Scott Bryce wrote:

> I have a website that takes paid subscriptions. 10 days before a
> subscription expires, a script that runs via cron sends out an email
> notification.
>
> So I have sitting in my in box an email from an automated spam
> blocking program asking me to verify that my email address is real
> before it will send an email with my from address to the recipient.
>
> My email address is real, but the email in question may not be. I send
> out a dozen or so automated emails every night, but my email address
> is also forged onto hundreds of spam emails every day. The spam
> blocker does not give a subject line for the email in question or any
> of the content, so I can't tell whether it came from my site, or it is
> spam.
>
> The recipient's email address is not in the list of emails that were
> sent out last night, but there are other ways a legitimate email could
> be sent from my site. I am inclined to ignore the email from the spam
> blocker. If the email in question is spam, I don't want the recipient
> to be flooded with spam emails with my return address forged onto
> them.
>
> So why can't spam blockers include the subject line of an email that
> they are questioning? Don't they know that not all generated emails
> are spam?

The chances of a spammer sending a forged from address with your
domain/sender address to someone that's legitimately on your mailing
list that pays to use your site/services, is quite unlikely. Some
people (without notice to the people that email them) suddenly add a
spam check that just requires a one-time verification that the sender
isn't a spammer. Obviously if the spam checking routine only checks
the "from" field and nothing else, then yes, they could get a spam
email from a spammer claiming to be you, which would be against most
odds. Besides, spammer or not that send this email, if you don't
verify that you're not a spammer, they won't get your email. To combat
this in the future, you should simply keep track of what users had
emails sent out to them on what date/time. If there is any message ID
or header information, you can compare that with the mail logs (or have
your host do it). Honestly, though, the chances are pretty unlikely.
I'd not worry.
--
Tim Greer, CEO/Founder/CTO, BurlyHost.com, Inc.
Shared Hosting, Reseller Hosting, Dedicated & Semi-Dedicated servers
and Custom Hosting. 24/7 support, 30 day guarantee, secure servers.
Industry's most experienced staff! -- Web Hosting With Muscle!