User flooded with Undeliverable messages RSS



One of my users have been receiving hundreds of "Undeliverable" messages every week for over a month. It happened to this user and to a few others before and it usually just stops after a day or two. But not this time.

I understand this means some spammer is using his e-mail address as the reply-to address on spam e-mails but I'd like to know what the best plan of action would be? I don't think the keyword filter would work as it would block legit "Undeliverable" messages and also because these messages have different subjects and are in dozens of languages.

We're on Exchange 2003.
Changing his e-mail address isn't a possibility.


by PL 8 years ago

@PL: This is called email backscatter: a spammer spoofs your user's email address, and the spam target recipient servers floods the user with NDRs (of emails he/she never sent actually). For solutions, please read our article at

by Krisztian Fekete (ORF Team) 8 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

Email address (will not be published):
Your comment:

ORF Technical Support

Configuring, installing and troubleshooting ORF.

News & Announcements

Your dose of ORF-related news and announcements.

Everything but ORF

Discuss Exchange and system administration with fellow admins.

Feature Test Program

Feature Test Program discussion. Membership is required to visit this forum.

ORF Beta

Join the great bug hunt of the latest test release.

Customer Service

Stay Informed