total 'overnight' email -- 7923

[craigt]

That's a pretty crappy signal to noise ratio!

[StevenUnderwood]

That's a pretty crappy signal to noise ratio!

I have 16 domains going through Postini and for the last day.. only 16.8% of messages are valid... better than your percentage, however.

Domain - Grand Total

Messages - 16882

Bytes - 365850685

Acct Msgs - 16852

Forwarded Acct Msgs - 2830

% of Msgs - 16.8

% of Bytes - 84.1

Blocked Acct Msgs - 10857

% of Msgs - 64.4

% of Bytes - 10.4

Quarantined Acct Msgs - 3165

% of Msgs - 18.8

% of Bytes - 5.5

[craigt]

My results for this morning aren't really typical -- in fact I think that's my all time record for a crap / valid ratio!

[JamesM]

My results for this morning aren't really typical -- in fact I think that's my all time record for a crap / valid ratio!

There are different types of spam. Does SpamCop want as many as possible reported or is it better just blackhole the repetitive pharma spam? (from the same handful of spammers)

[rconner]

There are different types of spam. Does SpamCop want as many as possible reported or is it better just blackhole the repetitive pharma spam? (from the same handful of spammers)

You can report any mail you get that fits the rules, it is up to you. Here are the rules, they are by an astonishing coincidence in the FAQ: http://www.spamcop.net/fom-serve/cache/14.html

-- rick

On edit: corrected link (see reply below)

[JamesM]

You can report any mail you get that fits the rules, it is up to you. Here are the rules, they are by an astonishing coincidence in the FAQ: http://mailsc.spamcop.net/fom-serve/cache/14.html

-- rick

Thanks for taking the time to reply Richard - That's a great help. Do you happen to have a password and a username for the link you suggested? I'm getting a 401 User Authorization message? Just in case someone else is looking for this information I think the link you meant to post was

http://www.spamcop.net/fom-serve/cache/14.html Which in the early days I read quite a few times and have checked fairly often since because we report a lot of spam and don't want to get anyone in to trouble.

Having read that section we have reported rather a lot of spam and were a bit surprised the other day to be told that SpamCop did not want spam from certain accounts. For instance if we accept spam from anything[at]ourdomain.com we have a lot more spam than if we just report spam from username[at]ourdomain.com.

So should we be reporting all of this of spam from anything[at]ourdomain.com ?

Further if we had other domains should we be reporting spam from those too?

[Assuming of course that the spam in question meets the FAQ at

http://www.spamcop.net/fom-serve/cache/14.html]

So getting back to the slightly more technical original question is there any point in reporting very similar spams multiple times from which is almost certainly from the same spammer [group]?

[rconner]

Just in case someone else is looking for this information I think the link you meant to post was

http://www.spamcop.net/fom-serve/cache/14.html

Oops! My bad! I of course meant to post the publicly-accessible link. Thanks for the correction.

Having read that section we have reported rather a lot of spam and were a bit surprised the other day to be told that SpamCop did not want spam from certain accounts.

Who told you this, and what was the reason they gave?

For instance if we accept spam from anything[at]ourdomain.com we have a lot more spam than if we just report spam from username[at]ourdomain.com.

I'm confused. When you say "anything at ourdomain.com" or "username at ourdomain,com" are you referring to the from-addresses in the e-mail message? Normally these are completely forged and random, and often belong to innocent parties. SpamCop does not do anything with these addresses. I trust you are not trying to report abuse of these addresses through SpamCop.

So should we be reporting all of this of spam from anything[at]ourdomain.com ?

Further if we had other domains should we be reporting spam from those too?

[Assuming of course that the spam in question meets the FAQ at

http://www.spamcop.net/fom-serve/cache/14.html]

I believe that as far as SpamCop is concerned, the spam does not "come from" an e-mail address; it comes from a machine that relayed it to the recipient's mail system, a machine with an identifiable IP address that can be traced back to a particular internet provider who has abuse contact addresses to which abuse can be reported.

So getting back to the slightly more technical original question is there any point in reporting very similar spams multiple times from which is almost certainly from the same spammer [group]?

The point in reporting all spam you get is this -- you feed the SpamCop blocking list with accurate information as to the sources of spam right now. This helps SCBL users (including possibly yourself) to detect and detain (or even reject) mail that appears to be spam. So, I think the more reporting the better (as long as it is accurate and rightful reporting).

-- rick

[JamesM]

Sorry if it wasn't clear i meant mailboxes/users/aliases/accounts on our domain

i.e. contact[at]ourdomain.com richard[at]ourdomain.com etc and any any other made up "send to" address

(as you say the "from" addresses are often pretty random and of little use in most cases.

If I just report emails sent to myusername[at]ourdomain.com I can not report anywhere near as many as if I report emails sent to anything[at]ourdomain.com [*[at]ourdomain.com]

So, I think the more reporting the better (as long as it is accurate and rightful reporting).

That was what I thought and was very disappointed to be told the other day that that this was not the case.

It would be nice if we could clear this up definitively one way or the other.

