[ Headers & delivery errors ]
Backscatter: why a bounce can involve a forged sender address
An unexpected bounce can be collateral damage from someone forging your envelope address; correlate it before treating it as proof of account compromise.
By the EmailAuth research team · 4 min read
[ Key points ]
- Separate disruption from compromise
- Inspect acceptance and notification paths
- Preserve evidence safely
[ Takeaway ]
An unexpected bounce can be collateral damage from someone forging your envelope address; correlate it before treating it as proof of account compromise.
[ By role ]
What this means for you
Choose your role for practical next steps.
IT / Mail Admin
Inspect acceptance and notification paths
The reverse path explains where delivery errors go.
Next steps
- Correlate original submissions.
- Test invalid-recipient policy.
- Suppress error-on-error loops.
CISO / SecOps
Preserve evidence safely
Returned content can contain sensitive or hostile material.
Next steps
- Avoid unexpected links.
- Restrict diagnostic sharing.
- Document known and unknown origin.
Founder / Non-technical
Separate disruption from compromise
Unexpected notifications need triage without unsupported incident claims.
Next steps
- Assess mailbox impact.
- Confirm outbound-log coverage.
- Escalate verified unauthorized sending.
[ FAQs ]
Frequently asked questions
Does a bounce prove someone used my password?
No. A forged envelope address can direct a notification to you without account access.
Which address normally receives delivery failures?
The SMTP envelope reverse path, subject to the applicable delivery-notification rules.
Is the visible From address necessarily the reverse path?
No. They are separate identities and can legitimately differ.
What does an empty reverse path do?
It marks a notification path that must not trigger another error notification, helping avoid loops.
RFC 5321 SMTP RFC 3834 Automatic Responses to Electronic Mail
Should I reply to every unexpected bounce?
No. Correlate it with trusted logs and avoid creating automatic response loops.
Can rejecting an invalid RCPT prevent one kind of backscatter?
Yes. It can avoid later notifications for that refusal when the recipient is rejected before message acceptance.
Was the example an actual forged delivery?
No. It is an explicitly illustrative routing model using reserved names.
What justifies a compromise investigation?
Trusted evidence of unauthorized submission or account activity, rather than bounce arrival alone.
[ Sources ]
Sources
- RFC 5321 SMTP
Sections §3.3 · §4.1.1.3 · §4.4 · §6.1
- RFC 3834 Automatic Responses to Electronic Mail
Sections §3 · §4
- RFC 3464 Delivery Status Notifications
Sections §2.2 · §2.3
[ Glossary ]
Glossary
- Backscatter
- An unsolicited notification reaching an innocent party because an earlier message used a forged return address.
- Reverse path
- The return address carried by SMTP MAIL FROM, which can be empty.
- Null reverse path
- The empty SMTP reverse path, written <>.
Enterprise provenance
Why top financial institutions and governments retired their email security dashboards.
Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.
EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.
SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption