We've observed an end to the previous NDR storm, but continue to see some spammers falsifying the "From" address of their spam messages, resulting in some users receiving numbers of bounce messages for messages they didn't send.

What is an NDR?

A non-delivery receipt (NDR) is a message that a mail server sends to notify the sender when a problem occurs with delivery.

For example, if you type a recipient's address incorrectly, the receiving server might send you a message that looks similar to this: 

Undelivered Mail Returned to Sender  
Your message did not reach some or all of the intended recipients.
Subject: Report update The following recipient(s) could not be reached: webmmaster@yourcompany.com on 05/15/2008 08:09 PM
The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address. 

Types of normal NDR messages include:
 

• User unknown: The recipient's address doesn't exist on the receiving server, and the message is bounced
• Server resources are unavailable; for example, the recipient's mailbox is full
• Auto-reply vacation or out-of-office messages
• Auto-reply list server or mailing list responses 

NDR spam: Why am I receiving an NDR for a message I didn’t send?

NDRs are a normal part of email exchanges, but spammers' activities can cause spikes in NDR activity. Spammers send junk messages to thousands of email addresses, some of which exist and some of which do not. To give the appearance that their messages are legitimate, spammers use a practice called "spoofing," whereby they manipulate the "From" address to use a real domain or sender.
 
When a spammer sends email to an invalid address, the receiving mail server sends an NDR message to the "From" address, rather than to the actual sending server. Because spammers spoof common addresses, such as sales or info of well-known companies, these NDRs may be destined for your mail server.



The good news is that your message security service recognizes the spam content in an NDR, and blocks large numbers of these messages so they never reach your mail server.