Autoresponder - good or bad?

[gilman01]

I've got a client asking to use an Out of Office autoresponder onhis account. I've read a lot of posts on this forum about this issue but not really sure where I should come down on this issue. (Especially since many of the threads are older)

I understand the danger of getting blacklisted. However, I also see big companies using this feature. Do they have the same issues as little companies? So here are my questions - any guidance or input would be greatly appreciated.

As an aside - I am running Chirpy's Mailscanner system on my server - this might have an impact on your answer.

1. Would you allow autoresponders? Why or why not.

2. Are there other alternatives to Out of Office messages using autoresponders?

3. How can you prevent a user from creating an autoresponder when it is an option on the webmail page?

Jeff Hoffman
The Gilman Group

[mtindor]

I've got a client asking to use an Out of Office autoresponder onhis account. I've read a lot of posts on this forum about this issue but not really sure where I should come down on this issue. (Especially since many of the threads are older)

I understand the danger of getting blacklisted. However, I also see big companies using this feature. Do they have the same issues as little companies? So here are my questions - any guidance or input would be greatly appreciated.

Yes, they have the same issues if they allow their customers/clients to use autoresponders.

1. Would you allow autoresponders? Why or why not.

It's pretty difficult to tell all of your customers that they cannot use autoresponders. However, we try to educate all customers beforehand - letting them know the caveats of using autoresponders.

Scenario
-----------
- your email account receives 500 messages a day, 490 of them are spam
- the vast majority of spam has a forged FROM address
- autoresponders will send the response to the FROM address

Since 490 of those messages were spam and almost all of them had forged FROM addresses, then when the autoresponder responds it is basically responding back to an email address that never initiated a dialog in the first place - So the owner of that address ends up marking the email as spam.

A lot of mail providers consider those responses as 'spam' - I do. It's a really bad idea to use autoresponders and it should be avoided at all cost, especially if the email account typically receives a ton of spam. If the email account typically receives little or no spam (not widely known, used sparingly), then it is probably safe to enable the autoresponder for brief periods while somebody is out.

It's one thing if people use autoresponders as 'out of office' responders for very brief times, but I've seen a lot of customers that like to keep an autoresponse on 24/7. That's really a terrible idea.

Mike

[Spiral]

I personally don't like autoresponders because of infinite loop and
mail security concerns. There are ways to fool autoresponders into
making your server an open releay to send spam too and that is
yet another concern.

The way that Plesk sets up autoresponders is a bit better than Cpanel
and takes more thought into the mail security behind it. If you were
going to use autoresponders, Plesk would probably be a better choice.
Personally, I wouldn't allow autoresponders at all on any Cpanel server.

Now with that said and to answer your third question ...

Unfortunately cpanel is not so good about disable options working
for this particular specific item ...

I usually setup a frequent running cron process to go in and remove
any autoresponder mail settings setup by my clients so if they
add any autoresponders, it's automatically deleted.

[gilman01]

Thanks for the responses - they are very much appreciated. After doing significant reading we've decided to adopt a policy of no autoresponders on the server. Since this was the first request by any of our clients we're way ahead - and we don't have to remove any existing autoresponders.

Just a note - I found a way to remove the autoresponder option fromt he webmail login screen here http://forums.cpanel.net/showthread.php?t=65783 (look towards the bottom of the thread for instructions.