My website's support email address is starting to get a lot of spam emails to it, what do big companies do about this?
3 Answers
Various enterprise-level email systems have built in spam filters, things like Google Apps, MS Exchange etc. If you're hosting your own email, you'll have to setup your server with some sort of third-party spam/blacklist software, this will be a bit more complicated and will warrant some further research.
-
And just to add further (since I was surprised by this), a third party could either be software you install on your server, or a service you use else where (EG, all emails are routed via another domain first which does the checking/spam removal/virus removal etc before dumping it back to your sever)– DaveJul 19, 2012 at 15:10
You can try to obscure the support email address by avoiding common terms like staff@ and support@ while using some variation that is easy to tell customers. This foils low-level spammers that just constantly hit those common addresses on every domain.
You can also try to further obscure the email address by using a form that submits mail to the address without actually displaying the address on the website. This also has the benefit of allowing you to encourage/force customers to submit specific information in their request that may help you assist them, although you may also think it more helpful to have a publicly viewable support address.
If you use a ticket system that pulls messages to an email address into a database, you may have the option to ban/ignore emails from addresses that repeatedly send spam. To catch spam at the source, however, you need some kind of filtering system.
There is no easy way to resolve this issue.
I stopped using email all together. I prefer to have all contact done using a main "contact" form on my site. Using emails addresses became extremely frustrating. On the contact form I include a drop down box that includes different departments so users can select where the email should go like "support", "billing", and "sales" so the message is routed to the correct people.
To prevent spam from being submitted I use something like reCaptcha. I have had problems with people creating accounts manually and spamming forums on our site but the captcha prevents the bots from sending mail through the contact page. There are debates about reCaptcha being cracked but it has worked for us.
Another trick that people use on contact forms is to have a hidden form fields. When bots submit forms they have a tendency to check every box and fill text fields with garbage. If a hidden field has any data in it the message is rejected.
-
1
-
1@KennyEvitt Be aware that the hidden (with CSS) field trick can trap legitimate users who use their browsers (or browser extension) auto-form complete feature. The auto-complete feature behaves like a bot.– MrWhiteJul 20, 2012 at 12:49
-
@w3d – don't auto-complete (autofill?) features fill-in fields based on the
nameattribute? If so, it should be easy enough to avoid trapping legitimate users by naming the field appropriately. Jul 20, 2012 at 14:17 -
1@KennyEvitt You can certainly minimise the chance of trapping a legitimate user by using a more obscure name, but in using a more obscure name you are less likely to trap a bad bot - since they only have to be using the same algorithms/naming conventions that legitimate autofill scripts use. Contrary to what fry.pan states in his answer, much of the bot-filled form spam I see is not garbage, but intelligently filled forms with valid-looking names, phone numbers, emails, etc. Garbage tends to get filtered out with first stage validation checks.– MrWhiteJul 20, 2012 at 23:14
-
2@KennyEvitt I'm not saying that the hidden field trick is a bad idea; it's a great idea and is indeed ingenious. I use it. I just don't think you can be 100% sure that it is always a bot that completes your hidden field. Hence the "beware" message. If the hidden field check fails then perhaps you could ask a further "human check"/captcha type question to be sure.– MrWhiteJul 20, 2012 at 23:23