kmail: Mail: Caveat on Bouncing Msg to Sender

OS X Mail: Caveat on Bouncing Msg to Sender

Bouncing unwanted email back to the sender is a great way to fool spammers into thinking that your email address no longer exists. When you bounce a message, the sender will receive an email notification with the following wording:

<your email address>... User unknown. Message could not be sent.

There is just one issue to be careful about, and it applies to you if you have more than one email address. Suppose you have a "private" address that you use for family & trusted sources (such as jsmith@privatemail.com). This is your main email address that you set up with your ISP.

Suppose you also have a "public" address that you use when posting on the internet to such things as chat rooms, newsgroups, etc. (Let's call it joe@publicmail.com). This is the address that gets all the spam.

When you get spam or an unwanted message in this account and you bounce it back to the sender, you want your message to say "joe@publicmail.com is an unknown user/address."

However, this will ONLY work if your actual email address (joe@publicmail.com) appears in the "TO" field or the "CC" field of the message. Many spammers hide the recipients' addresses and fill the "TO" field with useless text (such as "to undisclosed recipients," etc.).

If you bounce a message like this, your ISP's mail server won't know from which address the bounce request is coming, so it will end up disclosing your main email address (the one you set up with your ISP) to the sender. In this example, that was your PRIVATE email address, so the sender will get a notice like this: "jsmith@privatemail.com is an unknown user/address."

This might tip off a spammer that the address "jsmith@privatemail.com" is a valid one. How? Because the spammer did not even send a message to that address, yet he/she is getting a notification about it.

Granted, the risk may be small. The spammer might not have the resources to notice the discrepancy; also, many spammers forge or change their own addresses constantly so they may not even get the bounce message. But if you want to stay on the safe side, make sure that the email address that you want the sender to think is invalid actually appears in the "TO" or "CC" of the message you were sent.

P.S. If your email address is not in the message, don't reply to the sender. This will only tell him/her that your address is active and valid. Instead, just delete the offending email.