www.earthlink.net myEarthLink myVoice My Account Support webmail.earthlink.net

« Ask Email Guy     |   Back to MAIN   |     Can't type anything into a new message or reply »

Why is the Blocked Sender List limited to 500? - 11/01/06

From: Email Guy
Subject:       Why is the Blocked Sender List limited to 500?
Date: November 1, 2006 10:28 PM
Permalink   |   Post Comment

Users often try adding every spam sender to their Blocked Sender List and quickly run into the 500 address limit. Then they ask why they can't add more. There are two reasons, but the main one is that we haven't done a good enough job of educating users about the purpose of the Blocked Sender List, and what it can and can't do for them.

Adding every individual sender of a spam message to your Blocked Sender List is a losing battle and will never be successful at controlling spam. The majority of spam has random From addresses and made-up domains, and the return address is almost always bogus. A lot of the worst fraudsters will actually use harvested "real" addresses for their From address, that go back to some unsuspecting user. So adding these bogus addresses to the Blocked Sender List is unlikely to block any subsequent spam. You will run through 500 one-time throwaway addresses in a very short time, and your list will be full but won't be doing anything to control spam.

There are however, "honest" spammers (relatively speaking) that do use real addresses, and these are usually marketing companies or web sites that have you on their mailing list and don't make it easy for you to get off their list. Or perhaps they bought your email address in a bulk mailing list and never really had your permission to send solicitations to you. These are the kind of senders that you can effectively stop by using the Block List. They use a real return address, they have a legitimate web site, but you just don't want to be on their mailing list anymore. For this reason, when you click on the This Is Spam button, we give you the option to automatically add the sender's domain to your Block List. So if you are getting email from BigWebSiteStore-dot-com then just use the automatic option to block the domain. This will be more effective, and use a lot less entries, than blocking individual addresses. You should first try to use their unsubscribe link, which really honest marketers provide in any message they send out.

You can also effectively use the block list if there is a specific known sender you want to block, one that you know is using a real email address. To do this, you'll have to go directly to the Block List page by clicking on Spamblocker then Settings, or by clicking Preferences then Blocked Sender List.

I said there was a second reason for the limit, and it has to do with maintaining good performance for all users. We accept over 100 million incoming messages a day (thousands every second at times), and that is not counting the many known spammers that we block by IP number and don't accept their email at all. Even with our limit of 500 for your Blocked Sender List, if all users had a list of 500, and we had to process every single incoming message through this filter to make a delivery decision, the system would slow down a lot. Not all users use the feature, but it is easy to see that the larger the list, the slower all incoming email will be for everyone, and in fact the queue could back up to the point that messages couldn't be delivered. If we allowed large list sizes, then everyone would suffer and the larger lists still wouldn't be much of a benefit.

If you want a much more effective way to control all spam, then consider using spamBlocker set to High. This uses the reverse of a Block List, and instead uses what we call an Allow List. At this time, your Allow List is equal to the list of contacts in your Address Book. So you can allow any sender by adding them to your Address Book. The default setting in your Preferences is to automatically prompt you to add all addresses to your Address Book when you send a message to them or reply to them. For those who send to you first, they get an autoreply (which you can customize) to fill out a one-time form asking to be added to your list, and you will then get a request in your Inbox to add them and allow their messages.

Learn more about using spamBlocker on High here.

In the near future we'll be separating the Allow List and the Address Book contact list, so that you can manage them independently. I also would like to add the ability to block top-level domains, so you could block all messages coming from some remote country you never heard of. And I'd like to add things like being able to sort and manage your list more effectively, automatically remove addresses in a domain you subsequently add, and more. These things are on the list, and hopefully we'll get to them. Other suggestions are welcome.

Discussion

Posted by: peggie   |   November 24, 2006 8:41 AM    |   (1)

this was helpful...but I can not find my spamblocker interface...help??!!

Do you see a problem if I empty my entire block senders list and just direct unwanted Email to junk mail?

Thanks...and again, your info re the blocked senders list was very helpful.

