Tracking spam origination using qmail and vpopmail

One of the challenges on the web at the moment is that many sites want you to register a “free” userid just to do the most mundane thing (such as downloading a file, viewing a picture, etc). While I don’t have a problem with that requirement in general, I am often quite sceptical about what they plan to do with my userid.

There is a common technique that many people use where they create a site-specific version of their email address (I believed it is often called “plussed email addressing”). For example, let’s say that my actual address is edwardaux@mydomain.com and I wanted to signup to flickr, I could
create an email address called edwardaux-flickr@mydomain.com and use that (and tell my mail server to forward all email to that address to my real edwardaux@mydomain.com address). The nice thing about this is that if flickr is naughty (not that I am suggesting they are) and sells/gives my email address to spammers, I can immediately determine that by looking at who the email was addressed to.

The problem with this approach is that I have to go into my mail server ahead of time and manually create each site-specific email address. That is a bit of a hassle, and I am sure that I can get away with a simpler approach.

So, given that I am using a combination of qmail and vpopmal to manage my mail server, how might I configure them to do what I want?

Looking at the qmail documentation, I see that the suggested mechanism is to manipulate a file called /home/edwardaux/.qmail-xxx, where xxx is the site-specific alias I want. For example, .qmail-flickr would match any email coming to edwardaux-flickr@mydomain.com. However, this still means that I have to manually create explicit files for every site I want to sign up to. There is another special variant of this file called .qmail-default, which is the catch-all for all addresses that don’t have a specific .qmail-xxx that matches the incoming mail. It looks like this is the guy I want because it should mean I don’t have to keep creating explicit files.

However, as I am using vpopmail to manage multiple domains, the default .qmail-default file location will not work because qmail doesn’t deliver the mail directly to my /home/edwardaux mailbox. Instead, it hands all mail to vpopmail who then decides which virtual domain and virtual user to deliver it to. So, looking at the vpopmail configuration files, I found one called /home/vpopmail/domains/mydomain.com/.qmail-default. This is the catch-all configuration file for all mail delivered to the mydomain.com virtual domain.

vpopmail supports a subtle variation on this file that incorporates the user’s email address. I created a file called: /home/vpopmail/domains/mydomain.com/.qmail-edwardaux-default and added the following:

| /home/vpopmail/bin/vdelivermail ” edwardaux@mydomain.com

Note that the above line contains two single quotes (‘), not a double-quote (“)

What this does is forward all mail that is addressed to edwardaux-anything@mydomain.com to edwardaux@mydomain.com. A quick restart of qmail (/var/qmail/bin/qmailctl restart) and I was set to go. So, now I can dynamically make up as many combinations of edwardaux-xxx@mydomain.com as I like without having to create individual .qmail-xxx files ahead of time.

One thing that you need to be conscious of, though, is that now if spammers send mail to edwardaux-aaa@mydomain.com, edwardaux-bbb@mydomain.com, edwardaux-ccc@mydomain.com, then all that will come through to my inbox, whereas it used to just get thrown away. I think I can live with that, though.

Enjoy!