foo@bar.com is a real email address | Hacker News Reader

foo@bar.com is a real email address

bar.com

153 pointsacangiano91 comments

I thought this is basic knowledge of everyone technically engaged in Internet stuff. But apparently, this isn't the case, despite its well-known and very readable documentation! [1] It says:

1) There are exactly 3 domains the IANA keeps free for that purpose:

    example.com
    example.net
    example.org

2) In addition, all domains under the following 3 top level domains can be used freely for that purpose:

    *.test
    *.example
    *.invalid

3) The domains under the following top level domain have some special meaning (should point to loopback IPs only):

    *.localhost

Everything else is either registered, or might be registered by somebody in the future. Don't (mis)use those names unless you own them!

Unfortunately, this kind of criticism is not always welcome on HN. (for example, http://news.ycombinator.com/item?id=3129459 was scored -1)

[1] RFC 2606, http://tools.ietf.org/html/rfc2606

Along a similar line, there are two reserved IP prefixes for use in documentation and examples;

IPv4: 192.0.2.0/24 - as described in RFC3330, http://www.faqs.org/rfcs/rfc3330.html

IPv6: 2001:db8::/32 - as described in RFC3849, http://www.faqs.org/rfcs/rfc3849.html

*.local is a great example of why not to use a domain that just 'sounds good' as an internal dns suffix, as it is used by bonjour/avahi[1]

I had to rename an entire corporate network once because the previous folks thought .local "looked good". It cause constant issues with clients that had bonjour or avahi running.

[1]: http://en.wikipedia.org/wiki/.local

Wait, why doesnt apple just fix its software? .local isn't reserved. Seems like picking some arbitrary fix over another isn't helping matters.

Well, .local would be reserved if the mDNS draft, http://tools.ietf.org/html/draft-cheshire-dnsext-multicastdn... , ever progressed to an actual RFC. It is already a de-facto standard, with several implementations.

Because in 99.9999% of use cases it won't break.

That, and mDNS already being used as a psuedo-standard with things like Avahi.

Here's my hand up admitting I made that mistake back in the day. At least it was only our staging server cluster, and not an entire network...

So I've wondered this for a long time.

Where does email sent to wildcard@example.com go? If I accidentally sent sensitive information to wildcard@example.com would some evil person (potentially at the IANA) be able to retrieve it someday?

Posted to http://stackoverflow.com/questions/8221381/where-does-email-...

Currently: no. In the future: don't bet on it

Ironically, example.com/net/org were themselves taken over by IANA because they were the recipient of so much test email.

ETA: I am now starting to doubt my memory here, and Google's USENET archive search is broken. Sigh.

Is this documented somewhere?

I looked, but I can't figure out the right Google juice - example.com is, for obvious reasons, a pretty common search result on the web! USENET would be better, but Google Groups seems to not index words with periods in the middle; "example.com" returns only "example com" results.

It was common advice back in the day to use "example.invalid" and NOT kill some poor guy's server at example.com; I don't think .invalid was explicitly reserved before then, but it was known not to be a ccTLD or gTLD.

Thanks for the explanation and for pointing to RFC. I somehow managed to survive to this date without knowing any of this.

doh, test@test.com must be pissed.

the guy who owns test.com emailed me once because I wrote a paper on IIS vulnerabilities and had 'test.com' as example URL's. turns out a lot of people reading my paper would copy+paste the example exploits and own the test.com server (which just happen to be running IIS).

Man, this is really beautiful. Care to share more details? (I suppose all exploits are long patched now). It could be an interesting blog post...

it was actually server.com. I found the old doc, first time I have seen it since I wrote it 11+ years ago:

http://web.archive.org/web/20040210183242/http://black.wiret...

that server.com server was hilarious. it ended up becoming a mini-BBS with people posting funny messages, file names etc. to it. When I went to check it out to see what was going on, I ran a dir on the c drive, and there were almost 500 funny folder and file names there, with 'X WAS HERE' etc.

someone then put out a URL on IRC which would fire up a reverse shell. and that server.com server ended up running gaming servers, porn ftp sites, warez, the works. the guy emailed me around 2-3 months later asking for help to patch the box because it kept getting owned.