Posted by: Don   |   November 30, 2006 9:54 AM    |   (2)

Happy to hear that you are looking at ways to allow us to better manage blocked addresses. If we are going to have to live within the 500 address limit, then two things would really help. One, as you have mentioned, would be the ability to block foreign addresses regardless of the specific email address. A significant amount of the spam I receive carries foreign URL's. Secondly would be a way to look at a list of blocked addresses with the dates they were added and the activity since they were added. That would allow us to remove those that have not been repeaters and to leave those that have repeated on the list. I do find quite a few that repeat, but it is cumbersome to try to manually track them myself.

Posted by: Eli Polonsky   |   December 1, 2006 7:18 AM    |   (3)

I find that there are many very common spammer domains. I use the Block Sender list to block mostly domains, very few full e-mail addresses.

Every time I get a spam mail that isn't caught by Spamblocker on medium, I list the domain in an e-mail to myself that I save as a draft. I don't block that domain right away, because it might be a one-off, and I don't want to waste any of my 500 block limit on one-offs, only repeat offender domains.

If I get a second spam from the same domain, I consider it a repeat offender domain and block it, and then I list it in a second draft e-mail to myself of blocked domains, with the date that it came in. Then, if I see the same domain come up in a blocked e-mail in a Spam Summary report, I add the date of that blocked e-mail to my listing for that domain so that I have a record of the most recent offenses from that domain.

When my 500 blocked domains fill up and I need to add a new repeat offender domain, I remove the block on the domain with the oldest date of last offense, and replace it with the new one to block. Often the oldest ones have become inactive by then. However, when I do remove a block from a domain, I add it to my first list of unblocked one-off spam domains, with the word "removed" so that I know to block it right away if it comes to life again as an offending domain.

To the person who asked about blocking foreign domains, there is a way that you can block a good deal of them without using up many of your 500 alloted blocks. Here's the hint: if you enter the two last dotted suffixes into your block list, it will block all e-mails with those two last suffixes. For example, if you block co.uk, it will block all e-mails from all domains that end in co.uk. It won't work if you just enter the last suffix (just entering uk won't work), but the last two does work.

I've blocked the following suffixes to greatly reduce foreign domain spam: ac.uk, bk.ru, co.il, co.jp, co.kr, co.nz, co.uk, co.za, com.ar, com.au, com.br, com.cn, com.hk, com.tw, ne.jp, net.au, net.mk, net.pk, net.tr, org.uk. That block all e-mails that come in with those domain suffixes, regardless of the domain prefixes.

Posted by: Email Guy   |   December 1, 2006 8:22 AM    |   (4)

Eli - that is really great advice. Yes, the Blocked Sender List allows you to list any "subdomains", which as you describe means there is at least one period used. We haven't allowed top-level domains as the potential for error is too great where users will block all of .com or .net for example, without realizing it. I plan to add the ability to add top-level domains with some exceptions like those mentioned.

Again, your suggestion is great and I'll probably do a new post describing that technique. Thanks a lot.

Posted by: Ginger Paul   |   December 3, 2006 12:11 PM    |   (5)

I would like information about Spam I've been receiving from MAILER-DAEMON, Internet Mail Delivery, Mail Delivery Subsystem, postmaster@hcrsi.com (and other domains). Try as I might, I cannot seem to block these addresses from my Inbox, even though I have set my spamBlocker to High.
Could I be infected with a virus? Am I being used as a "zombie"? I've spoken with Earthlink Technical Support a number of time about this issue to no avail.
Thank you for any help you can offer me.

Posted by: Email Guy   |   December 3, 2006 2:26 PM    |   (6)

Ginger - It sounds like you simply have a spammer forging your address in their outgoing messages, causing them to bounce back to you on a delivery failure. Learn more about this here. If they are mostly bouncing to you from the same server (hcrsi.com) then you can block them. Go to the Blocked Sender List in your spamBlocker settings (click spamBlocker then click Settings and look for Blocked Sender List) and add that domain by typing it in the box at the bottom and clicking the button. Otherwise, just make sure the sender address is in your block list if it is often the same. Use the View All Headers feature in Web Mail and find the address that is shown in the "Return-Path" header, and add that to your block list.

