Which email addresses should I activate for a website? [duplicate]

Question

While checking the log files for a website (let's say http://example.com) I manage, I saw that there is lot of spam being addressed to email addresses like [email protected] or [email protected], which do not exist nor have ever existed, and are not listed anywhere on the website. Postfixblocks these emails with Recipient address rejected.

At the same time there are mails being send to [email protected]or [email protected], … e.g. mail addresses that would make sense somehow. Some of which might exist for the website while other might not, and even those that exist, might not be listed anywhere on the website.

Is there a list of default email addresses, like info, contact, admin, administrator, webmaster, that one should enable for each website?

I know I could enable a catch-all address, e.g. [email protected] to which all emails which are send to non-existing addresses are redirected. But I fear that this would result in spam in the inbox.

Basically: Which common addresses should I enable, which could be used for legitimate correspondence, while not gathering too much spam mails?

A client recently applied for an SSL-Certificate and in the application-form from the certificate provider it was stated, that during the process, they will try to contact the technical contact of the domain as well as send an email to some 'standard' addresses: ([email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected])

Answer 1

As a privacy/information security researcher, I disagree with the accepted answer's statement "No ... institution will try to legitimate communicate you to an email address that they will guess...". When we run scans and observe vulnerabilities or privacy violations present on a page, we want our research to result in a remediation, so we want to report our findings to webadmins. Depending on concrete researchers, we will try common email aliases (admin@, webmaster@, security@) and maybe automatically extracted contact from footer. For the protection of your users, we would be happy if you read them.

Of course these emails are sent by a bot, one cannot expect to manually navigate thousands of websites to collect emails. But to decide if an email is unsolicited, you should use a good spam filter.

Let me support this by several resources:

1. RFC 2142 specifies common aliases POSTMASTER@, WEBMASTER@, ABUSE@, and TROUBLE@. The RFC's purpose is to define exactly emails that you should monitor.
2. 1, 2, 3, and 4 all study how reachable are webadmins by these aliases.
3. Have I been pwned requires you to check email address at security@, hostmaster@, postmaster@, or webmaster@. if you want to check emailserver domain for leaks. There are other authorization methods, but this is the most convenient.

Finally, my personal choice would be webmaster@ (I prefer it over admin@ because of the RFC 2142) and security@ or privacy@ since these seem more specific and I would use them to address my issue.

Answer 2

There is not a common or default email address that you should create for your website.

Speaking of experience, I suggest to make any e-mail account you want and publish it to your e-mail account, preferably as an image in order not to being fetched by spam bots.

No service provider or company or institution will try to legitimate communicate you to an email address that they will guess that it might be your "common" email address or the general common email address for website owners (like webmaster@ or info@).

Whoever wants to legitimate contact you, he will first visit your website to find your contact details or even better contact you through your contact form. In other case, if someone tries to guess your email by typing the "common" ones, he will be probably a spammer (human or bot).

Concerning your question update

During the SSL Certification purchase process you will be asked to which of the above email address you mentioned, you want to receive verification email, and future ones concerning your SSL Certification status. You have also to declare the same email address during the CSR encrypted text generation on your server.

They will not just randomly send you an email to one of the "standard" email addresses you mentioned.

So make sure that you have created this email address before you declare it to the registration process. I mostly use [email protected] which in most cases is given as an option too during the SSL Certificate registration.