65

A long time ago one used to be able to count on domains having addresses like webmaster@example.com, postmaster@example.com, or abuse@example.com ... is this convention dead?

Note: I always try to make sure to make a contact available on the websites I put up, so people can contact us if necessary. But are there reasons to handle these or other "standard" email addresses I might not be thinking of? I set up less email addresses than I used to since spam got so awful, and a "predictable" email address just seems to be an invitation to the lousy spammers.

46

There's no reason to create them all as individual e-mail accounts. You can just set up forwarders that lead to a generic site.admin@ account and set up a filter for that in your mail client to keep the noise isolated.

You'll want them, because:

  • webmaster@ is where good natured people do things like report broken links, it happens more than you'd think!
  • abuse@ is nice to have, it sometimes keeps people from going directly to your host / data center / bandwidth provider in the event that someone found a way to use your server to send SPAM.
  • postmaster@ is handy to check, and make sure root's mail is also sent there, at the least it will show you if your mail server is configured incorrectly, it will also catch bounces that let you know you have a spammer.

I usually check my 'catch all' once a week and clean it out. It only takes a few minutes. Once in a while you find a real gem, which is something like "Your site helped me, I just wanted to say thanks for the resource!" .. which always makes your day :)

This, of course in addition to the convenience of automatically generated SSL certificates - SSL providers will send confirmation email to one of the above addresses, so you need to be able to receive it.

  • Yes, you can and should use aliases where that makes sense. Yes, there are well-known addresses Certificate Authorities will use. But the real answer is to refer to RFC 2142, as M Dudley said in a comment above. That says what are the well-known addresses. – Concrete Gannet Sep 17 '15 at 4:40
  • Can you clarify the bit about the aliases? Do you mean you create one admin@ account, and then give out contact@ and say contact2@ which forward to admin@? I tried forwarding non-existent addresses to the main email address, but that did not work. Or do you mean set up a catchall and have all emails forward to admin@? Thanks – pushkin Jul 18 '18 at 2:14
  • Can you elaborate on the SSL certificates? Are you referring to self-signed certificates or something else. I don't understand how email is involved. Cheers. – devios1 Aug 27 '18 at 16:21
18

Every RIPE LIR (Réseaux IP Européens Local Internet Registry) must have an abuse@ account and based on the RFC 2141 the webmaster@ (http), postmaster@ (smtp) or hostmaster@ (dns) addresses are used by most (all?) Providers.

So if you don't want to be an LIR and don't use certificates, you are mostly free to set your mail addresses any way you want.

7

If you plan on purchasing a domain-validated SSL, admin@ is generally a good one to have, as the domain-validated certificates use a small list of hard-coded email addresses, and admin@ is generally one of them.

5

I have mine set up so that anythingIwanttotype@example.com gets sent to me. This takes care of possibly missing anything.

So far I have not gotten much spam, however my sites are not to large, so that could change.

Then any address I want to send mail from I set up.

  • In general, it will change ;) That said, it's also useful for tracking who's sold your email address - if you start getting emails to ThisSite@example.com referring to someone other than ThisSite, you know that you won't be using them again :) – Zhaph - Ben Duguid Aug 10 '10 at 0:58
  • 6
    Yeah, that was the way I used to handle it too, a catchall for the domain. It ended with thousands of emails a day with no value, as the spammers sent mails to every name in the dictionary: aaron@example.com, alex@example.com, etc, etc, etc. There are a lot of possible email addresses as it turns out. – artlung Aug 10 '10 at 1:12
  • First, if same email arrive to 3 or more addresses (and you're sole user of the domain), it shall be marked as spam. Second, I find Google spam filters very good, as I don't get any spam in my inbox despite have same catch-all policy (though there's thousands of mails per day in spam folder). – LogicDaemon Sep 10 '14 at 14:10
  • By having a catch-all email account, not only will you see an increase in spam, the mailserver will also be put under a lot more stress. – MrWhite Aug 10 '16 at 9:16
  • 1
    I used to help run an email hosting service, and catchall email addresses nearly took us offline at times due to the volume of spam they attract. I highly recommend against them. – Mark Stosberg Jan 18 '17 at 16:07
2

Sorry but going back to the postmaster@example.com, or abuse@example.com, it is super critical to have one of two and register it with abuse.net.

Most feedback loops (when the SPAM button or junk button is hit) will send the data, similar to an email bounce log in a JMR (Microsoft) or ARF format to the address registered with Abuse.net.

WIth DMARC upon is registering is a good idea. You will notice that GSuite reserve abuse@ and postmaster@ for your domain making them a 'group' for access to, then you need to forward the data, I am not a fan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.