Bounce emails for unknown addresses

You're seeing email bounces in your inbox with subjects like Undeliverable: "j..d.o.e"@example.com. The addresses aren't in your address book and you don't remember sending anything to them.

This article explains where they come from and what you can do about them.

The symptom

Bounces in your inbox with subjects like Undeliverable: "j..d.o.e"@example.com. You don't recognise the addresses and you didn't send anything to them.

The cause

Your site has a form that sends a confirmation email — an account signup, a newsletter opt-in, or an order confirmation. A bot submitted the form with a made-up address. Your site sent the confirmation, it couldn't be delivered, and the bounce came back to the From address on your site's outgoing mail. That's a mailbox you read.

There are two kinds, with different causes.

Kind 1: invalid format

The address isn't a valid email address at all — quotes, double dots, or other characters RFC 5321 doesn't allow, for example "j..d.o.e"@example.com.

Cyberfusion's mail server refuses it:

553 5.1.3 not a valid RFC address

Your form should never have accepted this. Its email validation is too permissive.

Kind 2: valid format, mailbox doesn't exist

The address is well-formed but no mailbox exists at it, for example notarealaccount1234@gmail.com. Cyberfusion's mail server accepts it and tries to deliver. The receiving side — Gmail here — rejects it:

552 5.1.1 Requested mail action aborted, mailbox not found

Your site couldn't have known. There's no reliable way to check whether an arbitrary address exists without sending to it.

What you can do

1. Send from a noreply address

Fixes: kind 2, which you can't prevent.

Change the From address on your site's outgoing mail to a noreply@yourdomain.com mailbox you don't monitor. The bounces still happen, they just land there instead of in your inbox.

To stop that mailbox filling up forever, either set it up as an alias that discards incoming mail, or add a mail filter that deletes anything with Undeliverable: in the subject.

2. Tighten the form's validation

Fixes: kind 1, completely — the mail is never sent.

Make your form reject addresses that don't conform to RFC 5321. Most modern web frameworks and WordPress plugins already do this. If yours doesn't, replace the validation with a stricter one.

3. Reduce bot signups

Fixes: both kinds, partly.

Add a CAPTCHA, a honeypot field, or a per-IP rate limit on the form. Fewer bot submissions means fewer bounces. See Bot traffic and DoS attacks.