Why Am I Getting Mailer-Daemon Emails I Never Sent?

Mailer-daemon emails for messages you never sent almost always mean one of two things. The common one: a spammer is forging your address on their junk mail and you’re catching the fallout — this is called spoofing (the bounces it produces are “backscatter”), and your account is fine. The rare one: someone actually got into your account and is sending from it. The two look nearly identical from your inbox, so below is a two-minute check that tells you which you’re dealing with, followed by exactly what to do in each case.

The two-minute check: spoofed or hacked?

Open your mailbox and look at three things.

1. Your Sent folder. If someone is genuinely sending mail from your account, copies usually pile up in Sent. Scroll through the last few days and look for anything you don’t remember writing. (Careful attackers delete their traces, which is why this check alone isn’t enough.)

2. Your sign-in activity. Every major provider keeps a log. In Gmail it’s under Google Account → Security, where you’ll find recent security activity and the list of devices signed in. Outlook has a similar “sign-in activity” page for Microsoft accounts, and Yahoo and the rest offer the same thing under security settings. You’re looking for sign-ins from countries, devices, or apps you don’t recognize.

3. The recipients in the bounces. Open one of the failure notices and check who the undeliverable message was supposedly addressed to. Total strangers? Addresses in a language you don’t speak? People you would never email? Note what you find.

Now the verdict:

• Nothing strange in Sent, no unfamiliar sign-ins, and the bounced recipients are strangers → your address is being spoofed. Nobody is inside your account. This is the outcome for most people who search for this problem.
• Sent items you didn’t write, or a sign-in you can’t explain → treat the account as compromised and skip ahead to the “act now” section below.

Backscatter: why you get mailer-daemon bounces for emails you never sent

The From line of an email works like the return address on a paper envelope. Anyone can write anything there. The postal service doesn’t check that the return address on an envelope is really yours, and email doesn’t either — the protocol was designed in a more trusting era.

Spammers exploit this constantly. Instead of sending from their own addresses (which get blocklisted within hours), they stamp real people’s addresses onto their spam, because mail that appears to come from an established, legitimate mailbox slips past some filters. Your address ends up in their hands through no fault of yours: a data breach, a scraped web page, or the infected address book of someone who has you saved as a contact.

Here’s where your mystery bounces come from. Spam lists are full of dead mailboxes. When a spam message hits an address that no longer exists, the receiving server generates a delivery-failure notice and mails it to the return address written on the envelope. Which is… you. The spammer blasted thousands of addresses with your name on the From line, and every failed delivery boomerangs into your inbox. Mail administrators call this backscatter spam, and it’s exactly why you’re seeing bounce emails for messages you didn’t send.

The part that matters: you were not hacked. The spammer never had your password and never touched your account. They borrowed your address the way someone might write your home address on the back of their own envelope.

If it’s spoofing: what helps, and what to skip

The frustrating truth first: you can’t stop a stranger from typing your address into a From field, any more than you can stop them writing your street address on an envelope. There is no setting for it, on your side or your provider’s. Honestly, the hardest part is accepting that there’s nothing to fix. The sensible response is mostly patience:

• Mark the bounces as spam, or just delete them. Your spam filter learns fast and will shovel the rest out of sight.
• Don’t click anything inside them. The bounce notice itself is a harmless automated message, but it often carries the original spam as an attachment, and the links in that attachment are the usual bad news.
• Wait it out. Spammers rotate forged addresses constantly. Most backscatter waves fade within days or weeks, once the spam run using your address ends.

Changing your password does no harm, and if it settles your nerves, do it. Just know it won’t slow the bounces down: the spammer isn’t in your account, so there’s nothing to lock them out of.

One group can genuinely fight back — people who send from their own domain. If the forged address is on a domain you control (like [email protected]), publishing SPF and DKIM records and, above all, a DMARC policy set to reject tells receiving mail servers to refuse mail that fails your checks while it’s being delivered, before any bounce is ever created. Forged messages die at the door instead of bouncing back to you, and spoofing your domain stops paying off. We’ve walked through the whole setup in plain language in SPF, DKIM and DMARC explained.

If it’s a compromise: do these five things now

If the two-minute check turned up sent mail you didn’t write or a sign-in that isn’t yours, skip the theory. Work down this list in order, right now:

1. Change your password. Make it long, make it unique to this account, and use the “sign out of all devices” or “sign out everywhere” option if your provider offers one.
2. Turn on two-factor authentication. With it, a stolen password alone no longer opens the door. An authenticator app or your phone is fine.
3. Check forwarding rules and filters. This one gets missed. Attackers quietly add an auto-forward so a copy of everything you receive keeps flowing to them even after you change the password. In your mail settings, review forwarding, and read through filters or rules for anything that forwards or auto-deletes messages.
4. Review connected apps and app passwords. Remove anything you don’t recognize or stopped using long ago. Each one is a spare key.
5. Verify your recovery email and phone number. If an attacker swapped them for their own, they can walk straight back in through “forgot password.” Make sure both still belong to you.

Ten minutes of work, and the door is closed again. Afterward, it’s worth telling your contacts to ignore any odd messages “from you” over the past few days.

When the bounces are for emails you did send

One different case, mainly for businesses: the mailer-daemon messages refer to a newsletter or campaign you genuinely sent. That’s not spoofing and not a hack — it’s your mailing list telling you it contains dead addresses. We’ve covered what happens when you email an invalid address and the difference between hard and soft bounces separately; the short version is that too many of them erodes your sender reputation until even your valid subscribers stop seeing your mail. Running the list through Reoon Email Verifier before you hit send removes the dead addresses up front, so those bounces never happen — the free daily credits are enough to check a sample of your list today.

FAQ