Where do "Do Not Reply" messages end up?

If you wanted to send an email but didn't want the recipient to be able to reply to it, what might you do? Well, if you're like thousands of automated emailing systems, you'd probably use a phony from: or reply-to: email address, like "admin@donotreply.com" to alert the recipient not to send a reply. And if you were like millions of people you'd probably just go ahead and reply anyway.

Such is the predicament that Chet Faliszek has found himself in, per a great story in the Washington Post: You see, Faliszek owns donotreply.com, and when other emailers use that domain as a reply-to address in messages they send, they don't consider that a) the domain may actually be in use and b) people might actually send replies to it despite being told not to do so.

How big a problem is it? Faliszek says he now gets millions of emails a week, many of which are filled with sensitive material intended for financial institutions of government agencies. Capital One has used a phony "donotreply.com" email to send account information to its customers; when they reply, their information goes to Faliszek. An engineering company uses such reply-free accounts for information about personnel and equipment deployed in Iraq. The intent is always harmless, as automated messages sent by a machine aren't supposed to merit a reply, but that doesn't mean using a phony email account for the from: field is the smart way to do it.

Faliszek used to alert companies about the bigger problems, but he stopped doing so after they, failing to understand that they'd screwed up, not him, threatened lawsuits and accused him of being a hacker so many times he simply just gave up. Now he runs a blog publicly shaming these lazy companies into getting their act together. If they want to be removed from the blog, the companies have to make a donation to an animal care society. (He's raised about $5,000 this way so far.)

In other news, many email administrators use "null@whateverdomain.com" as a dummy account for do-not-reply emails as well. Well, I'm living proof that that's a bad idea, too, regularly getting "test" messages and dummy missives not intended for human eyes. But I feel even more sorry for those of you named Nobody.