We are currently blackholing thousands of spams a day and it does seem a bit of waste. (Having said that it saves a lot time and resources) I suppose we could send them to knujon instead.

[rconner]

That was what I thought and was very disappointed to be told the other day that that this was not the case.

Again, I'd like to know who told you this, and what reason they gave. Do you have examples (tracking links) of the spams that were found to be unacceptable?

-- rick

[Farelf]

...

So, I think the more reporting the better (as long as it is accurate and rightful reporting).

That was what I thought and was very disappointed to be told the other day that that this was not the case.

It would be nice if we could clear this up definitively one way or the other...

Who told you and how? You refer to multiple instances of the one spam, addressed to different (including non-existant) addresses at 'ourdomain.com'. Sounds like someone is saying these are tantamount to duplicate reports if they are reported from a single source. Yes it is an important point to clarify. I can imagine SC not wanting to give a 'single reporter' 'undue' weight ...

[rconner]

Sounds like someone is saying these are tantamount to duplicate reports if they are reported from a single source. Yes it is an important point to clarify. I can imagine SC not wanting to give a 'single reporter' 'undue' weight ...

Could the issue be Person A reporting spams addressed to Person B? I have several e-mail addresses, and report spam received at all of them, but they are all MY addresses. If I were running an ISP, it is not clear that I would have the right to file SC reports on behalf of my customers, certainly not without their knowing. The FAQ link above alludes to this indirectly, but is not explicit about it (emphasis added):

If you receive a message (perhaps a bounce) which contains spam, you should not report the spam contained within the message, even if it includes what appear to be the full original headers. This is someone else's spam, not yours.

-- rick

[Miss Betsy]

Everyone is assuming that you were told by a deputy not to submit spam that is going to your catchall account (I think that is what it is called when non-user names are accepted by a server). But you have not actually confirmed that.

Have you asked the person who told you to stop reporting what the reason is? Or did they give a reason? Was this request made via email or phone conversation? Was it in response to a question on your part or did they initiate the exchange?

Have you done a Mailhost configuration?

It seems highly unlikely that anyone who is 'official' spamcop personnel would tell you not to report spam - unless there is something peculiar about the way you are reporting it.

And to get back to the original question, no, there is no reason not to report multiple spams or conversely, yes, there are good reasons for reporting all the spam you receive. Why are you asking that question when 'someone' told you not to submit all your spam? Are you ignoring that request? Or trying to get a clarification on what caused this 'someone' to request you stop submitting spam?

Miss Betsy

[JamesM]

Thanks for all the replies – I’ll try and answer them all in once place

I started the conversation on another matter. I was very surprised when I received a terse reply that the quantity of spam I have been submitting is probably breaking the rules.

So as a precaution I have stopped reporting spam and started blackholing it instead. (Several thousand so far)

I thought by reporting spam I was helping and the person who indicated otherwise was wrong so I'm trying to get clarification of the rules to decide if it's better just to dump it all and forget about it.

Just to clarify

I am using Mailhosts

I have several e-mail addresses, and report spam received at all of them, but they are all MY addresses.

is the case

And to get back to the original question, no, there is no reason not to report multiple spams or conversely, yes, there are good reasons for reporting all the spam you receive

This is what I thought and hoped.

Is it against the rules to report all the spam from a "catchall" account?

[DavidT]

I started the conversation on another matter. I was very surprised when I received a terse reply that the quantity of spam I have been submitting is probably breaking the rules.

Was that here in these forums? Before jumping in to this thread/topic, you hadn't posted here since Oct 11 2007, and the posts at that time had nothing to do with reporting.

Do you perhaps have another login/identity here? I'm not understanding your explanation quoted above. Was the "terse reply" perhaps a PM (private message) that none of us here have seen?

As for catchalls, let me insert my standard advice - just don't use one....period. Why would you want to open yourself up to all that potential spam? The "best practices" for domain owners is clearly not to use a catchall feature -- we've long had consensus on that here.

DT

[rconner]

I was very surprised when I received a terse reply that the quantity of spam I have been submitting is probably breaking the rules.

Received a reply from who? Was it an admin or deputy of SpamCop? Was it on this web forum? Was it an e-mail, phone call etc.? What rule were you "probably" breaking?

So as a precaution I have stopped reporting spam and started blackholing it instead. (Several thousand so far)

I confess I don't know what you mean by "blackholing." Does this just mean tossing them in the trash?

I thought by reporting spam I was helping and the person who indicated otherwise was wrong so I'm trying to get clarification of the rules to decide if it's better just to dump it all and forget about it.

Who is the person who indicated otherwise? Were they affiliated directly with SpamCop, or just another user (like me)? Why did they tell you it did not help to report your spam? It is very hard to give you any "clarification" if we aren't clear about what was unclear in the first place.

Is it against the rules to report all the spam from a "catchall" account?

I'm with DavidT. Just turn the catchall off, your spam will drop precipitously so that whoever told you that you were reporting too much will be happier with you. If you get that much spam, the catchall can't be doing you very much good in the first place.

-- rick

[Farelf]

...I started the conversation on another matter. I was very surprised when I received a terse reply that the quantity of spam I have been submitting is probably breaking the rules. ...

