Why am I getting bounces for emails I never sent?

Open a bounce and find the copy or the headers of the original message it is returning.

Look at the servers the original passed through. If none of them is your mail provider, the message was forged and never touched your systems.

Look for a DKIM signature made with your domain. Forged mail carries none, or one that fails; mail sent through your real account carries a valid one.

Look at the sender policy verdict. Forged mail usually fails SPF for your domain, because it came from a server you never authorised.

If the original was signed by your domain and sent through your provider, treat it as a compromised account: change the password, enable multi-factor authentication and look for forwarding rules you did not create.

The mail protocol lets a sending server write any address as the sender, both in the envelope and in the From header.

Nothing in the protocol itself stops someone else putting your domain there.

Sender policy, DKIM and DMARC exist to let receivers check the claim — but only receivers that check, and only if your domain publishes the records.

So you cannot stop anyone from forging your domain; you can make receivers reject the result.

A sender policy that lists your real sending services and ends in a hard fail, so unlisted servers fail explicitly.

DKIM signatures on all your legitimate mail, so it can align even where SPF does not.

A DMARC policy of quarantine or reject, which tells receivers what to do with mail that fails alignment.

Under a monitoring-only DMARC policy, receivers may still accept forged mail — the policy asks them to report, not to act.

The DMARC policy should also cover subdomains, since forging an unused subdomain is an easy way around a policy that covers only the main one.

Receivers that honour DMARC reject forged mail during the transaction, so nothing is bounced back to you.

Receivers that accept mail first and check later generate a bounce afterwards, and they send it to the forged address.

Those are misconfigured receivers, and their bounces will keep arriving at a lower rate whatever you publish.

Filtering bounces that refer to messages your systems never sent is the practical remedy for what remains.

The aggregate reports DMARC receivers send show the forged sources directly, which is a better measure of the problem than counting bounces.

Replying to the bounces, which only generates more mail.

Changing your own passwords when the evidence says the mail was forged — worth doing for hygiene, and irrelevant to the forgery.

Adding more services to the sender policy, which widens what is authorised rather than narrowing it.

Waiting it out: forgery campaigns come and go, and a domain without an enforcing policy stays available for the next one.

Whether the domain publishes a sender policy and how strictly it ends.

Whether DMARC is published, what policy it states, and whether it covers subdomains.

Whether reporting addresses are configured, so forged sources become visible.

Whether DKIM keys are published at the selectors your services use.

Taken together, how exposed the domain is to being forged successfully — which is the part you control.