Be careful you don't block a domain that might have real people wanting to send you email. Using the exact address is safer.

Posted by: barry   |   December 18, 2006 4:10 PM    |   (7)

Email Guy wrote at the top: "You should first try to use their unsubscribe link, which really honest marketers provide in any message they send out."

the problem is determining honest from dishonest marketers! the rule of thumb is to never reply to a spammer, either in response to their offer, or to be removed from their mailing list. replying to a spammer shows them that 1. you got the spam, 2. you opened the spam, & 3. most importantly, you read the spam. thus they'll know that they have a 'very good' email address, and may wind up not only sending you even more spam, but will sell your address to other spammers. and you know what that means! supposed corporate email can be spam too. they may buy lists from legitimate sources in their industry, and then email you without your permission. that's still spam.

if the spam is from a company you never heard of, then i'd call it dishonest and NOT reply to be deleted. if the spam is from a company you know, say Dell, then yes, i might ask to be deleted.

Posted by: barry   |   December 18, 2006 4:31 PM    |   (8)

peggie wrote Nov 24, 2006 8:41 AM: "Do you see a problem if I empty my entire block senders list and just direct unwanted Email to junk mail?"

no need to delete your blocked list! keep it. but upgrading your spamblocker settings is a possibility too.

Email Guy wrote at the top: "If you want a much more effective way to control all spam, then consider using spamBlocker set to High."

yep. that works! i have a secondary earthlink email address i got when my ISP was Mindspring. earthlink then bought Mindspring, allowing us to retain all of our existing email addresses. i got the second address for potential future use for a specific purpose. for over 5 years i never used that address--never gave it to anyone. eventually i started to receive spam at that address. not much at first, then lots. but i still hadn't ever used it ANYWHERE! so i turned on spamBlocker to High. any spam that slips thru Known Spam (& 100% of the mail is spam since i didn't give out the address) to my Inbox gets directed to a Suspect Spam folder. so my inbox remains empty as my Suspect & Known spam folders fill up. i delete the known spam, and report as spam to earthlink 100% of the suspect mail folder. i have yet to receive ONE request from a Suspect mailer asking to be added to my 'allow' list!!!

recently i gave out this email address to one mailing list, so i'm now getting legit emails from them in my Inbox. everything else is still spam.

moral of the story: if you maintained a list of everyone to whom you've given your email address--friends, family, mailing lists, websites--then spamBlocker set to High is the way to go, as your allowed list is easy to create and update. but be careful if you've forgotten anyone in your allowed list, as they'll get the Suspect autoreply email asking for permission--and any mailing list you're on may not read that autoreply and think your email has bounced, possibly resulting in them dropping you from their list.

Posted by: barry   |   December 18, 2006 5:27 PM    |   (9)

Eli wrote Dec 1, 2006 7:18 AM that he saves as a draft email addresses from spammers for possible future addition to the Block list of 500. i do something similar.

over at this blog
http://blogs.earthlink.net/webmail/2006/11/why_do_i_get_spam_not_addressed_to_me_1.php
i wrote about selecting which email addresses or domains to add to the list of 500 as adding ALL addresses from ALL spams is not good. in addition to what i posted there: i maintain a Text file on my computer of the addresses & domains i've added to my 500, ever since my List was deleted by earthlink one day! nobody in tech support could explain why my list just vanished, nor could they retrieve it. so i now keep the list 'just in case'.

also, if i get an email from an address or domain i want to block, i can go faster to my Text file and do a search to see if i already blocked that address. if the new spam is in my Known Spam folder then the spam wasn't deleted because earthlink doesn't scan our blocked list prior to routing known spams. if the spam is in my Inbox and the address or domain is already blocked, then something is wrong. it's usually spam from my known spam folder tho.

