# Allowing topic creation through direct delivery email in makes my forum vulnerable to spammers
**URL:** https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421
**Category:** Support
**Created:** [May 22, 2019, 3:51pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421 "2019-05-22T15:51:50Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 22, 2019, 3:51pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/1 "2019-05-22T15:51:50Z")
Recently my personal forum has become the target of email spam, apparently always coming from different auto generated email addresses on domains like [qq.com](http://qq.com), [139.com](http://139.com) etc that I have put on my blacklist. Clearly I am doing it wrong… can anyone advise?
See screenshot. Discourse is sending emails to each of these email addresses, and I have now received a warning from mailgun that I have surpassed sending 10,000 emails this month.
Generally this forum has little to no traffic at all, but I still want to allow emailing in for various purposes. I am using mailgun for outbound mail, and have set up direct delivery for inbound mail, with a mail-receiver.yml. My suspicion is that I need to add some info to mail-receiver.yml to prevent these messages from reaching discourse at all but I am not sure how to do it. Or is there another way to block domains from outgoing mail from within discourse?
This is the contents of the message my discourse is sending:
> We’re sorry, but your email message to [“[foo@mydiscourseforum.org](mailto:foo@mydiscourseforum.org)”] (titled 顶 级 菠 菜 注 冊 嶺 领 1 8 ⑻ え 找 美 女 Q485947940连结604959ＣOＭ ) didn’t work.
>
> Your reply was sent from a blocked email address. Try sending from another email address, or [contact a staff member](https://discourse.mydiscourseforum.org/about).
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [May 22, 2019, 4:36pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/2 "2019-05-22T16:36:22Z")
I had the same problem. I’m using the [incoming mail server](https://meta.discourse.org/t/straightforward-direct-delivery-incoming-mail/49487) and tried adding `qq.com` to the blacklist, but it didn’t work, I think because they have apparently hacked a bunch of servers, so the mail isn’t coming from [qq.com](http://qq.com), but instead the hacked server, so the blacklist doesn’t work.
I ended up just disabling incoming email altogether. (Probably not a solution for you).
And it does seem that discourse is sending a “Your email didn’t work” message to all of those.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 22, 2019, 4:54pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/3 "2019-05-22T16:54:41Z")
Thanks, Jay! It helps to know I’m not alone. 😉
---
### Author:  [@schungx](https://meta.discourse.org/u/schungx)
#### Post date: [May 23, 2019, 9:59am UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/4 "2019-05-23T09:59:37Z")
The way i eventually solved this problem is to turn on post approval for incoming emails. This is done by setting the approval level limit to 1 instead of 0.
So all posts from email gets added to the pending list. Then you can delete those users and blacklist their ip.
Cons of this is that a post will be created for each. This will inflate your db.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 23, 2019, 11:42am UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/5 "2019-05-23T11:42:34Z")
> [@tobiaseigen](#):
>
> have set up direct delivery for inbound mail, with a mail-receiver.yml
Can you assist here @mpalmer? What do you recommend?
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 23, 2019, 5:24pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/6 "2019-05-23T17:24:26Z")
OK, based on what I’ve seen here and found in my explorations, I may have found an interim solution. Not great but at least not generating gazillions of emails.
- removed [qq.com](http://qq.com) etc from the discourse blacklist
- disabled my own email notifications
Now I can delete these messages and staged users at my convenience, though it is going to be a lot of them - a new one is created every minute or so.
I suspect that a longer term solution will be to set up a blacklist to prevent emails from these domains reaching discourse at all, at the postfix level or perhaps as an admin setting that prevents sending or receiving mail from blacklisted domains.
Or maybe (not my preference) I switch back to the POP polling, and let a mail server handle the spam filtering? Or install spamassassin or some such - has anyone done that on the same server hosting a discourse site?
The trouble is these spammers are also using other domains besides the ones on my own blacklist, so the occasional spam will always find its way through and I will be playing a constant game of whack a mole. Adding a line to mail-receiver.yml and rebuilding each time is cumbersome.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 24, 2019, 1:09am UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/7 "2019-05-24T01:09:17Z")
You can ban SMTP sender domains with at SMTP time with `sender_access` rules, and do pretty much anything you like with mail via header checks. Given how heavily abused `qq.com` is, that’ll probably go a long way to solving your immediate problem.
Discourse with incoming e-mail enabled is really very similar to an old-school mailing list platform, with a better web interface, and so the vast majority of the same abuse controls work quite adequately. These include things like not allowing unregistered users to post via e-mail – realistically, there are no mailing lists that allow such behaviour, because it invites exactly the sort of misadventure you’re seeing here.
