Bounce Address

What is a Bounce Address?

A bounce address, also called the return path or envelope sender, is the email address that receives non-delivery reports (NDRs) when an email cannot be delivered. This address is separate from the "From" address visible to recipients and is used exclusively for automated delivery notifications.

How Bounce Addresses Work

Email transmission uses two sets of addresses:

From: John Doe <[email protected]>

MAIL FROM: <[email protected]>

When delivery fails, the receiving server sends the bounce to the envelope sender, not the header From address.

SMTP Conversation Example

Client: MAIL FROM: <[email protected]>
Server: 250 OK
Client: RCPT TO: <[email protected]>
Server: 550 No such user here
Client: QUIT

# Later, server sends bounce to [email protected]

Types of Email Bounces

Hard Bounces

Permanent delivery failures:

• User doesn't exist: 550 No such user
• Domain doesn't exist: 550 Domain not found
• Rejected by policy: 550 Spam blocked

Soft Bounces

Temporary failures:

• Mailbox full: 452 Insufficient system storage
• Server temporarily unavailable: 421 Service not available
• Message too large: 552 Message size exceeds limit

Block Bounces

Deliverability issues:

• IP blacklisted: 554 Service unavailable; Sender IP blocked
• Content filtered as spam: 550 Spam score too high
• Rate limiting: 450 Too many emails

Bounce Address Configuration

Setting Return Path in Email Headers

$to = "[email protected]";
$subject = "Test Email";
$message = "Email body";
$headers = "From: [email protected]\r\n";
$headers .= "Return-Path: [email protected]\r\n";

mail($to, $subject, $message, $headers, "-f [email protected]");

$mail = new PHPMailer();
$mail->From = "[email protected]";
$mail->Sender = "[email protected]";  // Return path
$mail->addAddress("[email protected]");
$mail->Subject = "Test Email";
$mail->send();

# /etc/postfix/main.cf
sender_canonical_maps = hash:/etc/postfix/sender_canonical

# /etc/postfix/sender_canonical
@example.com    [email protected]

# Apply changes
postmap /etc/postfix/sender_canonical
systemctl reload postfix

Dedicated Bounce Handling Services

Most email service providers offer bounce management:

{
  "Message": {
    "Subject": "Test",
    "From": "[email protected]",
    "ReturnPath": "[email protected]"
  }
}

const msg = {
  to: '[email protected]',
  from: '[email protected]',
  replyTo: '[email protected]',
  return_path: '[email protected]',
  subject: 'Test Email',
  text: 'Email body'
};

Bounce Address Naming Conventions

Subdomain Approach

[email protected]           # General bounces
[email protected]          # No-reply emails
[email protected]           # Returns/receipts

Campaign-Specific

Track bounces per campaign:

[email protected]
[email protected]
[email protected]

Variable Envelope Return Path (VERP)

Encode recipient in bounce address:

Sending to: [email protected]
Return path: [email protected]

When bounce arrives at bounces+*, parse to identify failed recipient

Processing Bounce Messages

Automated Bounce Parsing

import email
from email import policy

def parse_bounce(raw_email):
    msg = email.message_from_string(raw_email, policy=policy.default)

    # Extract bounce type
    if "550" in msg.get_payload():
        return "hard_bounce"
    elif "452" in msg.get_payload():
        return "soft_bounce"

    # Extract failed recipient
    for part in msg.walk():
        if part.get_content_type() == "message/delivery-status":
            # Parse delivery status
            pass

    return bounce_info

# Integrate with mailing list to remove hard bounces

Webhook-Based Bounce Handling

Modern ESPs provide webhooks:

POST /bounce-webhook
{
  "email": "[email protected]",
  "event": "bounce",
  "reason": "550 5.1.1 User unknown",
  "type": "blocked",
  "status": "5.0.0"
}

SPF and Bounce Addresses

SPF checks the envelope sender (bounce address), not the From header:

Message:
  From: [email protected] (header)
  Return-Path: [email protected] (envelope)

SPF Check:
  Queries: mail-server.com TXT record (not example.com)
  Must include sending IP in mail-server.com's SPF

Bounce Domain SPF Configuration

bounces.example.com.    IN    TXT    "v=spf1 include:_spf.sendgrid.net ~all"

Ensure your bounce subdomain has appropriate SPF records for your sending infrastructure.

Bounce Address Best Practices

Use a Dedicated Bounce Address

Never use your primary email for bounces:

# Bad
Return-Path: [email protected]

# Good
Return-Path: [email protected]

Monitor Bounce Rates

Implement Bounce Processing

Automate removal of hard bounces:

-- Mark emails with hard bounces
UPDATE mailing_list
SET status = 'bounced', bounce_count = bounce_count + 1
WHERE email IN (SELECT email FROM recent_hard_bounces);

-- Remove after 3 hard bounces
DELETE FROM mailing_list
WHERE bounce_count >= 3;

Separate Transactional and Marketing Bounces

[email protected]  # Order confirmations, receipts
[email protected]      # Newsletters, campaigns

Different bounce rates are expected for each type.

Set Up Bounce Processing Automation

#!/bin/bash
# Process bounces every hour

# Fetch bounces from IMAP
fetchmail -c /etc/fetchmailrc

# Parse and update database
/usr/local/bin/process-bounces.py

# Clean up processed bounces older than 30 days
find /var/mail/bounces -mtime +30 -delete

Backscatter and Bounce Security

Backscatter Problem

When your server accepts spam and then bounces it, you're sending to forged addresses:

1. Spammer sends email with forged From
2. Your server accepts it
3. Your server realizes it's spam/invalid
4. Your server bounces to forged From address
5. Innocent party receives bounce (backscatter)

# Postfix: Reject unknown users at SMTP time
smtpd_recipient_restrictions = reject_unauth_destination
local_recipient_maps = hash:/etc/postfix/local_recipients

Bounce Forgery

Attackers can forge bounce messages to:

• Harvest valid addresses
• Deliver spam disguised as bounces
• Phish credentials via fake delivery reports

• Check bounce originated from MX server
• Verify bounce is for email you actually sent
• Parse delivery-status headers carefully

Common Bounce Scenarios

Scenario 1: All Emails Bouncing

Scenario 2: Bounces Not Being Received

Scenario 3: High Soft Bounce Rate

Scenario 4: Bounce Loops

Testing Bounce Handling

# Test bounce to invalid address
swaks --to [email protected] \
      --from [email protected] \
      --server mx.test-domain.com

# Check if bounce arrives at [email protected]

dig bounces.example.com TXT
# Should show SPF record with authorized senders

Proper bounce address management is critical for maintaining sender reputation, list hygiene, and deliverability.