Comment by dspillett | Hacker News Reader

Comment by dspillett | Hacker News Reader

Parent Full thread

This is why every company gets a different address for me. If junk starts coming in, that address is blocked, and I stop doing business with that company (if I haven't already).

This sometimes falls foul of spammers adding some random addresses of the form blahblah@mycatchall.domain.tld or <commonname>@mycatchall.domain.tld into their lists, but that hasn't happened often enough to be a problem. That it isn't much of a problem surprises me a little, given how much <commonname>@domain.tld (no sub-domain) addresses are used this way. I have considered trying the pattern somename@<sub-domain-per-company>.domain.tld as an alternative if that becomes a problem, but before implementing that I need to change my email setup (doing that anyway soon as running Zimbra's OSS version is going to get more difficult next year) and maybe my DNS server of choice (if wildcard MX records are an issue, I've not looked into that).

Sometimes I get funny looks for addresses like this, especially as I usually work the company/other name in there somewhere. I had one website refuse to accept an address based on their name, which was a rad flag and I backed away from going any further into dealing with that organisation.

You can just use [id]-[sha1 hmac]@domain.tld

The id could be anything, and the SHA1 HMAC takes 32 characters in base32 (which is an email-address-safe encoding). Then just configure your spamfilter to reject any address where the HMAC doesn’t check out.

Of course, the drawback is that you’ll need a computer to generate a new address… At which point you may as well store an explicit whitelist of valid addresses.

You can do that from a phone app though, or even a static webpage that loads on phones. It doesn't have to be 32 characters either, putting ~4 characters is probably secure enough, unless a ton of people start using this exact scheme.

This is a great idea, I might implement it. The difficult part is hooking the validation in the mail server I guess.

I typically do it with

<emanynapmoc>@mydomain.tld

Spelling the company's name backwards makes it easy to match to a company for use by my own spam filter without setting off their pattern detectors.

> If junk starts coming in, that address is blocked, and I stop doing business with that company (if I haven't already).

AND CALL them, if possible: “I’ve received marketing emails from your company recently, how is this possible, I’ve never signed up, yaddayadda… “

Generate some cost on their side.

Support calls will probably cost you more than the company unless you value your time very little - most companis don't post numbers answered by anyone paid highly enough for this to have an impact. Instead, call them out publicly or mail/call a someone in a leadership position if you can find contact information.

You don't have to use the company name in the email address, just use a unique email. If you start getting spam on a certain email address, search your email archives to see what company was associated with that address to link it back to them.

Reply on news.ycombinator.com