Bounce address protection for email

One of the more vexing problems with the lack of security in Internet email is ‘‘collateral spam’’: the backscatter of bounces from forged email that is sent to the forged address. The effect of this is for users to ignore bounces as just another kind of spam, and even for some email system administrators to disable bounces altogether. So as well as being a nuisance, it is making email less reliable. This paper will describe a technique for determining whether a bounce is in response to a legitimate message or if it is collateral spam. I’ll describe the difficulties which make the technique more complicated to implement and deploy, and my approach to a solution for Cambridge University. I’ll also describe how the technique can be extended to detecting the original forgeries as well as the backscatter.