Guide

"Delivery Status Notification (Failure)" for emails you didn't send

Bounces for emails you never sent usually mean a spammer put your address on their emails as the sender.

If the address is at your own domain, see whether you have a rule against fakes with Email check.

In short: someone posted a pile of junk mail with your return address written on the back. The letters that couldn't be delivered come back to the "sender", which is you, even though you never posted them. Your own mailbox was never opened.

The same goes for "Undeliverable" and "Mail Delivery Subsystem" bounces. Your account is usually fine, and two minutes of checking tells you for sure.

Faked, or hacked? How to tell

Faked (spoofed)
The emails aren't in your Sent folder, they went to strangers, and the subjects aren't yours. A spammer only typed your address; they never got into your account.
Maybe hacked
The emails are in your Sent folder, people you know say they got odd emails from you, or you had a sign-in alert you don't recognize. Someone may have your password. Act today.

If it's faked

  1. Don't reply to the bounces or click anything in them. Mark them as spam or delete them.
  2. A real bounce is only a report and never needs you to act. One that asks you to log in, "release" held messages or pay is a scam dressed up as a bounce: see Spot scam emails about your website.
  3. On a free address (@gmail.com, @outlook.com, @yahoo.com) there's nothing more to do. Google says it can't stop spammers using an address, because the fake emails are made outside Gmail.
  4. On your own domain (you@yourbusiness.com), check you have DMARC: a public rule that tells other mail servers what to do with email that claims to be from you but can't prove it. Set to send fakes to spam (p=quarantine) or refuse them (p=reject), mail servers that follow it keep fakes out of people's inboxes, and fewer of them should bounce back to you. Email check shows whether you have one and what it's set to.

Be ready for a few to keep coming. Nobody can stop someone typing your address, and Microsoft says even the biggest email services can't avoid sending some of these bounces.

If you might be hacked

  1. Change the email account's password, from a computer or phone you trust. Use one you don't use anywhere else.
  2. Turn on two-step login, so a stolen password isn't enough on its own.
  3. Check the settings a hacker would change: forwarding to an address you don't know, filters that delete or forward mail, and "Send mail as" addresses or people given access that aren't yours. In Gmail they're in Settings › See all settings, under Accounts and Import, Filters and Blocked Addresses and Forwarding and POP/IMAP.
  4. Tell your contacts not to open the odd emails, and tell whoever runs your email.

Send this to your email provider

Not sure what to say? Copy this into an email, add your website's address, and send it.

Hi,

We're getting lots of bounce emails ("Delivery Status Notification (Failure)" / "Undeliverable") for messages we never sent from our domain. They aren't in our Sent folder, so it looks like someone is faking our address.

Could you check we have SPF, DKIM and DMARC set up for our domain, and move our DMARC rule to p=quarantine once our own email passes? Please tell me what you changed.

Thanks

PageKiwi Tips

One plain-English website tip a month. No ads, no spam, unsubscribe in one click.

We email you a link first, and nothing is sent until you press Confirm in it. Never sold or shared. What we keep · Past tips

Know someone this would help? Share it

Quick question

Did this guide help with your problem?