Can spam/phishing domains be blocked?

TidBITS Talk
1

I’ve been getting a large number of spam/phishing emails this past month and was wondering if there was a way to block them at my ISP (not on my Mac). Spectrum’s Webmail interface has a “blocked senders” list that can be easily updated. However, the problem is in the nature of addresses being sent, where even the domain names seem to change all the time. For example, a message such as: mny0W0MHXTpcHjI8Nv@qcrYt.mundopc.net. What I’ve noticed is that even the domain name section seems to change from message to message. This one comes from a .net top level domain but many of them are coming from .ng (Nigeria) and there’s no way to block only senders from that top-level domain.

Is there a simple solution for this, or am I stuck simply deleting lots of Junk mail?

mny0W0MHXTpcHjI8Nv@qcrYt.mundopc.net

1 Like
2

Charter/Spectrum’s poor (actually, no) spam filtering is the reason I bought a license to spamsieve. I run it with the drone feature turned on so that if I can train anything that happens to slip through by moving spam messages to the “TrainSpam” mailbox and move any messages incorrectly flagged as spam to the “TrainGood” mailbox. As time goes by, I am doing that far less often.

1 Like
3

I second @ddmiller SpamSieve is the best.

You could use a mail Settings>Rules to trash all .ng.

Screenshot 2026-05-04 at 20.17.52
Screenshot 2026-05-04 at 20.17.521228×466 42.4 KB

1 Like
4

I haven’t come across an ISP that allows blocking of top-level domains (TLDs) by end-users, though I haven’t looked recently. It’s a pet peeve of mine.

For example, I am very confident that I have never received a legitimate email from the .xyz TLD, but there was quite a while when nearly all of the spam that made it through my spam filters and into my inbox came from there. More recently, my Gmail accounts were getting spammed several times a day with emails from very long domain names from a TLD I had never seen before.

You might try using a wildcard, like *.ng, but I’m not optimistic. I know that some business email services allow blacklisting TLDs (including Microsoft 365), but the major consumer-level services do not. As others have suggested, you may be left with installing spam tools like SpamSieve or otherwise creating custom mail filters on your Mac.

5

At the ISP level, a lot depends on the user services the ISP, or its email provider, offers and if you are only an email user or are using the ISP to host a domain or your own online presence.

One tactic you can try is to use filters or rules, if available, at the ISP/email provider level. Look for commonalities in the spams you are receiving, such as subject lines, words and phrases, and hyperlinks. Set up filters based on these commonalities.

Looking longer term, you could think about moving away from your current address by either setting up your own domain or following a multiple email address strategy. I essentially have four email addresses: an address that is only used for a very small number of businesses I have long-term relationships with and hold confidential information about me, an address that I use for all other ongoing business relationships, a friends-and-family address, and a DuckDuckGo address that allows unlimited numbers of aliases for pretty much everything else.

6

That is not the problem. The messages always end up in my Junk mail folder. However, there are so many of them that I would prefer not to have to keep deleting them and simply block them at the ISP level.

1 Like
7

Thanks. Interesting about Charger/Spectrum, who are not terribly focused on email service in general.

8

Thanks. I will check to see if Spectrum allows you to set up rules on their end. I didn’t notice that feature but I didn’t look to hard.

9

Also, there are third-party tools that help with this I believe. And maybe it can be done with a firewall. Or, if you’re more tech savvy (more than I am), I believe some routers allow you to block domains. A Google search on the topic led to info about pfSenseNG and other tools, but I’m not sure I want to go that route.

10

In this case they go directly to Trash. You can also set them as read.

11

Assuming you use Apple Mail, have you looked into its built-in rules? This is not an ISP-level block, but failing that, I think this will effectively give you what you want. Set a rule whose scope is all From addresses that end in .ng and then move them to the trash and mark them as read (to avoid the unread count badge). Here’s an example that is close to that (looking for two cases of “contains” instead of “ends with”):

image
image1220×548 52.1 KB

1 Like
12

The short answer is that blocking spam in the email client by the From address is ineffective, because the From address can be anything. It is like trying to block robocalls by the caller id – they can fake it so it can be random phone numbers.

Your ISP can, theoretically, do a better job, because at the time they are receiving the message, they know exactly who the sending server is. They can choose to accept the message, accept it but mark it as spam, or deny it.

The trick is how does the ISP know which sending servers to trust? This requires effort, and it is a moving target: if they’re too conservative, they let spam through, but if they’re too aggresive, they can drop legitimate email.

Spectrum may not be putting in the effort to do an effective job.

So there are three strategies you can take:

  1. Switch to an email service provider that does a better job at spam management.
  2. Try to manage it at the client end (more on this below)
  3. Aggressively report every single spam email you get to the ISP that sent it so that the spammers get kicked off their provider. I use SpamCop for this purpose. *

Managing at the client end: As I said above, once the mail is accepted by the mail server (technically, a Mail Transfer Agent), you don’t know for sure where the mail came from. Each MTA the email passes through adds headers to the email that are supposed to track its path, but guess what? Spammers can add fake headers.

You can use SpamSieve, which examines the message body and headers and scores it for characteristics that distinguish spam from not-spam. I don’t know if SpamSieve goes as far as analyzing the headers to discard the fake headers and look up the true spammer’s server in spam blocklists.

The spam processing in Mail just looks at the body for words and phrases that are spammy vs. not. It can be fooled.

* I’ve had my 4 email addresses for decades. Last week I got 3 spam messages, total!

2 Likes
13

Just want to add that in macOS Mail, I think the Junk filter “learns” whenever an email is marked as Junk (if I recall correctly, I haven’t done anything with Mail’s Junk settings for a long time).

—————
ETA: found this historic thread…but given Apple’s ongoing neglect of Mail, I wouldn’t be surprised if a lot of the information still applies.

14

Thanks. I do use Apple Mail (Catalina). I’ll try this and see what happens.

15

Yes, it’s supposed to learn. It does a pretty good job of moving incoming spam to the Junk folder. So it has learned something. I simply would prefer to keep them from getting to me at all. It’s not a critical issue, but it is an annoyance. Not sure why the volume has increased in the past month though. In the past, I received very few spam/phishing emails per week, now I’m seeing 5-10 a day.

16

For me, that’s easy. I have Apple Mail set up to delete anything in the spam folder after 30 days. I look at spam messages to make sure there’s nothing falsely flagged there, but I mark the read after scanning and let Apple Mail delete the messages automatically.

1 Like
17

Be careful what you wish for. My email provider blocks spam at two levels. At the highest level it blocks and nukes the email before it is delivered–never to be seen again. At the next level, it quarantines suspected spam in a specific folder.

I can live with the latter; the former can be a problem.

1 Like
18

Do yourself a favor and buy and install Spamsieve. It has resolved all of my spam problems, and spam problems of my elderly parents. It even deletes the crap after a period you can set.

3 Likes
19

I have spamsieve installed and it works fine. The problem I have is that I’m still getting 100-200 spam messages a day from my email provider. And I have to check each message to catch the 1-2 good ones and train them as good. Sometimes I’ll get a good email that’s in my contact list still marked as spam. Vry frustrating. And I changing my email of 30 years would be a nightmare.