i also keep a second list in my Text file of email addresses of spam received that i didn't place in my earthlink list of 500 blocked. this includes addresses from spammers who sent email to my non-earthlink addresses, addresses from the body of an email that don't match the domain of the FROM field, and addresses that are 99% likely single-use-only spam addresses. one of these days i'll probably but an anti-spam piece of software that will allow me to add email address to be blocked from a list i provide, email addresses found not only in the FROM line of the header but from the Received & Reply lines of the header as well as in the body of the email. i'll run all my email accounts thru that software using that huge, & growing, list. one of these days.

like Eli, if i get a new spam with an address on my Text list that's not on my Blocked list, then i'll add that address to earthlink's Blocked 500. but i would think that maintaining a single Text file on one's computer should be easier, and easier to search, than 'saving as drafts' rec'd spams, as well as taking up less storage space at earthlink. (assuming that you save as draft in webmail and not in an email program on your hard drive such as Outlook. if you save on your pc then earthlink storage doesn't matter.)

i just don't keep a record of dates spam rec'd, or quantity of spam from that address. when my blocked list hits 500 i go in and delete addresses that i don't recognize as ones placed there recently, and hope that that address isn't still active. i also maintain a Text file list of unblocked addresses in case i need to re-add an active address back to the Block list.

Eli's trick to "enter the two last dotted suffixes into your block list" is something i never thought to try--thanks Eli! i'm saving your list of them (ac.uk, bk.ru, ...) for possible use in my Blocked list. especially the .ru!

Posted by: CCK   |   July 5, 2007 10:09 AM    |   (10)

You indicated "In the near future we'll be separating the Allow List and the Address Book contact list, so that you can manage them independently." Could you give us a status update on this project?

It's coming, but a few months out.

Email Guy


Posted by: bill cutler   |   July 15, 2007 2:21 PM    |   (11)

I am having a tough time getting into my block sender list so that I can weed out and delete old and unwanted bl;ocked items.
Please tell me how to access that list.

Click Preferences / Blocked Sender List, or click spamBlocker / Settings / Blocked Sender List.

Email Guy


Posted by: O. Paller   |   July 28, 2007 2:02 AM    |   (12)

My question is: "How do I eliminate an anonymous email address that you provide when I don't want to use it any longer?

Also, please do not use my first name in a response. My first name is for my friends and family alone.

Thanks,
O. Paller

Click on Anonymous Email on the left side of the Web Mail page. That takes you to the management page where you can delete or add them.

Email Guy


Posted by: barry   |   October 13, 2007 6:28 AM    |   (13)

i wrote 12/18/06 5:27 PM: "earthlink doesn't scan our blocked list prior to routing known spams." meaning that a known spam goes into the Known Spam folder even if the address or domain of that spam is in our Blocked Sender List. that spam doesn't get automatically deleted such that we never knew it was sent, like other blocked emails.

john, will 6.0 switch around its scanning for spam? i'd guess that a good 75% of the spam in my Known Spam folder is from addresses or domains that are IN my Blocked Sender List! and for the past several months a good 90% of those spams are from one blocked spammer, tecsysteminfo.com . if you scanned incoming mail first thru our Blocked List, followed by your Known Spam algorithms, then my Known Spam folder would be considerably smaller, and my searching for false positives would go a lot faster. and i'd no longer see the tons of daily Known Spams from tecsysteminfo.com .

or, scan for Known Spam as you do now, followed by scanning those positives thru our Blocked list for immediate deletion. thanks.

I've confirmed your report and the spam check does does in fact seem to come before and circumvent the block list check.

For the majority of users this makes no difference, since the spam folder doesn't count in your quota, and it is self-cleaning and won't ever contain more than about 100 messages even if you have set it to save them. And most users don't save them at all, they are set to delete immediately (the default).

That said, I do think that we should do the block list check first, and refuse the message. I can't promise that this will change anytime soon, but it is on my radar now. In the meantime now you know not to waste spots in your block list with things that we are already catching as spam, as it won't make any difference.

Email Guy


Posted by: barry   |   October 31, 2007 6:26 PM    |   (14)

>I've confirmed your report... most users don't save them at all, they are set to delete immediately (the default).

i can't set the default in my main netcom address to auto delete Known Spam due to the many false positives that wind up in Known Spam. The past few weeks have seen more false positives than usual--including BCC's i've sent back to myself winding up as Known Spam!! in my springmail account i do have all Known Spam deleted.

>now you know not to waste spots in your block list with things that we are already catching as spam, as it won't make any difference.

it will make a difference once you scan Known Spam thru our block list! (i can dream, can't i?)

i rarely add an address to my block list as most spam email addresses are one-time-only adresses. i only add an address to the block list if the domain name in the address matches a domain name within any link within the spam; if no link i don't save the address. i add any qualifying address to the block list upon 1st getting a spam from that spammer in my Inbox. it's usually later when additional spams arrive and you then have recognized them as spam and have started sending them to Known Spam, when these blocked addresses fill up my Known Spam folder. it's not that i add a block to something you've already been catching.

Posted by: F. Cook   |   December 23, 2007 10:32 AM    |   (15)

Thank you for answering my question about the 2500 address limit.
If I understand correctly, all four of the email address entries in each record could be used yielding a total of 10,000 email addresses.

Will this work to effectively increase the number of ALLOWED addresses the system can handle?

Is there an easy way to take the 2500 addresses I now have in the address book and pour them into 725 records, with four addresses per record so that I can keep adding to my allowed sender list?

What would you call this operation?
Searched for "automated input to Allowed sender list"

No pages were found containing "automated input to Allowed sender list".

There is not an automatic way to do this. If you need to allow more than 2500 senders to bypass your spamBlocker, I would guess that many of them are probably coming from the same domain (like yourcompany.com for example). You need to add the common sender domains to your allowed list rather than individual addresses, and you can allow an entire domain with a single entry. On the Address Book page, click on "Companies (Domains)" at the upper right. Add the domains to be allowed.

Email Guy

Posted by: Bob   |   July 19, 2008 12:07 PM    |   (16)

I just wanted to agree with barry's comment on revealing that you have a valid address to spammers, and that that helps their business ultimately, because they can sell your address to other spammers. The same is true if you set spamBlocker on High to generate an automated confirmation email back to the spammer. It's a dead giveaway that your address is a valid one, and they can flag your address as "confirmed" to increase its value to other mailers. Now, I know that if your blocker is set to High you might not receive those other messages either, but that's only part of the point. I don't want to enrich spammers or help them in any way, shape or form, even confirming my address so they can sell it.

I used to find the Blocked Senders list very effective, until I used up the 500 address limit. Now, if I want to use it, the only way to do it without taking up too much time is to delete all the addresses on the list when I hit my limit, and start building it up again. This does have the benefit of tracking with evolving spamming domains, but it's still a pain. I think Earthlink could afford to increase the limit to 1,000-2,000, as the vast majority of users won't even come close to that.

$0.02,

Bob

You don't have to use the auto-reply feature when spamBlocker is on High. Click SpamBlocker / Settings and turn it off.

I agree with you in principle, but in actual practice it rarely happens that spammers monitor replies and refine their lists. Almost always they actually use fake return addresses, so the autoreply goes nowhere. Their objective is to get you to click the links for whatever they are touting, they do not want email replies. It is a very small risk that what you describe will actually occur, and it never happens to most users. Spammers have more efficient ways to validate good email addresses than bothering with autoreplies, and they don't want to give out a real return address anyway.

The block list limit will be increased in Web Mail 6.0.

Email Guy


Posted by: Ronni   |   August 14, 2008 3:30 PM    |   (17)

Is there a way to block spam by words in the subject line, ie: viagra, from suspect mail messages? I have webmail and have been getting a lot of these messages daily for the last few weeks. I don't think I can block by domain as the majority are from yahoo.com.

Macintosh G4
Safari 3.1.2

Web Mail does not have a feature to block email by user-defined subject line.

Email Guy


Posted by: Patricia Haight   |   August 23, 2008 6:26 PM    |   (18)

How can I check the number of names currently in my blocked list without counting them one by one?

There currently isn't a way to do this, but you will get a message when the list becomes full (500).

