I run my own mail server for my domain. Volumes are low enough that running a greylist (blocking all the drive-by spammers) gets rid of 90% of the crap. As for the rest, I had set up lists of blocked senders and recipients (addresses I have declared invalid on my domain) in Postfix. Then, a few months ago, I decided I would like to collect statistics on how often these list entries are hit, and I couldn’t be bothered to scan logfiles to do it. So a few months ago I implemented a “socketmap server” <https://www.postfix.org/socketmap_table.5.html> which responds to lookup requests from Postfix for those lists, gets the information from back-end database tables in MariaDB, and also logs entries in other database tables to record the requests. This makes it easy for me to add/remove entries in those blocklists, without having to restart Postfix (or my socketmap server). And I can pull back statistics on database lookups at any time. The first thing I’ve noticed so far, the most commonly-used rejection entry in the blocked-sender table is the one that refuses mail from the entire “.shop” TLD. I have never done any business with any site with such a domain; has anybody else done so? My feeling is, no reputable business has such a site. As for blocked recipients, I am fond of giving out different recipient addresses to different online forums and businesses and anybody else who needs to contact me. This way, I can spot immediately if an address I gave to one entity starts being used for mail coming from an entirely different entity. One or two online sites were too trusting in their early days about letting web scrapers glean email addresses from their user pages. I did later go in and enter new addresses on these sites, and invalidate the old ones, and they haven’t repeated the same mistake. But one of those old addresses keeps popping up, in some interestingly-corrupted forms. The address I originally entered took the form “from-«forum»@«domain”. I still get attempts to send mail to that (now invalid) address, but also to “u003cfrom-«forum»@«domain”. And more recently also to “cfrom-«forum»@«domain” -- addresses which I have never used anywhere. That “u003c” looks like a corruption of “U+003C”, which would be how you would write the Unicode code point for the “<” character (which is of course commonly used to delimit email addresses and URLs and such). I suspect the “cfrom” version is a further corruption of the “u003cfrom” one. I also get email sent to an address I haven’t used since my Apple Macintosh days, which would have been over a quarter century ago. I guess this goes to show that the spammers’ address lists can only grow over time, they can never remove any address as the lists are passed on, just in case it is still valid, because by the nature of their business they can never pay any attention to bounces that are supposed to indicate invalid addresses. And that passing on of lists introduces its own corruptions, as well. I wonder how big the spammers’ email lists are these days? I have this feeling the number of entries in typical lists might have exceeded the entire population of the Earth by now ...