Spammers are forging your domain, and servers that reject their mail send the rejections to you. Publish an SPF record listing everything that sends as you, add a DMARC policy, and filter the bounces while it settles.

A morning of bounce messages

The inbox fills overnight with messages titled Undelivered Mail Returned to Sender, Delivery Status Notification and Mail delivery failed, some in languages nobody in the office reads.

Each one returns a message that supposedly came from your domain: an offer of cheap watches, a fake invoice, a link to an online pharmacy. Nobody at your business sent any of them.

Spammers chose your domain as the sender, the way someone might write a stranger's return address on an envelope. Writing it costs them nothing.

The rejections are receiving servers telling the apparent sender that delivery failed. The apparent sender is you.

Why the rejections come back to you

Email has no built-in check on who sent a message. The sender's address is whatever the sending machine claims, and spam sent from infected computers claims whatever the spammer chooses.

Many receiving servers refuse such mail during delivery, and the sending machine simply moves on. Others accept it first and check later, and when they reject it, they send the rejection to the address in the sender line.

Those after-the-fact rejections are sometimes called backscatter. They do not mean your account was broken into, though it is worth asking your host to confirm that nothing unusual left it.

What makes a domain easy to forge

The second describes most small business domains. Without a DMARC policy, a receiving server that suspects a forgery has no instruction from you, so it has to guess.

What SPF tells receiving servers

SPF, short for Sender Policy Framework, is a line of text published in your domain's DNS settings, alongside the records that say where your website and mail live.

It names the servers permitted to send your domain's mail, and ends with an instruction about everything else: treat it with suspicion, or reject it outright.

A receiving server checks the list as a message arrives. Mail from a server not on the list fails the check.

A server that checks during delivery can refuse the forgery before accepting it. Nothing is accepted, so there is nothing to bounce back to you.

What DMARC adds

SPF checks a hidden sender address used for delivery, not necessarily the one people see in the From line. DMARC ties the checks to the visible address, which is the one spammers forge to look like you.

A DMARC policy, another line in DNS, tells receivers what to do when mail claiming your domain fails: deliver it and report, send it to junk, or refuse it.

It also asks large mail providers to send you regular reports of every server that used your domain and whether it passed, which shows both the forgers and any sender you forgot.

List every sender first

Before publishing anything, list every system that sends email as your domain: office mail through the host, Office 365 or Google Apps for Work, the website's forms, the newsletter service, invoicing software, a booking system.

Each one has to be in the SPF record, or sign its mail in a way DMARC accepts. Anything forgotten will start failing the moment a strict policy goes up.

Each domain gets a single SPF record. Publishing another one later for a new service breaks the check, so new senders are added to the existing line.

A worked example

A family company runs a dozen carnival rides at summer fairs, town festivals and company picnics, and books the next season's dates over the winter.

In September, as the season ended, its office address began receiving bounce messages by the hundred: rejections of watch and pharmacy spam the company had never sent.

In October two fair boards mentioned that its contract for next summer had landed in their junk folders. The domain had no SPF record and no DMARC policy, so nothing set its real mail apart from the forgeries.

Its web developer listed everything that sent mail as the company: the host's mail server, the newsletter service, the booking system for picnic rentals and the accounting software that emails invoices.

All four went into one SPF record, and a DMARC policy went up in monitoring mode, with reports to an address the developer reads. After a few weeks of clean reports, the policy moved to sending failures to junk.

The bounces slowed rather than stopped, since some servers still accept first and reject later. A filter moves them to a folder the office manager scans weekly for genuine failures.

Why forgery hurts your real mail

Spam filters judge a domain partly by the mail that carries its name. When recipients mark forged messages as spam, some of that suspicion attaches to your domain.

Without SPF and DMARC, a receiving server cannot separate your quotes and invoices from the forgeries, so both are judged together. With the records in place, your real mail passes checks the forgeries fail.

While the bounces continue

Do not reply to the bounces or follow anything in them. Some forged messages carry harmful links, and the returned copy carries them too.

A rule that files messages with the usual bounce subjects into a separate folder keeps the inbox usable. Check that folder now and then, because a genuine failure of your own mail looks exactly the same.

The counter-case

A few bounces now and then need nothing more than the delete key. Every domain is forged occasionally.

SPF and DMARC will not stop spammers writing your name; they help receivers recognise the forgery. A strict policy published before every sender is listed can block your own invoices, which is why it starts in monitoring mode.

But a domain without either record leaves receivers guessing. List your senders, publish SPF, then add DMARC and tighten it as the reports allow.

Senders first, then the policy

  1. Ask your host to confirm nothing left your account.
  2. Check whether your domain has SPF and DMARC.
  3. List every system that sends as your domain.
  4. Publish one SPF record covering all of them.
  5. Add DMARC in monitoring mode with reports.
  6. Tighten the policy once the reports are clean.
  7. File bounces in a folder you check.

Step three decides whether the rest helps or hurts. A record that leaves out the invoicing software or the booking system starts failing your own mail, which is worse than the bounces.

Bounces for invented addresses at your domain are covered in a catch-all inbox full of spam.

Frequently asked questions

Why am I getting bounces for mail I never sent?

Spammers put your domain in the sender line. Servers that accept their mail and reject it later send the rejection to the apparent sender, which is you.

Does it mean my email was hacked?

Usually not. Forging a sender address needs no access to your account. Ask your host to confirm nothing unusual was sent from it, to be sure.

What does an SPF record do?

It names the servers permitted to send your domain's mail, so receiving servers can recognise mail from anywhere else as a likely forgery.

What does DMARC add to SPF?

It applies the checks to the visible From address, tells receivers whether to deliver, junk or refuse failures, and sends you reports of who uses your domain.

Can SPF break my own email?

Yes, if it leaves out a system that sends as you, such as invoicing software or a newsletter service. List every sender first, and keep one record.

Will the bounces stop completely?

They should slow, but some servers still accept forged mail and reject it later. Filter bounces into a folder and check it for genuine failures.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Inbox full of bounces you never caused?

Tell us your domain. We will check its SPF and DMARC records and list every service that should be in them.

Start a Conversation