Decrease your spam by address munging

Posted By: Mark Aplet 1 Comment August 18, 2008

I think we all would agree that spammers must die! Okay not literally, but the spam does need to stop. I recently closed down an email address that received over 5,000 junk emails a day. I had the address for the better part of 6 years or more. Part of the spam problem was created when I put my email address online unprotected. This is a common practice still employed today because many webmasters either don't know how to munge an email address or maybe it's just too much work.

I don't believe there is a silver bullet for becoming spam free. However, in the last year or so I have done two things to curb my spam. So far it has worked nearly perfectly. I now only see one or two emails a week that are junk mail.

The first thing I did was move to the hosted google email solution. It's free, and has the best email filtering that I have ever used. A good spam filter will go along way towards inbox freedom. The second thing I chanaged was my email practices. I started munging my email address on all the websites I built.

What is email munging?

Email "munging" is the act of intentionally messing up your email address so that the robots that harvest your email address are hopefully fooled or tricked into thinking that it's not an email address. There are a few main types of munging techniques as far as I can tell. One is to modify the address so that it is invalid. This is a common technique, and one that I personally do not recommend. It would look something like this:

mark AT domain DOT com
mark-at-domain.com
mark@REMOVETHISdomain.com

All of these examples have severe usability issues, and for that I do not recommend using anything like this. While it hides your email address from spammers, some users do not understand that this is not valid. They may not be savvy enough to know that they are supposed to chanage the address in their email program. As a result, legitimate emails are never delivered to you. I read once on a "hacker site" that this method is referred to as "Obfuscation for human but not for robots."

The next method is to convert your email to ASCII code replacing either part of your email or the entire address with it's ASCII code equivelent. There are many sites that offer tools to help you do this I will list a few of them at the end of this article. Though I have read that this works, I would have to make an assumption that a spider can recognize this and translate it right back to a valid email address. For these reason I can't recommend either of these two methods.

Javascript obscure method

The only method of protecting an email address that make sense so far is javascript. I believe that nearly 100% of all legitimate users have javascript turned on. The visitors that do not have javascript enabled appear to be robots. Or perhaps a handful people that just want a different experience than the rest of us. So unless there are compelling reasons to make an email address available to a user with javascript disabled, I have to say to bad turn javascript on. With this in mind, it makes sense to use javascript to protect our email address. There are two scripts that I currently use. I am running tests on each to see if one method works better than another. So far I have not had a single spam using either method below.

The simplest version is one that I got from Joe Mailer. Though I tried to find the original article on his site I could not. I hope to find it before I release the article, but his credits are in the script below. This script is easy to add to any web page and gets the job done. Though it pretty easy to crack if you wanted to. It will produce an inline clickable email link that appears completely normal to visitors.

<SCRIPT TYPE="text/javascript">
<!-- // JavaScripts from http://www.joemaller.com
emailE='domail.com' emailE=('mark' + '@' + emailE)
document.write('E-mail: <A href="mailto:' + emailE + '">' + emailE + '</a> ')
//-->

</script>
<NOSCRIPT> Email address protected by JavaScript. Please enable JavaScript to contact us. </NOSCRIPT>

The next method is a bit more involved but it might be a better system in the long run. This method was taken from Project Honey Pot. It basically does the same thing as the Joe Mailer script in principal but does so with a bit more pizazz. The same email would look this:

<script type='text/javascript'>
var a = new Array('n.','ai','rk','ma','@d','om','co','m');
document.write("<a href='mailto:"+a[3]+a[2]+a[4]+a[5]+a[1]+a[0]+a[6]+a[7]+"'>"+a[3]+a[2]+a[4]+a[5]+a[1]+a[0]+a[6]+a[7]+"</a>");
</script>
<NOSCRIPT> Email address protected by JavaScript. Please enable JavaScript to contact us. </NOSCRIPT>

As you can see it's a bit more cryptic and more difficult to put back together again. Hopefully ensuring that it stays protected for a longer period of time. Who knows what the next tricks will be. At present time, javascript munging seams to be the best method. You can munge your own email address using the Project Honey Pot online munger tool for free so give it a whirl. Best of all— either method works perfectly with a screen reader, since screen reader software typically sit on top of the web browser that is javascript enabled. So accessibility is not as big of an issue as other methods listed above.

Additional links & Resources

ASCII Email Address Encoder
Email Address Munger/Email Address Encoder
Javascript Complete Obfuscation

Tags: Accessibility · General

1 comments so far ↓

  • 1 roberto // Feb 14, 2010 at 11:30 AM
    This can be used in php, it encode the adresse
    email@domainename.com when the server parse it

    <?php
    function hex_encode ($str)
    {
    $encoded = bin2hex($str);
    $encoded = chunk_split($encoded, 2, '%');
    $encoded = '%'.substr($encoded, 0, strlen($encoded) - 1);
    return $encoded;
    }
    ?>
    <p><a href="mailto:<?php echo hex_encode("email@domainename.com"); ?>">text for the mailto link</a></p>

Leave a Comment

Leave this field empty:

Theme Design By Mark Aplet

Super Powered by Mango Blog

such