Ah - we have a confluence of circumstances, assumptions ... Too much spam is covered under Is there a limit on reporting spam?

SpamCop has implemented a very generous limit of 3,000 emails that may be submitted for parsing by a single account in a 24 hour period. If you exceed this limit, the system will automatically disable your reporting account.

If you run into the "Your account has been disabled" message, you must pass the "I'm not a spammer" test by writing service[at]admin.spamcop.net explaining your situation. Those passing this simple 'test' will have their account reinstated, however the limit will remain in place.

...Is it against the rules to report all the spam from a "catchall" account?

No

...Could the issue be Person A reporting spams addressed to Person B? I have several e-mail addresses, and report spam received at all of them, but they are all MY addresses. If I were running an ISP, it is not clear that I would have the right to file SC reports on behalf of my customers, certainly not without their knowing. The FAQ link above alludes to this indirectly, but is not explicit about it (emphasis added):

Don has posted in these forums IIRC (and of course IIUC) that it is OK to report other people's spam - to aggregate under a single reporting address. Of course only if *they* don't also report it (duplicate the reports). Many reporters channel several accounts through the one reporting account. Same thing. There is then the bcc thing (multiple different spam apparently addressed to some/any individual not being the recipient ... just to indicate visible addressee has no particular bearing).

Just as long as nobody gets confused and starts wanting to report the spam embedded in a (misdirected) bounce, touched on above. That is quite different. We're talking the stuff received in an account and handled through submission of that unaltered stuff.

[DavidT]

Good analysis, Farelf. The problem was due to this vague phrase:

a terse reply that the quantity of spam I have been submitting is probably breaking the rules

I'm guessing now that this refers to an automatic notification from the SpamCop system, as described in the FAQ item you cited.

Is that correct, JamesM? (Darn...he was just here a moment ago...after Farelf posted....so he apparently saw the post and didn't respond....I hope that he's gone to disable the catchall.)

DT

[Farelf]

...Don has posted in these forums IIRC (and of course IIUC) that it is OK to report other people's spam - to aggregate under a single reporting address. Of course only if *they* don't also report it (duplicate the reports). Many reporters channel several accounts through the one reporting account. Same thing. ...

Here's a couple of cases of what Don actually said (there may be other relevant posts): http://forum.spamcop.net/forums/index.php?...ost&p=61061

...It's not against the rules to report other people's spam, but it's a bad idea.

http://forum.spamcop.net/forums/index.php?...ost&p=63221

...You only need one account to report all your spam. ...

Read those in their original contexts and I think it should be clear - but he's certainly NOT advocating reporting the spam of others. Though that's a step further than anything JamesM was talking about, it is still 'within the rules'.

Researched because Don shouldn't have to clarify what he'd already said, elewhere, plainly, and I was putting the wrong slant on it, WRT 'other people's spam'. Memory ...

Besides which, he's already said he never looks at the 'Geeks' and 'Lounge' forums so wouldn't even see a misstatement "here". (I hasten to add, just as the Bishop said to the Actress, "Don't rely upon it," though in that case The Most Reverend gentleman was responding to the lady's query on whether or not X-rays might make one sterile.)

[DavidT]

I posted these questions for JamesM a few days ago:

Was that here in these forums? Before jumping in to this thread/topic, you hadn't posted here since Oct 11 2007, and the posts at that time had nothing to do with reporting.

Do you perhaps have another login/identity here? I'm not understanding your explanation quoted above. Was the "terse reply" perhaps a PM (private message) that none of us here have seen?

He's been back here since then, and I don't understand why he hasn't cleared up the mystery. Farelf posted a possible explanation, and it appears that JamesM saw it, and yet....?

DT

[Miss Betsy]

When the OP doesn't come back with an explanation or answers to questions posed by other posters, /then/ is when I start to think 'troll' - though actually the OP seems to be one of those people who simply cannot comprehend the need for detail in troubleshooting. As I am just a hair's breadth away from not being able to understand why all that detail is needed, I do have empathy. But since I do try to provide detail when I ask questions (now, after meeting Wazoo<g>), I don't have much sympathy.

Miss Betsy

[rconner]

As I am just a hair's breadth away from not being able to understand why all that detail is needed, I do have empathy.

Doesn't seem like you'd need much detail orientation to be able to answer questions like "who told you?" or "where did they tell you?" or "what did they say you did?" Maybe that's just me, though.

-- rick

[Farelf]

...When the OP doesn't come back with an explanation or answers to questions posed by other posters, /then/ is when I start to think 'troll' - though actually the OP seems to be one of those people who simply cannot comprehend the need for detail in troubleshooting. ...

Heh, someone reporting well over 3,000 spam a day (and wanting to keep doing it) probably doesn't have a lot of time for complexity. But yes, not answering direct and repeated questions is typically "troll-like" behavior and any innocent accused as such had better get used to the injustice or learn to focus if they come back for more help. But many, if they find their answer, seem to simply move on without a backward glance, for whatever reason. A matter of manners? Who knows, so who can judge? But it helps the rest of the internet community if there is some feed-back.