2

I run a website which needs to send the following emails:

  • Sign-up email confirmation (required for access)
  • Forgot password requests
  • Change email address requests
  • 2-factor enrollment requests
  • Payment receipts

Previously, I simply had exim4 installed on the VPS and was sending email directly from there. However, in recent times, those emails were getting rejected by several large email providers (Microsoft and Yahoo) due to spam coming from adjacent IP address space.

Since I use Fastmail for the human emails originating from that domain, I configured the web application to use Fastmail SMTP credentials for sending those emails using my account there. That's been working great, until today, when I received an abuse report from Fastmail. They tell me that people have been marking the "Welcome to [website], please confirm your email address" as spam, and that I am not (no longer?) allowed to send automated email using their service.

So how does a small and low-budget website send (very small quantities of) email these days?

1 Answer 1

1

Are you sure that Fastmail said it was in relation to sign up emails? It is very unusual that they would have any visibility of this, letalone reported it back to you. It is far more likely that there is a vulnerability in your application someone is exploiting. You should be logging details of every email your application sends (if not then please do so). Go start analysing those logs and checking for vulnerabilties.

Your app should be monitoring your signup process for signs of abuse - applying automatic bans to IP addresses which attempt multiple registrations in a short time window.

4
  • I'm sure - Fastmail's notice to me included a "list" of subject lines, which had as its only entry the subject of my "please confirm your email address" emails.
    – Mala
    Oct 5, 2022 at 21:41
  • More to your point though, it looks like you're right, i have a bot hitting my registration page sigh. Thanks.
    – Mala
    Oct 5, 2022 at 22:16
  • 1
    Use a CAPTCHA on your registration page to frustrate BOTS. Maybe also something to limit registrations per IP in a given period and a Honeypot.
    – davidgo
    Oct 6, 2022 at 8:47
  • For now it's honeypotted, I can recognize the attack traffic and am basically just showing success and then not sending the email / actually performing the registration. IP monitoring isn't going to help here, sadly: over the last week i've seen 225 bot registrations, and haven't seen the same IP more than 4 times. CAPTCHA it is :|
    – Mala
    Oct 6, 2022 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.