The basis for the requirement for an "abuse" address

> I do understand and agree with what you say. My concern is understanding
> the weight of this "abuse@domain" issue even if a legit co. has
> several obvious ways of assisting their customers. This is very critical
> to me because we take the utmost care to ensure that all of our
> names/addresses are opt-in, we respond to permissions and are accessible
> at every touch point. We just don't have the "abuse@domain.com"
> set up. Granted, anything that goes to an unknown domain address is
> handled by my folks, I'm still concerned about this ( I don't want our
> company to be blacklisted because we lack a simple email address).

Thanks for the kind words and the important question. I have a few in return, then I'll address the "abuse" issue.

1) Are you running a closed-loop confirmation on all subscription requests (sometimes called double opt-in)? If not, you aren't conforming to current best practices for mailing list management. If you have any kind of web form subscription form, you need to ensure that the OWNER of an address is the one signing it up, and only a closed-loop confirmation will prove that.

It's critical to read and understand all the elements of this essay:
http://www.mail-abuse.com/an_listmgntgdlines.html

2) You need to retain all confirmation emails and logs for the lifetime of the list you're collecting them for, to protect yourself against spam reports sent to your upstream provider. ONLY those logs are a effective defense against the inevitable spam complaint. Even well-run lists will get some small percentage of folks who forgot they subscribed AND CONFIRMED. And it's the only way to handle the inevitable churn of addresses, where somebody subscribes, abandons the address later, and a new person picks it up who didn't subscribe. THEY can report your emails as spam, and you need to drag out the proof to protect yourself. Of course, when the address was abandoned, your emails would have been rejected for a while, and you ARE handling rejections as unsubscribe request, aren't you?

For more reading on what can get reported as spam:
http://www.mail-abuse.com/an_reptspamgdlines.html

An unconfirmed subscription form can (and will eventually) be used as a harassment engine, since some spammers have made scripts that use such forms to submit their enemies' addresses to. When you get hundreds or thousands of fresh newsletters as a result of a lame harassment trick like that, you really start to appreciate the ones (now a vast majority) who require confirmations. If you ignore the confirmation request, you do NOT end up falsely subscribed to the list.

And the list manager doesn't end up being blacklisted by the Non-Confirmed Mail List Blocklist: http://www.mail-abuse.com/nominats_nml.html

3) The Internet works with no central authoritity through the use of cooperation, and conformance to international agreements. These agreements are called "RFC"s, which stands for "Requests for Comment" which really refers to the documents that are circulated among interested parties. When the comments are ended by some mutual agreement, the document becomes a "standard" but for historical reasons is still called an RFC.

The one that specifically and strongly recommends an "abuse" address is RFC 2142:

http://www.rfc-ignorant.org/rfcs/rfc2142.php

It's the same document that requires the existence of a "postmaster" address.

If a provider (domain name) fails to have an abuse address, it is eligible for listing on the RFC-Ignorant blacklist:

http://www.rfc-ignorant.org/policy.php

Many network admins refuse to carry email from such listed domains, as it's evidence that the domain owners are not aware or or not caring enough to conform to RFCs that apply to ALL entities on the Internet.

Many providers have found that posting an abuse address only gets it harvested, and spammed into the stone age - so they try to put out an alternate address, like "spam" or "reportabuse" @ their domain name. This is deprecated by many network admins, but happens.

Many automated spam-reporting tools like SpamCop use an abuse address lookup service offered by http://www.abuse.net/

This is designed for domains where they have an alternate preferred address, or some some reason they want multiple addresses to get copied on spam reports. Or sometimes the entity being reported is a known spammer themselves, or rogue provider, and it's not worth reporting spam to that bad site, so the abuse.net database will suggest sending the spam report straight to the bad site's upstream provider.

So the bottom line is that the current expectations of all domains is that they have an abuse address set up (even if it internally just forwards to the proper staff), and that EVERY domain has one, even domains that are just used for outbound email and only appear in the headers of the email. For instance, your domain might be widgets.com, but your newsletter is sent out by mail.widgets-mail.com. There should be addresses for abuse@widgets.com *AND* abuse@widgets-mail.com, since many spam reporting tools just look through the headers of the mail to find and complain to the source.

And the main web page for widgets.com should have a link to your no-spam policy, and perhaps an easy link to the abuse address.

What's widely deprecated and mocked is providers who offer up only a web form for reporting abuse, and no abuse address. If the spam violation is committed by email, then reports must be accepted by email. Web forms are seen as a form of hoop-jumping, designed by rogue providers to reduce the numbers of spams that get reported, so their lazy admins can continue their work-avoidance strategy.

Hope this helps - let me know if you want any more data from my side of the table. :-)