MX Messaging Resources

Welcome to MX Messaging Resources Sign in | Join | Help
in Search

MX Watch

NDRs (Non-Delivery Reports)

NDR spam: Why am I receiving an NDR for a message I didn’t send?

NDRs are a normal part of email exchanges, but spammers' activities can cause spikes in NDR activity. Spammers send junk messages to thousands of email addresses, some of which exist and some of which do not. To give the appearance that their messages are legitimate, spammers use a practice called "spoofing," whereby they manipulate the "From" address to use a real domain or sender.

When a spammer sends email to an invalid address, the receiving mail server sends an NDR message to the "From" address, rather than to the actual sending server. Because spammers spoof common addresses, such as sales or info of well-known companies, these NDRs may be destined for your mail server.

Undelivered Mail Returned to Sender

Your message did not reach some or all of the intended recipients.

Subject: Report update

The following recipient(s) could not be reached:

webmmaster@jumboinc.com on 03/15/2008 11:09 PM

The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address.

Another challenge is that the growth in NDRs is driven by the overall growth in spam activity. The more messages spammers send, the greater the number of spam messages sent to invalid addresses, resulting in more NDRs.

We highly recommend that anyone running a corporate email server invest in top-of-the-line Anti-spam technology.  It will pay off a thousand fold in the long run.  Most good anti-spam solutions do a reasonable job of limiting the impacts of NDR spam attcks.  But almost all still will allow a sender to try quite a few bad recipients before shutting them down. 

Published Wednesday, September 10, 2008 10:17 AM by Wendy
Filed under:

Comments

 

luckman212 said:

Hello,

I read this article and am curious if implementing SPF rules at the MX level would help in these kinds of spoofed 'from' situations?  My understanding of SPF is weak but am I correct that if a mail server honors this setting, then it will somehow verify that the IP/source of a message is authorized to send a message for a particular domain?

November 12, 2008 12:14 PM
 

Wendy said:

SPF records can be a really great source of protection for your network. However, they only really work if the other person you are communicating with has an SPF record as well. The use of an SPF record is becoming more common, but it is not required or implemented by all servers and may not protect your network in the end.

Here is a great site for creating an SPF record: http://old.openspf.org/wizard.html,.

Another great wizard is available from Microsoft at http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/.

NOTE: If you are not certain of all the places that are able to send mail on your behalf (fax machine, 3rd party services, websites etc) it can cause problems.

We would not recommend implementing an SPF if you are intensely aware of your network infrastructure as an improperly configured SPF record can have drastic affects on your mail flow.

Thank you,

Wendy @ MxToolBox

November 12, 2008 12:30 PM
Anonymous comments are disabled