Backscatter: bounces for emails you did not send (what to do)

What it means

You receive many "Undelivered Mail Returned to Sender", "Delivery Status Notification (Failure)" or "Undeliverable" messages, for emails you never wrote. This is called backscatter.

Here is how it happens: a spammer sends spam to thousands of addresses and puts your address as the sender. Some receiving servers first accept the spam, then find that the recipient does not exist, and send a bounce to the sender written in the message, which is you. You get the bounces, not the spam.

Backscatter is annoying but usually does not mean your account was hacked. You need to check that first, though.

Why it happens

• The sender address in SMTP is easy to fake. Without SPF, DKIM and DMARC enforcement, any server can claim to send for your domain. Spoofing in general is covered in fake emails sent with your domain.
• Badly configured receiving servers accept every message and bounce later, instead of refusing invalid recipients during the SMTP conversation.
• A catch-all address on your domain receives bounces sent to random addresses (xk3h@yourdomain.com) that spammers invented.

How to check

Is it backscatter or a hacked account?

Open one bounce and look at the original message attached or quoted at the bottom. Read its Received headers:

• If the first Received line shows an IP and server that are not yours (unknown country, home connection), and there is no valid DKIM signature for your domain, it is backscatter.
• If the message really went out through your mail provider or server (your provider's hostnames, your login in the headers, copies in your Sent folder), your account or website may be compromised. Follow hacked email account sending spam instead.

Also check your provider's sent logs or message trace.

Check your authentication

Look up your domain on the domain scanner: do you have an SPF record ending in -all or ~all, and a DMARC record? Send a test from your real mailbox to the unique address on the Delivmail home page to confirm your real mail passes SPF, DKIM and DMARC. Also check your own server IP on public blacklists: if your own server bounces spam, it can be listed as a backscatter source.

How to fix it

You cannot stop spammers from writing your address, but you can reduce how many servers accept the fake mail, and filter the bounces.

1. Publish strict authentication. A correct SPF record, DKIM on all your real mail, and a DMARC policy that you move to quarantine then reject (see moving DMARC to quarantine or reject safely). Servers that check these refuse the fake mail during the connection, so no bounce is sent to you.
2. Remove the catch-all if you do not need it, so bounces to invented addresses are refused.
3. Filter the bounces. Make a rule that moves bounce messages whose original message was not sent by you to a folder. In Microsoft 365, the advanced spam filter setting for NDR backscatter can mark them as spam:

   Set-HostedContentFilterPolicy -Identity Default -MarkAsSpamNdrBackscatter On

4. On your own server, consider BATV (Bounce Address Tag Validation): your server adds a signed tag to the envelope sender of real mail, and refuses bounces that do not carry a valid tag.
5. Do not create backscatter yourself. Configure your server to reject unknown recipients during SMTP instead of accepting and bouncing. In Postfix, keep local_recipient_maps or virtual_mailbox_maps complete and use relay_recipient_maps for relayed domains, and make your spam filter reject, not bounce.

Floods usually stop after a few days when the spam campaign ends.

Check that it is fixed

After any DNS change, wait for propagation and check your records again on the domain scanner. Send a new Delivmail test to confirm your own mail still passes DMARC. Then watch the number of bounces over the next days; it should drop. If bounces show messages really sent from your systems, treat it as a security incident.