Bounce emails for addresses I don't know

You're seeing email bounces in your inbox with subjects like Undeliverable: "j..d.o.e"@example.com. The addresses aren't in your address book and you don't remember sending anything to them.

This article explains where they come from and what you can do about them.

What's happening

Your site has a form that sends a confirmation email — usually an account signup, a newsletter opt-in, or an order confirmation. A bot submitted the form with a made-up email address. Your site tried to send the confirmation, the message couldn't be delivered, and the bounce came back to the From address on your site's outgoing mail — which is a mailbox you read.

There are two flavours of bounce, with different underlying causes.

Invalid format

The address isn't a valid email address at all — it might have quotes, double dots, or other characters that RFC 5321 doesn't allow. For example: "j..d.o.e"@example.com.

Cyberfusion's mail server refuses to accept it and returns:

553 5.1.3 not a valid RFC address

The site should never have accepted this in the form field — its email validation is too permissive.

Valid format, mailbox doesn't exist

The address is well-formed but no mailbox exists at it — for example, notarealaccount1234@gmail.com. Cyberfusion's mail server accepts it and tries to deliver. The receiving side (Gmail in this example) then rejects it, because there's no such mailbox:

552 5.1.1 Requested mail action aborted, mailbox not found

The bounce comes back to you. Your site couldn't reasonably have known the address was fake — there's no reliable way to check whether an arbitrary email address exists without trying to send to it.

What you can do

1. Tighten the form's validation

For the invalid format flavour: fix your form so addresses that don't conform to RFC 5321 can't be submitted at all. Most modern web frameworks and WordPress plugins already do this correctly — if yours doesn't, replace the validation with a stricter one. This stops the entire "invalid format" category of bounce, because the mail is never sent in the first place.

2. Send from a noreply address

For the mailbox doesn't exist flavour: you can't prevent the bounce, because you can't know the address is fake until you try. What you can do is change the From address on your site's outgoing mail to a noreply@yourdomain.com mailbox that you don't monitor. Bounces still happen — they just land at noreply@ instead of in the inbox you read every day.

If you don't want the noreply@ mailbox to fill up forever, set it up as an alias that discards incoming mail, or add a mail filter that deletes anything with Undeliverable: in the subject.

3. Reduce bot signups in the first place

Both flavours are ultimately bot traffic. Add a CAPTCHA, a honeypot field, or a per-IP rate limit on the form — the fewer bot submissions get through, the fewer bounces you see. See Bot traffic, nuisance, and DoS attacks for the broader picture.