Handling abuse that comes from your network is critical to:
1. Maintain a good reputation
2. Retaining customers
3. Avoid costly legal action (both civil and criminal) and significant fines.
However, we frequently see several bad practices:
1. Bouncing addresses
The mail system will be returning the messages as non-deliverable to the sender in 2 main situations:
1. The email address provided isn’t valid
2. The mailbox is full
This means that no one can report abuse from your networks to you, which is a terrible sign.
2. Spam filtering
By their very nature, abuse reports will contain IP addresses, domain names, and sample data.
Organizations should handle abuse addresses carefully with regard to filtering. All messages sent to the abuse address should be delivered to the mailbox.
3. Freemail addresses
It should go without saying that using a “free” email address as an abuse mailbox is a terrible idea.
Google, Hotmail, Outlook, etc., are designed as “consumer” services. Thus, they will have strict rate limiting, limited mailbox quotas, and heavy spam filtering. Making them a very poor choice as the destination address for an abuse mailbox.
4. Not accepting email reports
Abuse reports will be sent in all sorts of formats.
Some will be manual others will be automated. These varying formats are one of the main challenges to abuse handling and one of the main reasons we are pushing for using easily parsable formats like X-ARF.
We’ve seen a small number of cases where an auto-responder is applied to the abuse contact. In these cases, it states that abuse reports are only accepted by filling out an online abuse form.
Having an auto-responder burdens the abuse reporter to fill out a manual form. You will therefore miss important reports and discard all the automated reports sent to you.
5. Ignoring abuse reports or being unable to handle reports promptly.
Another case is when there is a working abuse@ address, and the messages are delivered, but no one:
1. Monitors this mailbox
2. Takes action on the issues reported
3. Can keep up with the volume of reports received
Abuse reporters will quickly work out that they are repeatedly sending abuse reports for the same issues and that nothing is being done or happening very slowly.
The next steps
To wrap this up, make sure that:
1. All your network ranges have the correct abuse-contact configured, and it works correctly
2. You are monitoring it and taking action on all reported issues
Otherwise, reporters will quickly conclude that you don’t care about abuse, and bad things will happen.