2003 2:50 pm

Post by merk »

yeah eventually the spammers will figure out to strip out the + but its a step in the right direction. A step i wish ME would take. It would make it a lot easier to avoid and ID spam sites.

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Post by fmaxwell »

merk wrote:yeah eventually the spammers will figure out to strip out the + but its a step in the right direction.
But once it's figured out, the flood gates will open. It only takes one spammer to figure out to strip the + and what follows, and suddenly your primary gmail address is on countless spam lists all over the world.

I've been asking for ME to address this for several years. All that it would take is to simply allow wildcards in mailboxes to specify what addresses go each mailbox.

And you would not put your primary address at risk. You could even do something convoluted like ab*cd@yourdomain.com so that spammers could not easily tell what to strip.

I'll put my money where my mouth is: If MailEnable implements that feature in the Professional version of 2.0 as described in my earlier suggestion (see http://forum.mailenable.com/viewtopic.p ... highlight=), I'll buy a Professional 2.0 license as soon as I am notified that the feature is there.

michelkenny
Posts: 42
Joined: Mon Sep 11, 2006 7:36 pm

Post by michelkenny »

Any word on this if it is/will get implemented? This is probably my #1 most requested feature.

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Post by fmaxwell »

michelkenny wrote:Any word on this if it is/will get implemented? This is probably my #1 most requested feature.
Thanks for writing. I'm sure that a lot of people want it -- especially given how much spam has increased this year. I have not heard anything regarding the feature and I've been asking for this it since 2002.

I am receiving multiple bounce messages every day in my catchall mailbox, always to some random address that some spammer has forged as a From: address on his spam. Since I rely on the catchall for legitimate addresses (in the form of "_somename@mydomain.com") that I have given out hundreds of, I cannot disable it.

My offer still stands: If MailEnable implements that feature in the Professional version (see http://forum.mailenable.com/viewtopic.p ... highlight=), I'll shell out the $240 (U.S.) to buy a Pro license immediately.

michelkenny
Posts: 42
Joined: Mon Sep 11, 2006 7:36 pm

Post by michelkenny »

fmaxwell wrote:I am receiving multiple bounce messages every day in my catchall mailbox, always to some random address that some spammer has forged as a From: address on his spam. Since I rely on the catchall for legitimate addresses (in the form of "_somename@mydomain.com") that I have given out hundreds of, I cannot disable it.
Same here. Each site that I give my address to, I use their name so I also rely on the catch all. Needless to say I get a lot of spam in there too.

RickH
Posts: 49
Joined: Tue Feb 08, 2005 4:23 pm

Post by RickH »

Can't you just add email addresses to the account in webadmin?
That of course assumes you are the admin. I guess if you want non admins to be able to do that same thing then you would have to write a webpage to allow this function. Enhancing the webmail to be able to do this may be abused however.

RickH

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Post by fmaxwell »

RickH wrote:Can't you just add email addresses to the account in webadmin?
I have given out several hundred addresses that start with a leading underscore and have not tracked them. I have no list of addresses to add.

RickH
Posts: 49
Joined: Tue Feb 08, 2005 4:23 pm

Post by RickH »

You should be able to write a pickup event to do this but you would need to know that the catch-all has been activated. Does anyone know how a vbs script can read the headers in a message via CDO or how else to detect that a message is being sent to the catch-all account? The scripting part would be easy after knowing that fact.

RickH

Update. This VB Script will analyze the message header to detect if the catch-all filter has been activated. If so then you can determine if the email should be forwarded or deleted. This assumes a CDO message opened with the name 'message'.

Code: Select all


if instr(lcase(message.fields("urn:schemas:mailheader:received")), "with mailenable catch-all filter") > 0 then
	'' Analyze message.To and decide if the message needs moved to a real account
	'' or deleted...

end if

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Post by fmaxwell »

RickH wrote:Update. This VB Script will analyze the message header to detect if the catch-all filter has been activated. If so then you can determine if the email should be forwarded or deleted. This assumes a CDO message opened with the name 'message'.

Code: Select all


if instr(lcase(message.fields("urn:schemas:mailheader:received")), "with mailenable catch-all filter") > 0 then
	'' Analyze message.To and decide if the message needs moved to a real account
	'' or deleted...

end if
Rick,

Thanks for that. It's a cool idea. I may look into fully implementing it until/unless MailEnable fixes the problem right.

The problem with your solution is that the mail server will still accept all messages. That means that a dictionary attack can result in your bandwidth being tied up for hours as spammers blast tens of thousands of addresses. The other problem is that the acceptance at address X means that the spammer often considers address X to be valid, meaning that he'll send to it in the future or sell it to other spammers.

RickH
Posts: 49
Joined: Tue Feb 08, 2005 4:23 pm

Post by RickH »

Yea I understand your concern. It is almost impossible to use any type of catch-all without opening yourself up to spam.
I am considering the ability to block incoming messages based on criteria before the SMTP server ever accepts them. I want the spammers to know the messages have not been received. Today anything I delete based on spam filters and virus scanning appears to the sender as delivered. I want to stop this anyway I can.

RickH

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Post by fmaxwell »

RickH wrote:Yea I understand your concern. It is almost impossible to use any type of catch-all without opening yourself up to spam.
I am considering the ability to block incoming messages based on criteria before the SMTP server ever accepts them. I want the spammers to know the messages have not been received. Today anything I delete based on spam filters and virus scanning appears to the sender as delivered. I want to stop this anyway I can.

RickH
Rick,

Well said and we are in complete agreement.

Now if MailEnable could support wildcards (e.g., "_*@mydomain.com"), we could get rid of the catchalls and still be able to have traceable, revocable e-mail addresses that we provide to untrusted, semi-trusted, and commercial entities.

Regards,
Fred

merk
Posts: 423
Joined: Sun Oct 12, 2003 2:50 pm

Post by merk »

anyword from anyone at ME support is this is something that might getting added in?

fmaxwell
Posts: 151
Joined: Sat Aug 03, 2002 9:10 am

Post by fmaxwell »

merk wrote:anyword from anyone at ME support is this is something that might getting added in?
I wish there was, but it's something that is not getting attention.

I'm really disappointed because I really think that this is something that could be done and documented in a couple of days, at the worst, and it would make so much sense for so many people.

Post Reply