@ExperimentalGuy@programming.dev This doesn’t involve security. This is just about a protocol that says a server must let you know, via one email for each rejection, that an email with your from address couldn’t be delivered, regardless of whether you sent it.

It’s a procedural problem.

If a spammer sends 5 million emails with your email address in the FROM: then you can expect hundreds of thousands of messages from your email provider telling you that it couldn’t deliver an email, for whatever reason.

Here. Let Google explain it: https://support.google.com/mail/thread/209018675/my-sent-email-box-is-filling-up-with-bounce-emails-and-emails-i-did-not-send-my-inbox-is-fine?hl=en

@kalpol@lemm.ee No idea what you are saying here. But, you can argue with Google: https://support.google.com/mail/thread/209018675/my-sent-email-box-is-filling-up-with-bounce-emails-and-emails-i-did-not-send-my-inbox-is-fine?hl=en

@ikidd@lemmy.world People are not reading. You are not reading.

SPF, DKIM and DMARC are not relevant. Those are instructions to the receiving servers which are not the ones sending the bounces. The receiving server is telling the sending server, based on these DNS records, that it will not accept the message. It refuses them. Period. No bounce message.

The sending server then, as a courtesy, lets the sender know, solely based on the FROM: address, that the email could not be delivered, as one by one messages.

There are no DNS records or configurations that control this. The SMTP server follows the protocol which is to inform the FROM: address, as a courtesy, that the email was not accepted. It is the sender. It does not look at SPF, DMARC, and DKIM rules. That is only what the destination server uses.

@lautreg SPF and DKIM are only used by the destination IMAP or POP3 servers to see what to do when they receive the email. In this case they reject it.

The delivery failure message is coming from the sending server as a courtesy message to the sender to let them know their email was not delivered. The protocol is to tell the FROM: address that the email could not be delivered. The SMTP, sending server, doesn’t look at SPF, DKIM or DMARC or any DNS records or any other configuration related to it. It simply tells you the millions of emails sent with your FROM: address could not be delivered, one by one.

People keep bringing up SPF, DKIM, and DMARC, but it’s not relevant to this problem.