fun fact: I wrote a scanner in C back then that would check for these vulnerabilities. The scanner had two 0day vulnerabilities that weren't in this paper. one night at a friends house we were playing around with NXFR transfers from DNS servers (this is back when you could do them and before people figured out to lock this down). we started downloading lists of all the domain names from various TLD's. for eg we had .net, .org, .com etc. then we started downloading various countries, for eg. .at, .co,

we were talking to each other about what to do with them, and he said 'lets run one of these through your scanner'. so I made a quick change that would check the Server banner returned, and if it was IIS, it would then try these different exploits and run a command. we couldn't work out which command we wanted to run, so I had the idea of just creating a file called 'heh.txt' in C. I set it all up and ran it against all the Austrian domains. within a few seconds it was obvious that it was working too well - because it was churning through 5-10 hosts per second and a lot of them were 'SUCCESS'. I left it running, no idea when it finished, but when I picked it back up again the next day around 40% or servers (may have been more) were running IIS and of those, around 98% had our 'heh' command run successfully.

tl;dr hacked ~40% of all servers in austria. if you ever found a file called 'heh.txt' in the root of your C drive, that was me.

example.com is too long. That's why everyone uses foo@bar.com or something shorter.

Although this argument about shortness doesn't make any sense to me, what about foo@b.test which conforms to the standard and is even shorter?

.test, not being widely used, is not immediately recognizable as a TLD the way .com is.

"too long"? Are you joking?

Anyone when educated about the proper use that says that is just spouting BS.

Do it right or don't do it all.

    This page is a memorial to Foo at Bar.com

    Back in the earliest of early days, I (The Foo at bar.com) got a few emails a week, mostly from sysadmin type people who were invoking The Foo in an effort to debug some kind of system or other.

    Of course I, being a gregarious sort, answered the messages.  Mostly along the lines of "hello?  Foo here.  What can I do for you?Ó or "who you?  I Foo.Ó

    I met a lot of really interesting people in 1994 and 1995 that way.

    But soon I had to return to obscurity, as my email volume grew overwhelming.

    Y'see people building web sites started putting little "give us your email address and we'll let you see the goodies" challenges in their web sites, and lots of folks entered foo@bar.com.

    Soon, I was getting thousands, then tens of thousands of emails a day, mostly from people who didn't care whether I replied or not.   Alas, I was overwhelmed and had to return to my solitary life.

    For a while, I MX'd email addressed to me to 127.0.0.1 but that made some people cranky (although I still take some quiet pleasure at the thought of what that address did to spammers).

    I MX'd the mail over to a friend's spam-detection server for about 4 hours one time, but the volume crashed his server and he asked for relief.

    So now I'm content to tell you this small story.

    Onward,

    The Foo

That is so true... Most developers who get an account with Mailgun (http://mailgun.net) get so excited about the live email log or for some other reason... they love to fire up emails to @test.com. We have thousands of emails in our queue destined for test.com at any given moment.

Guys, please stop: what makes you think test.com can't be a real destination? :-) Actually, they don't have a mail server for that domain, but still...

Ironically, I just came across some potentially real email addresses in the Mailgun docs and sample code, i.e.:

http://cl.ly/1L1C0O2A081x000t382z

You might want to edit those.

We own profista.com and use it for testing ourselves. Using it in the docs helps us see how many people are trying out the samples.

I wish all our users would read the docs as carefully as you do! :)

Would love to read a post about how you measure sample engagement through this and other cleverness!

Some should setup a MX on test.com and:

* post a public webpage with all email going to @test.com

* post a public webpage with all email addresses harvested from emails to @test.com

* setup an auto responder asking people to stop sending there (bonus points: threaten to post emails of repeat offenders to spammer lists)

See also donotreply.com:

http://blog.washingtonpost.com/securityfix/2008/03/they_told...

Whenever you think the solution is to "setup an auto responder".... don't.

You should probably set the example by avoid using "@farfaraway.uk" in your blog posts. It's invalid right now, but that could change too... ;-)

Acme Labs has much the same problem. Jef's (2005) article about handling his mail is still a good read (though a bit dated now) http://acme.com/mail_filtering/

I agree, test.com is an awful domain to use.

Whenever I fire up email testing tools, I use president@whitehouse.gov.

do you notice a lot of vans in your parking lot?

First we spammed them, and now we appear to be DDoSing them.

See it boggles my mind how a site cannot survive a front page HN appearance. TideArt has been on the front page a number of times, sometimes even second top link, and I happen to know this brings around 10,000 more hits. Using my own custom CMS, built on SQLite, I handle that kind of traffic easily on a shared host.

HN will never bring you more than a few hits per second at the most..

Reminds me of: http://test.com/contact/contact_spam.htm

I dread to think how many emails they get everyday.

As a side note, looks like they copied HN's favicon.

The favicon issue is actually a Chrome bug. Sites that don't provide a favicon will sometimes end up with the favicon of the referrer.

It's not identical, just looks like the same orange with a single white letter in the middle, only noticed when clicking between the two just how similar they were.

Wasn't aware of the Chrome bug though, thanks.

