83

A long time ago one used to be able to count on domains having addresses like [email protected], [email protected], or [email protected] ... is this convention dead?

Note: I always try to make sure to make a contact available on the websites I put up, so people can contact us if necessary. But are there reasons to handle these or other "standard" email addresses I might not be thinking of? I set up less email addresses than I used to since spam got so awful, and a "predictable" email address just seems to be an invitation to the lousy spammers.

3

5 Answers 5

60

There's no reason to create them all as individual e-mail accounts. You can just set up forwarders that lead to a generic site.admin@ account and set up a filter for that in your mail client to keep the noise isolated.

You'll want them, because:

  • webmaster@ is where good natured people do things like report broken links, it happens more than you'd think!
  • abuse@ is nice to have, it sometimes keeps people from going directly to your host / data center / bandwidth provider in the event that someone found a way to use your server to send SPAM.
  • postmaster@ is handy to check, and make sure root's mail is also sent there, at the least it will show you if your mail server is configured incorrectly, it will also catch bounces that let you know you have a spammer.
  • hostmaster@ is strongly recommended by RFC2142 as a well-known mailbox name for your DNS zone's SOA record.

I usually check my 'catch all' once a week and clean it out. It only takes a few minutes. Once in a while you find a real gem, which is something like "Your site helped me, I just wanted to say thanks for the resource!" .. which always makes your day :)

This, of course in addition to the convenience of automatically generated SSL certificates - SSL providers will send confirmation email to one of the above addresses, so you need to be able to receive it.

5
  • Yes, you can and should use aliases where that makes sense. Yes, there are well-known addresses Certificate Authorities will use. But the real answer is to refer to RFC 2142, as M Dudley said in a comment above. That says what are the well-known addresses. Sep 17, 2015 at 4:40
  • Can you clarify the bit about the aliases? Do you mean you create one admin@ account, and then give out contact@ and say contact2@ which forward to admin@? I tried forwarding non-existent addresses to the main email address, but that did not work. Or do you mean set up a catchall and have all emails forward to admin@? Thanks
    – pushkin
    Jul 18, 2018 at 2:14
  • Can you elaborate on the SSL certificates? Are you referring to self-signed certificates or something else. I don't understand how email is involved. Cheers.
    – devios1
    Aug 27, 2018 at 16:21
  • 1
    I think it would be worth adding hostmaster@ to your list. RFC2142 strongly recommends using this 'well known mailbox name' in your DNS zone's SOA record.
    – Kal
    Feb 11, 2020 at 23:31
  • @Kal Seems like a good idea. Added!
    – Tim Post
    Feb 12, 2020 at 3:35
22

Every RIPE LIR (Réseaux IP Européens Local Internet Registry) must have an abuse@ account and based on the RFC 2141 the webmaster@ (http), postmaster@ (smtp) or hostmaster@ (dns) addresses are used by most (all?) Providers.

So if you don't want to be an LIR and don't use certificates, you are mostly free to set your mail addresses any way you want.

7

If you plan on purchasing a domain-validated SSL, admin@ is generally a good one to have, as the domain-validated certificates use a small list of hard-coded email addresses, and admin@ is generally one of them.

5

I have mine set up so that [email protected] gets sent to me. This takes care of possibly missing anything.

So far I have not gotten much spam, however my sites are not to large, so that could change.

Then any address I want to send mail from I set up.

5
  • In general, it will change ;) That said, it's also useful for tracking who's sold your email address - if you start getting emails to [email protected] referring to someone other than ThisSite, you know that you won't be using them again :) Aug 10, 2010 at 0:58
  • 6
    Yeah, that was the way I used to handle it too, a catchall for the domain. It ended with thousands of emails a day with no value, as the spammers sent mails to every name in the dictionary: [email protected], [email protected], etc, etc, etc. There are a lot of possible email addresses as it turns out.
    – artlung
    Aug 10, 2010 at 1:12
  • First, if same email arrive to 3 or more addresses (and you're sole user of the domain), it shall be marked as spam. Second, I find Google spam filters very good, as I don't get any spam in my inbox despite have same catch-all policy (though there's thousands of mails per day in spam folder). Sep 10, 2014 at 14:10
  • By having a catch-all email account, not only will you see an increase in spam, the mailserver will also be put under a lot more stress.
    – MrWhite
    Aug 10, 2016 at 9:16
  • 2
    I used to help run an email hosting service, and catchall email addresses nearly took us offline at times due to the volume of spam they attract. I highly recommend against them. Jan 18, 2017 at 16:07
3

Sorry but going back to the [email protected], or [email protected], it is super critical to have one of two and register it with abuse.net.

Most feedback loops (when the SPAM button or junk button is hit) will send the data, similar to an email bounce log in a JMR (Microsoft) or ARF format to the address registered with Abuse.net.

WIth DMARC upon is registering is a good idea. You will notice that GSuite reserve abuse@ and postmaster@ for your domain making them a 'group' for access to, then you need to forward the data, I am not a fan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.