The ‘Undeliverable Email’ Notifications Problem

A sudden run of “message undeliverable” emails can be confusing, especially when you did not send the messages. One possible cause is sender-address spoofing, but it is worth checking rather than assuming there is nothing you can do.

How spoofed bounces happen

Imagine a spammer uses someone else’s address on outgoing messages. Some receiving systems may send a failure report to that innocent address. This is often called backscatter. Receiving such a report does not, on its own, prove the mailbox password was stolen.

Check whether the account was used

Keep representative non-delivery reports and ask the provider or administrator to inspect the evidence. Review unexpected sign-ins, sent activity and forwarding rules through the legitimate account controls. Do not click an unfamiliar sign-in link inside a bounce message.

What can help?

The provider can review the sending configuration, domain authentication and filtering. If the account is compromised, it needs an incident-response process. If an address is only being forged, changing the mailbox password alone does not stop someone typing that address into a forged sender field.

There is no fixed two- or three-week period after which every problem ends, and no generic guarantee that reputation is unaffected. Work from the actual reports. See our email security and deliverability service for related configuration questions.

Sources and further reading

Guidance checked 26 October 2026: Microsoft’s email-authentication overview.

Illustrations