From isc.sans.edu
If there is a place where you can always find juicy information, it’s your spam folder! Yes, I like spam and I don’t delete my spam before having a look at it for hunting purposes. Besides emails flagged as spam, NDR or “Non-Delivery Receipt” messages also deserve some attention. One of our readers (thanks to him!) reported yesterday how he found a “spam farm” based on bounced emails. By default, SMTP is a completely open protocol. Everybody can send an email pretending to be Elon Musk or Joe Biden! That’s why security control like SPF[1] or DKIM[2] can be implemented to prevent spoofed emails to be sent from anywhere. If not these controls are not implemented, you may be the victim of spam campaigns that abuse your domain name or identity. The “good” point (if we can say this) is that all NDR messages will bounce to the official mail server that you manage. That’s what happened with our reader, he saw many bounced messages for unknown email addresses.