What is Backscatter?

Backscatter, as it relates to email, is spam that contains a forged Sender field, causing the rejected mail to “return” to an innocent person that was not the true source of the spam. Those “non-deliverable mail” notices in your mailbox that were not sent by you in the first place are backscatter from spammers using your email address illegally.

Spammers know that most mail servers will not route mail without a valid sender field. Once spam became illegal, spammers stopped using their own addresses and began forging other, valid addresses. Spammers can get valid email addresses using any number of means, including software bots that scan the Web looking for email addresses on Web pages. Spamming software can also generate addresses by assigning common names to established Internet Service Providers (ISPs), and mailing lists are yet another source.

Once your email address appears on a spammer’s list, spam will be generated with your address as the sender. Spam that doesn’t make it to a valid recipient or is rejected for another reason is returned as undeliverable, to you, as backscatter.

The rule of thumb in receiving spam is to not reply to it, even to say, “Please take me off your list!” It won’t do any good anyway, since the “sender” is forged. You’ll only end up sending mail to people who are victims themselves, worsening the problem.

If inclined, you can report spam to your favorite service, such as the Federal Trade Commission (US), Spamcop, or others. These services endeavor to track down the true origin of spam. If you choose to report spam read the site’s instructions first, as certain information is required to track the email, including email headers.

The best defense for the end-user in dealing with backscatter is to use a good, intelligent spam blocker that will clean backscatter from your inbox before you see it. The best programs use Bayesian filtering to actively “learn” which mail you want, and which mail you don’t. By initially training the filter, it soon begins filtering without requiring your input, drastically reducing the amount of spam that reaches your inbox. After a period of a few months, a good spam filter should require very little input.

If your email program does not have a built-in Bayesian filter, try a free Bayesian filter such as PopFile, SpamBayes, or K9. These and other third-party programs will work with any email client.

If you own one or more domains, configure the mail servers to not use the catch-all option. This will cause the server to reject all mail that is not addressed to a real address on the domain. With the “catch-all” option enabled, all mail sent to [anyone]@yourdomain.com will get through as a “valid” email address, potentially generating ever-growing volumes of backscatter.