So, you log into your email Monday morning and there’s 500+ Non-Delivery Reports for emails you haven’t sent. What’s going on. Has your account been hacked? Unlikely. The more likely reason is that you’re a victim of Backscatter.

What is it? In brief, backscatter is the influx of Non Delivery Reports (or NDR’s) into a victim’s Mail Server (or MTA).

What is an NDR?

Mail Transfer Agents support a service called Delivery Status Notification (DSN) which allows end users to be notified of  the status of an email, such as the successful or failed delivery of email messages.

A non-delivery report is a status message sent by the recipient or interim email server that informs the sender of a email message delivery failure. There are several issues that can trigger an NDR, the most common are when the recipient of the message does not exist or when the destination mailbox is full.

Smarter Spamming?

Email servers offer a simple measure against SPAM by only accepting emails that have a valid source domain.

i.e. The domain exists.

Spammers are aware of this and have a simple way of bypassing this check which is to mimic email addresses from a valid domain.

Spammers use several methods for harvesting email addresses from the web. One method is the use of “Web Spiders”. Spiders crawl the Internet and web sites for email addresses that can be added to a database to be both a recipient, and used as a valid email address for sending spam.

From SPAM to Backscatter

So now you’re in the database, you’re likely to be targeted for the receipt of SPAM, and unfortunately it’s likely that a Spammer is going to use your email address at some point to send a batch of SPAM emails.

Even though you’re not the true source of the emails, you are the legitimate owner of the “Senders” address. As such any Non-Delivery Report is going to be returned to you.

So depending on the frequency of abuse, or indeed the size of the attack, you could potentially about to receive thousands of Non-Delivery Reports thanks to a spammer.

Can it be stopped?

Unfortunately it is easy to mimic someones email address, however there are measures to firstly prevent you being the source of such a violation, and secondly reduce or prevent the influx of backscatter.

The “Sender Policy Framework” or SPF have introduced additional DNS Records (SPF Records) that allow you to specify who is allowed to send email from your domain (Mail Servers). This way, if an email is received by a mail server from a source other than defined in your SPF record, the connection will be dropped and the email will not be processed.

Note: Googlemail, Hotmail and Microsoft are already implementing policies whereby if an SPF record does not exist, your email may be rejected.

Other options include disabling all catchall or wild-card mailboxes. When this feature is disabled the spammer has to match your exact email address and not your domain, so your mail server will not be accepting non-delivery reports for email addresses which do not exist on your mail server.

It is also recommended that you configure your mail server to reject during SMTP transmission rather than bounce email messages which cannot be delivered. Email servers such as Microsoft Exchange, Postfix, Sendmail and Qmail have patches to improve the behavior to create less backscatter.

A better solution

Using an external host to relay and filter your inbound email can prevent the receipt of SPAM and Backscatter, as well as reduce the loads generated by SPAM on your local mail servers.

Be low are a few more resources to give a little more information on the subject.

The Backlash!

The source of a Backscatter attack is no the SPAMMER, but it is the servers that are not configured to reject emails for invalid email addresses. These servers, although they’re the victim of an actual SPAM attack are now being listed on a UCE Blacklist (http://www.backscatterer.org/), which in turn gets your outbound email rejected due to your server being listed on a Black List.

As you can see, it is important to configure your email and DNS services correctly to ensure your neither the subject of a backscatter storm, nor listed unknowingly in a Blacklist.

Other Resources

Open SPF – http://www.openspf.org/
SPF Record Creator – http://old.openspf.org/wizard.html
Microsoft Sender ID Framework - http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/
Reducing Backscatter on Exchange – http://www.avianwaves.com/Blog/default.aspx?id=31