Some months ago, I started to receive some emails from "Mail Delivery Subsystem" (mailer-daemon@googlemail.com). Despite this is "automatic" failure email, I thought these emails were spam, so I just ignored. But today much more emails, and this started to disturb me.

These emails are send from mailer-daemon@googlemail.com (there is a icon that indicates a reply email) and says that "MYEMAIL@aol.com couldn't be found". "MYEMAIL" is the email that is receiving these messages, but with domain "aol.com" (I don't have any email from this domain).

In these emails, there is always a attached file about something attractive, like diets and wines. I think the most curious detail is that I was receiving these emails but in a "normal way". Before receiving from mailer-daemon, I was receiving like normal spam, even with the same subject, and at some point this has changed to mailer-daemon. Another detail is despite these emails always have a attached file, I can't see the attached file icon's until I open the email. Only then, when I close the email, I can see the attached file icon's. Obviously I never downloaded these files

I already changed password, checked login's entries and everything seems to be normal. I can just block emails from mailer-daemon@googlemail.com, but I'm concerned about why this is happening.

  • I have two-factors autentication enabled too.
    – Mycroft
    May 29 '19 at 14:51

I've had this issue before, with another e-mail provider. In my case, someone was able to obtain my e-mail address, but not my password.
Then, my e-mail address was used as the "reply-to" or the "sent-from" address on a spam e-mail.

It is annoying, but you're e-mail itself is probably safe. (TFA helps).

Example for clarity:
Through whatever means, I notice that a valid e-mail address is Mycroft@googlemail.com.
Now, I can authenticate to another mail server, say postoffice.com. I can then use a sendmail program that does something like this:
to: JoeBloggs@aol.com from: Mycroft@googlemail.com Subject: Best Diet Program Ever!! Body: blah, blah, blah. For more info, click here! EOT

You will then get the mailer-daemon message, and I have not compromised your e-mail, but I have compromised your email ADDRESS.

  • 1
    Oh, thank you for clarify. Is there a way that I can handle with this or my only option is block emails from googlemail?
    – Mycroft
    May 30 '19 at 21:05
  • Not that I know of. I see 3 possibilities: 1) Do nothing and they will (eventually) go away. 2) Change your e-mail address. 3) Block them, or filter into spam (I'm guessing you might want to see a legitimate mailer-daemon email if one you sent really didn't go through).
    – Scottie H
    May 30 '19 at 21:16
  • All these email are going to spam, but how can I block them without blocking every email from googlemail?
    – Mycroft
    May 30 '19 at 21:19
  • 1
    That depends on your mail client program. You may be able to set up a rule that says anything from <source> goes directly to the trash. I don't believe you can stop receiving them all together.
    – Scottie H
    May 30 '19 at 21:30

This is probably backscatter spam, in which a spammer sends out junk with a forged sender address. Recipient addresses that bounce (on servers misconfigured to send bounce messages as external email) will be sent to that forged sender address.

In this case, that was you.

However, it seems highly unlikely that Google is so misconfigured. If you can paste a copy of one of those bounces as source code in your question, I can help you determine whether it truly came from Google or if the whole thing is forged.

My suspicion is that you're forwarding these messages to another (non-Google) account and the receiving system has SMTP-rejected them as spam, which will generate a legitimate bounce message back to you.

  • I've also received some of these emails from mailer-daemon@googlemail.com as well. All are just advertisement/spam mails, things that I'd never read, let alone forward to anyone.
    – Hp93
    Jul 17 '19 at 7:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.