At the same time they likely have a couple of extra inbound links. :D

They should just use Postini and let Google handle it. Really impressive service that.

A related topic that drives me nuts after years of operations is the fairly widespread use of '.int' to represent private DNS on an internal network. '.int' is a rarely used TLD for international organizations created by treaty. It is so rare that many browsers do not recognize it as such and will ship you off to a search for 'www.nato.int', for example. Nonetheless, it drives me batty whenever I see 'dns1.int'.

Worse yet, some internal networks use .local, despite its standard use for mDNS.

I truly feel sorry for the poor guy that owns asdf@asdf.com. I must have registered for over a hundred different accounts on various Interweb forums using his email address...

He mentions that his real email is jklsemicolon@asdf.com. Which is just as funny, and not as prone to cheap viagra offers, presumably.

If you really need to receive a test email, you can always use @mailinator.com (just make sure it's not sensitive info). Mailinator is a disposable, publicly viewable email address mostly useful for one-time account registrations, especially in cases where you fear they might spam you.

In recent years, I started using the + notation at gmail -- anything you put after the + and before the @ is ignored by gmail, BUT you still receive it -- the handy part is you can filter it out (e.g. myname+hackernews@gmail.com will go to myname@gmail.com, and I create a filter to archive everything that comes to myname+hackernews@gmail.com)

I prefer to have my own domain, I just use nameofthesite@example.com, and set it up to catch-all.

The "+" trick is great, except for sites that use hair-brained email "validation" scripts which reject the address. Sadly enough, these are often the ones that I most want to use the "+" for (its a great way to also keep track of who hands out your email address to spammers).

I have the solution for you there:

If your email is mylittlepony@gmail.com

Then your can use as many '.' and filter it out.

You will also receive emails sendt too my.little.pony@gmail.com

M.y.l.i.t.t.l.e.p.o.n.y@gmail.com

Gmail ignores punktum. Thats smart!

Huh. I didn't know about the punctuation marks. That IS smart. Thanks!

I used to work for a company that hosted customer.com. Microsoft, on more than one occasion, sent thousands and thousands of emails to customer@customer.com.

One developer probably entered customer@customer.com in a database, and then another guy probably accidentally triggered the "email everybody in the database" script. I can see how that would happen. I've obviously never personally done anything like that but I know a guy who tripped the "Send sales report to CFO" using test data once when I was an intern.

http://bar.com.nyud.net:8080/ should bring up the coral cache, if/when anyone can actually get through to the origin URI.

Interesting that this guy could write a quick script that could take out almost any mail server on the web for more or less free.

I imagine only a few of the big guys (yahoo, microsoft, google) could handle large unexpected volumes without hiccup.

As is jklsemicolon@asdf.com: http://www.asdf.com/asdfemail.html

I'd think you'd have to expect this when you set up that email account.

(Also, it wasn't enough to spam them, now we DDoS them)

yeah, but it looks like he set it up waaaaaaaaaaaay back (like before the eternal September) solely in order to get a rise out of emailing people back. Then the internet blew up and broke his email.

I have a domain which is much the same, though I don't get nearly the volume bar.com does. And, I now feel guilty for having used foo@bar.com a few times in the past. Mea culpa!

same here at asdas.net

I can only imagine the volume this guy gets - I have user24@gmail.com and I get about an email a week signing me up for something or other. It's very annoying.

So if anyone's reading this: Please stop using random gmail accounts and use foo@bar.com instead. Thanks!

* just kidding, test@example.com would be the one to go for ;)

My usual address for this kind of thing is john@doe.com. I've always wondered who would get those emails...

Some folks registered asdf.com, and had a similar experience. I wish they posted their inbox for all to see.

(http://asdf.com/asdfemail.html)

Work proxy killed the page, with "Block Access\Standard Users\Blocked URLs\Block - Harmful & Stealth".

The thing is an overly sensitive, badly configured setup; but still troublesome?

Haha, that's why I always use a dummy email addy at our own domain and make sure all unrouted mail bounces.

How much do you think Bar.com is worth? Seems like a domain that'd sell for a pretty penny.

since the site is dos'd: http://web.archive.org/web/20110707211652/http://bar.com/

bar.com seems inaccessible. Can someone who saw the site in the past few hours confirm that http://web.archive.org/web/20110707211652/http://bar.com/ is up to date?

The whois for the domain is accurate.

Yes but I still can't access the site ...

I frequently use aa@aa.aa - last time I checked, there were no countries using .aa

To you and everyone using things != .+@example.com: why? Example.(com|net|org) were specifically created for this purpose and for the purpose of tutorials. I work in client-facing support, and it's very easy to troubleshoot software that /other people/ write when the client says something along the lines of "It says 'connection to example.com:25 failed'" -- I instantly know what the problem is. If you're using things other than example.(com|net|org) for this, you're possibly making the job of a support tech you'll never meet harder.

