Spam and Security: Changes to Pobox Outbound Mail

This article was originally published as part of the Pobox blog. Pobox was acquired by Fastmail in 2015.

You can use Pobox to send your mail, by setting up your email program to send messages through smtp.pobox.com. If you use smtp.pobox.com, I wanted to make you aware of a recent change.

When you run an email service, you are constantly doing battle against spam. There’s the spam that people try to send to Pobox accounts. And then, there’s the spam people try to send FROM Pobox accounts.

The Pobox SMTP server has always filtered mail from trial accounts, as spammers and phishers love to try to take advantage of the reputations of legitimate email providers. Of late, though, we’ve seen an increased number of active, paid Pobox accounts being abused by spammers. (So you don’t worry, “increased” here means from a couple a year, to a handful a month. Hardly a rash.) Whether it’s caused by a virus getting installed on their computer or a phisher stealing their password, a compromised account can quickly send enough spam to cause a problem.

As such, we have recently changed the policies for mail sent through smtp.pobox.com. All outbound messages are now being checked by Cloudmark, which looks for “signatures” (URLs, phone numbers, email addresses, domain names, unique phrases, etc.) found in messages that have already been reported to them as spam. Accounts that have several messages flagged by Cloudmark in a day have their SMTP privileges automatically suspended.

This change is for your protection, as well as the protection of all customers who send mail from the SMTP server. Even a small number of spam complaints can adversely affect our ability to get the messages you send delivered to your correspondents’ Inbox. And the accounts actually compromised by spammers could see their email address’s reputation severely maligned.

However, Cloudmark, like all spam filters, is never 100% accurate. If you send a couple of messages misidentified as spam, your account shouldn’t be affected. But, if more than a handful of your messages are misidentified as spam, you may see your SMTP privileges temporarily suspended. You’ll be notified via email, and copy of the message will be sent to Pobox Customer Service for their review, and we will reinstate accounts that have been incorrectly deactivated.  But, feel free to email us if you think the situation warrants an explanation.

Because this change can cause your SMTP privileges to get suspended, I will take this opportunity to remind you that the SMTP server is never to be used to send bulk messages. If you are CCing enough people, even a single message identified as spam is sufficient to get your SMTP privileges suspended.  If you have a CC list that you regularly send mail (and it’s more than a few people), we strongly encourage you to set up a mailing list.