On Thu, Oct 02, 2014 at 04:59:45PM +0200, Daniele Nicolodi wrote: > Sending a message directly to the user account does not result in a > delivery attempt from account.microsoft.com, therefore I believe there > is not an auto-responder in action on the user account.
In that case something more complex is going on. > However, I fail to see how the auto-responder would send mail from a > scammer controlled domain. If it is an auto-responder configured on the > hotmail service, the automatic response should originate from hotmail. > Am I missing something? I too would expect that to the case, but I don't know what options Microsoft gives for automating message processing. > > If Microsoft really sends notices from a non-existent domain, shame > > on them. > > That's the only conclusion I can draw from the observations. You could temporarily exempt that particular address from "reject_unknown_sender_domain", and REDIRECT it to an admin mailbox, then you may be able to see what these messages are about. -- Viktor.