Really though, your best option is to stop using your domain as a catch-all email address and just use a single, specific email address.

Although it is a bit urgent, I like the new design. It’s certainly very clear and still not white. I talk, of course, as someone who has only recently abandoned purple.

First, kill the wildcard email delivery, and drop all mail sent to any address which does not match some criteria, either “contains my normal email prefix” or “contains a magic word I designate”. That should reduce your volume.

Second, do go ahead and report backscatter generators, both to postmaster@thedomain and more importantly *to their ISP as contributors to the spam problem*. This does in fact work, even with large ISPs.

Finally, if you feel like writing some code to solve the problem: find some way to keep a record of all mail servers yours contacted in the last X days, and drop bounces that do not come from one of those mail servers.

I’m not sure if it is all applicable to GMAIL, and a lot depends on how many, and which ways you send email.

Ultimately if the computer is to reliably distinguish between bounces of what you sent, and bounces of forged email, it needs a way to establish the difference. SPF fails because it relies on everyone else to implement it, and that won’t happen because it breaks forwarding.

Wietse has the poor man’s solution, one can make a similar approach cryptographically secure in a similar fashion to DKIM.

On a more practical note, I suspect spammers preferentially use domains with catch-alls as senders, since then any call-back sender checks will succeed. As such - step 1 - lose the catch all and use the “-” or “+” extension (whichever Gmail accepts) to vary the email address you hand out.

There are also some tips on rejecting backscatter with Exim here but I guess you’re not running Exim (included here in case someone else with the same problem is), however some of the rules on the same page will mean you hardly get any mail at all, so exercise caution.

The hard and fast rule here is that the people bouncing shit back your way are as much part of the problem as the spammers are. You should always reject mail at SMTP time where possible, not accept the mail and then bounce it.

Just don’t use catchalls. Set up all your addresses manually. It’s painful if you’ve been using a catchall for years but the end result is that you get sooo much less spam and bouncebacks from crap you didn’t send. For new domains, just say no to catchalls from the beginning.