The one thing that Discourse is lacking in this respect is subscribe (or, in this case, forum sign up) via e-mail – sending an e-mail to `-subscribe@example.com` gets you a response back with a confirmation code or URL, etc. I doubt that’s going to holding back thousands of potential contributors from being involved in your forum, though…
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [May 24, 2019, 7:40am UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/8 "2019-05-24T07:40:11Z")
> [@mpalmer](#):
>
> ban SMTP sender domains with at SMTP time with `sender_access` rules
Is there a link on how to do this in the direct delivery email topic? I suspect this will come up a bit.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 24, 2019, 4:10pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/9 "2019-05-24T16:10:36Z")
Thanks for the suggestions, Matt. I will think on it - it all makes sense. In the meantime my temporary fix appears to have worked and I have stopped sending responses. Now I just need to figure out how to delete all these users and their messages until the spammers give up on me.. 😉
My own use case is a bit different from what you are describing, but I imagine it’s something that other sites might also be interested in getting to work. My forum is private and I do not allow just anyone to post topics. However, I have a few email addresses that I allow anyone to send to. Those emails are delivered to me as discourse messages. The senders are added as staged users. I use [Tickets Plugin 🎟](https://meta.discourse.org/t/tickets-plugin/97914) and assigned to make sure I follow up.
I love this setup which has been working incredibly well for the last several months, and allows me to operate a discourse forum without maintaining a separate email account externally with gmail etc. I just have digitalocean and mailgun, and the domain name registration pointing the domain and I’m done.
I looked a bit at postfix settings. Can you give some pointers on how to configure postfix in this docker setup? Also, is there any way (within discourse or with postfix) to just completely ignore emails from blacklisted domains? I just want their emails to disappear into a black hole. The `sender_access` rules appear to send bounce messages.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 25, 2019, 4:11pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/12 "2019-05-25T16:11:07Z")
> [@schungx](#):
>
> The way i eventually solved this problem is to turn on post approval for incoming emails. This is done by setting the approval level limit to 1 instead of 0.
>
> So all posts from email gets added to the pending list. Then you can delete those users and blacklist their ip.
>
> Cons of this is that a post will be created for each. This will inflate your db.
Thanks, Stephen!
I would be happy to do what you describe but it doesn’t seem to have any effect on messages to groups, which is the only thing I allow topic creation through email for. See screenshot below - perhaps the “email in min trust” could be adjusted to also require minimum trust level to send messages to groups?
I’m also finding that my system is now still sending emails to the email addresses on the blacklist.. really it should ignore them as I wrote up separately in [https://meta.discourse.org/t/feature-request-do-not-accept-or-send-email-to-blocked-users-or-domains/118670?u=tobiaseigen](https://meta.discourse.org/t/feature-request-do-not-accept-or-send-email-to-blocked-users-or-domains/118670).
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 25, 2019, 4:02pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/13 "2019-05-25T16:02:20Z")
Relating to this topic, it seems to me my problem would mostly go away if discourse simply ignored emails from blocked users or blacklisted domains. Currently it responds with an email notification, generating tens of thousands of needless emails and triggering mailgun’s warnings. (I have no evidence to prove this, but I suspect these responses also encourage the spammers by showing a sign of life)
This is a bit draconian and only matters for sites where topic creation is allowed through email, so it could be an admin setting.
---
### Author:  [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [May 27, 2019, 4:54am UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/14 "2019-05-27T04:54:35Z")
> [@codinghorror](#):
>
> Is there a link on how to do this in the direct delivery email topic?
An appropriate [howto](https://meta.discourse.org/t/filtering-known-bad-sender-domains-from-your-mail-receiver/118760) has been written, and link thereto has been added in the direct delivery email topic.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 27, 2019, 6:44pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/15 "2019-05-27T18:44:58Z")
Thanks to @mpalmer’s howto, I have been able to resolve the OP and I will be able to deal with spam arriving via direct delivery from spam domains like [qq.com](http://qq.com). Many thanks again!
Now all I need to do is delete the 150+ spam accounts and messages associated with [qq.com](http://qq.com)! Is there a bulk admin task for this, e.g. a rake task to delete all accounts and posts matching email domain?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [May 27, 2019, 7:02pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/16 "2019-05-27T19:02:06Z")
You should be able to run this from the console to easily delete them:
```plaintext
destroyer = UserDestroyer.new(Discourse.system_user)
UserEmail.where("email LIKE '%@qq.com'").each { |ue| destroyer.destroy(ue.user, delete_posts: true, context: "qq.com users are spamming us")}
```
(as always, take a backup first)
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 27, 2019, 7:07pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/17 "2019-05-27T19:07:57Z")
Thanks! But does that also delete their posts?
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [May 27, 2019, 7:09pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/18 "2019-05-27T19:09:25Z")
Yes with the `delete_posts: true` argument to `UserDestroyer`.
`UserDestroyer` will actually fail if there’s still posts belonging to the user.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [May 27, 2019, 7:52pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/19 "2019-05-27T19:52:46Z")
Hoo! That worked. Thanks, Michael, for saving me 3000+ mouse clicks. 🖱
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [June 26, 2019, 7:52pm UTC](https://meta.discourse.org/t/allowing-topic-creation-through-direct-delivery-email-in-makes-my-forum-vulnerable-to-spammers/118421/20 "2019-06-26T19:52:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.