Email Guy


Posted by: Andrew Poth   |   January 29, 2010 2:12 PM    |   (19)

Some seemingly legitimate mailers have unsubscribe links that appear to be used only for the purpose of confirming that they've found a "live one", as I discovered with a Yahoo! Mail account a few years ago. I diligently clicked on the links and supplied the required information on dozens, perhaps hundreds of messages, and after that the spam volume doubled or tripled! The mailers conformed with the requirements of the CAN-SPAM Act by including an unsubscribe link, but they obviously didn't honor my requests to be removed from their lists.

The best policy is to block, filter, or change one's address and don't attempt to communicate with the spammers. I've learned to use disposable addresses to good advantage when contacting new entities, yes, even politicians and political candidates. I watch for a while; if they don't start generating unwanted mail, and I find their services useful, I go back to them and change my user profile to have messages sent to a regular email address. If they misbehave, it's much easier to delete a temporary address at my end, after which their messages and associated spam simply bounce as undeliverable.

Posted by: Greg   |   February 13, 2010 2:11 AM    |   (20)

Please allow specific Email Addresses in the Address Book to override blocked domains with that domain when SpamBlocker is set to the highest level.

For example, I have eliminated much spam from trickling through by blocking specific domains such as Hotmail.com; however, I have a friend who uses Hotmail and therefore have not been able to receive email from him although I have his specific Hotmail email address listed in my address book. So I am now forced to UNBLOCK hotmail.com domains so that I can receive my friends email and thus, once again, am receiving numerous Hotmail spam.

Having complete email address book entries override BLOCKED domain entries would be a major efficient improvement in spam filtering.

Posted by: JohnK   |   October 16, 2010 12:10 PM    |   (21)

I get email from a Panamanian spammer who changes his domain name daily, but always uses the same extension - .INFO. Is there any way to block all email from the *.info extensions?
Thanks,
-jk

Posted by: Dr. Mike   |   October 29, 2010 1:33 PM    |   (22)

I experience 2 very annoying and frustrating phenomena with Webmail (aside from the limits on domains and the lack of being able to block key spam word-containing subject lines like "Viagra").

1. The spam blocking has begun to "leak" over the past few weeks. If I get a blast of 10 spams from the same BLOCKED sender, identical in every way, I now find 7 of the messages in my suspect mail box and 3 in my inbox. Increasing in quantity and frequency over the past week (late Oct 2010).

2. Even more annoying: Mail sent to me by *myself* (as a cc from my Earthlink account or anywhere else, including lists) ends up as "spam". I have put myself in my address book each and every time, which numbers in the 1000's of times, literally. (Look in my address book any given time, and see dozens to hundreds of examples of my own email address, which STILL doesn't let my own mail in.) I have written to Earthlink numerous times, yet to get a response, despite my being one of the first and most loyal users and despite even being an owner of the company! I'm thinking of going to a stockholder meeting and presenting this f2f, since it's ignored elsewhere, as here (I'm guessing). Why can't webmail get its act together in terms of spam protection and 21st century filtering options?

Posted by: steve bass   |   March 30, 2011 12:03 PM    |   (23)

Before I post, I want to make sure this blog is being monitored.

Posted by: Jimbo   |   March 8, 2012 8:39 AM    |   (24)

I've been receiving a lot of spam from one source. I noticed one posting in this blog which stated the following :

"If you enter the two last dotted suffixes into your block list, it will block all e-mails with those two last suffixes."

I tried that and it hasn't worked for me.

All the sender's email addresses end in "ca.in". I put "ca.in" into my Blocked Sender List.

However, none have been blocked.

I'm at a loss.

That should work if you are sure it matches. I'll look into it.

Email Guy


Post a comment Back to MAIN

Please read the Ground Rules before submitting comments.

Please check the FAQ (Frequently Asked Questions) and try the Search feature before posting a new question. If your question is answered in the FAQ or in a recent article on the front page, it might not get published.



(All blogs get tons of automated spam from robots, so unless you answer this question, your comment will automatically be considered spam and won't be posted. Type human, one word, all lower-case letters.)

1.27