If your excuse is "I didn't know about example.com!"...well, that's a lame non-excuse. Do the rest of the IT world a favor and fix your tutorials and software -- mail server administrators like me already have enough headaches from the gazillions of spam techniques in use today.

>well, that's a lame non-excuse.

Ignorance is a legitimate excuse. I'm getting sick of people spreading this moronic misunderstanding that ignorance is not an excuse. Just recently the police in NYC failed to follow a judge's order out of ignorance. I wonder what excuse they used.

As for why people don't use example.com, if you're signing up for a site that annoyingly makes you put in a password it will check for non-real email addresses so example.com is out.

Not related but bar.com being a wordpress blog is surprising.

So is sp@rtacus.com

For future reference, the example.com domain is maintained for the purpose of documentation, etc.

Thus foo@example.com might be a better address to use, especially in examples.

.com, .net, and .org are all reserved for this purpose.

Just to add a source, it's all in RFC 2606 section 3: http://tools.ietf.org/rfc/rfc2606.txt

We get a lot of crap email address signups at http://feefighters.com We do a little bit of filtering to check that the email address is legit, but let you get by anyway (with an additional click) if it isn't... we have a 1-click unsubscribe but this is making me rethink whether we should let fake email addresses through at all.

We recently got this email from Fake.com

Hello

We own the domain fake.com, and from time to time some moron out there in the world-wide-waste-of-time uses our name to try and sign up for something...

Not just that, there’s also a whole slew of dozy IT people who test links by doing the same thing without doing a whois check first!

Whichever it is, could you please delete this account?

Thanks [redacted]

fake landscapes - the artificial plant company http://www.fake.com*

Somehow I don't think this has the desired effect... that's a tough domain name for this sort of thing, feel sorry for the guy but not much we can do.

The only reason they'd notice & care is because they received email they didn't want, right?
I assume you have an obvious 1-click subscribe on all of your emails? If not, I'd gladly mark you as spam over, and over, and over...

They must be using a catch-all address otherwise most emails wouldn't exist and bounce without much notice.

> this is making me rethink whether we should let fake email addresses through at all.
How do you tell fake from real?
What if someone who works at fake.com wants an account?

I've never been a fan of foo and bar as example names. Particularly in code examples, I can never keep them straight because the names are meaningless.
Anyway, we already have example.com for this purpose.

To be fair, their meaningless is their value. Using "real world" names may distract from the logic being discussed or unreasonably suggest that the logic may fit only a particular scenario.
http://en.wikipedia.org/wiki/Metasyntactic_variable

Perhaps reading RFC 3092 - Etymology of "Foo"[1] might be helpful.
Personally, I was familiar with the acronym FUBAR first, so it comes as natural to me as most mainstream, American acronyms.
[1]http://www.faqs.org/rfcs/rfc3092.html

I now feel really really bad for fuck@off.com. I owe someone an apology...

You're fine, off.com doesn't have MX records.

Except some people fall back to the A record (see RFC 5321).

Can you please let me know where you're seeing this? I looked through http://tools.ietf.org/html/rfc5321 for /\sa\s/i and /(fall(\s)?back)/i and didn't find anything related to this this behaviour. I ask because I'd like to have my answer at http://stackoverflow.com/questions/8221381/where-does-email-... be as accurate as possible (plus I'm now curious about this).
Thanks!

it's not a fallback, it's the default behavior. originally when you would send mail to a user at a host, the MTA would just connect to that host on port 25. the original SMTP RFC (821) pre-dates any DNS RFCs, so originally there wasn't even a concept of MX records and you just e-mailed someone at the server they had an account on.
after DNS was in place, MX records came along in order to route mail destined for a host to a different server, or just supply a list of backup servers. now since most people just use email addresses containing only a domain, MX records are pretty much common place (since the A record of many domains resolves to the web server). now MTAs check for MX records before trying to connect directly to the host.
to demonstrate:
jcs@thalamus:~> host -t mx test.jcs.org test.jcs.org has no MX record jcs@thalamus:~> host test.jcs.org test.jcs.org has address 10.10.10.10 jcs@thalamus:~> echo test | mail test@test.jcs.org
and shortly after, in postfix's mail log:
Nov 21 22:59:18 thalamus postfix/smtp[23742]: connect to test.jcs.org[10.10.10.10]:25: Operation timed out

That fuckers getting a lot of emails!

fucker's (fucker is)

Reply on news.ycombinator.com