What You Need to Know About Mailer Daemon Spam

When you send an email to an address that no longer exist, you'll receive a response from the "mailer-daemon" indicating that your message wasn't delivered. If your inbox is suddenly inundated with delivery failure reports, it could be the result of someone sending emails from your address without your knowledge.

Information in this article applies to all email services.

What Is the Mailer-Daemon?

Email works like virtual a postal system. When you send an message, it first goes to a server called the mailer-daemon. That server passes the message on to other servers until the message is delivered to the recipient's inbox. When delivery fails, a mailer-daemon error message is generated and sent back to the original sender.

What Is Mailer-Daemon Spam?

Mailer-daemons do not use the address in the "From:" line to determine an email's sender; instead, they use the email header, which includes a return path containing the sender's address. By forging your address in the email header, spammers are able to send messages that appear to be from you without having access to your account. If they send an email to an addresses that no longer exist, then you'll receive mailer-daemon spam.

Since every email needs to have a sender in the "From:" line, and spammers don't want to use their own email addresses, they often look up random addresses in people's contacts to use for phishing and other nefarious purposes. If you open an email containing a virus or worm, it can infect your computer and begin sending infected messages to everyone in your address book. Receiving mailer-daemon spam doesn't necessarily mean you have malware, but there are some precautions you need to take.

What to Do if You Receive Mailer-Daemon Spam

Here are steps you should take if you're receiving mailer-daemon spam:

Scan your computer and devices for malware. When you scan your computer for malware, make sure you're disconnected from the internet, and change all of your account passwords when you're done.
Report the mailer-daemon spam as junk mail. Most email programs have an option to flag emails as spam. For example, when you report spam in Gmail, Gmail uses the information in the email to block similar messages in the future.
Tell all of your contacts. If you're receiving mailer-daemon spam, then it's possible that some of your contacts received infected emails from you. Let everyone know what happened, and tell them to ignore any suspicious messages from your address.

Is Anything Being Done to Stop Mailer-Daemon Spam?

Email servers have measures in place to limit the amount of useless delivery notifications they send. For example, they may try to determine whether a return address has been forged before sending a delivery failure message. If the address is obviously not the real sender's, no error email is sent. Email servers receiving large amounts of delivery failures for an address (typically with content that is either spam or malware) may either silently delete these messages or quarantine them in your spam folder.