Send & Receive Issues

Fix Undeliverable Messages After External Emails in Microsoft 365

Maira Mehtab Sep 27, 2026 869 views

Question details

The user receives a non-delivery report (NDR) addressed to a masked external email address immediately after receiving any external email.

Product: Microsoft 365
Device & OS: not provided
Scenario: Receiving incoming messages from outside the domain triggers an immediate undeliverable bounce-back alert.
Observed behavior: An 'Undeliverable' message with the same subject as the incoming email is generated and sent back to the user due to an automatic forwarding rule being blocked by the system.

Before you start

Ensure you have Microsoft 365 global administrator or Exchange administrator privileges, as modifying outbound spam filter policies requires administrative access to the Microsoft Defender portal.

Solution 1Recommended

Adjust the Outbound Spam Filter Policy

Modify the automatic external forwarding settings in the Microsoft 365 Defender portal to prevent legitimate forwarded emails from being blocked by the outbound spam policy.

This issue typically occurs when a mailbox is configured to automatically forward incoming emails to an external address, but the organization's outbound spam policy restricts automatic external forwarding.

Log in to Microsoft 365 Defender

Navigate to the Microsoft 365 Defender portal (security.microsoft.com) and sign in with your administrator credentials.

Access Threat Policies

Go to Email & Collaboration in the left navigation menu, select Policies & Rules, and then click on Threat policies.

Edit Anti-spam Settings

Select 'Anti-spam' and click on the 'Anti-spam outbound policy (default)' to open its settings panel.

Modify Automatic Forwarding Rules

Click 'Edit protection settings', locate the 'Automatic forwarding rules' section, and change the setting from 'System-controlled' to 'On - Forwarding is enabled'.

Save the Policy

Click Save to apply the changes to the outbound spam filter policy.

Propagation Time: Please allow some time (up to 24 hours in some cases) for the policy changes to fully propagate across the Microsoft 365 environment before testing the email flow.

Solution 2

Run a Message Trace to Identify Forwarding Rules

Investigate why the incoming messages are being forwarded to the masked external address by running a message trace to locate hidden rules.

Free Microsoft Office alternative

Looking for a Lightweight Alternative to Microsoft Office?

While WPS Office does not manage backend Microsoft 365 Exchange server policies, it serves as an excellent, free alternative for your daily document, spreadsheet, and presentation needs. Enjoy a highly compatible and user-friendly office suite without the heavy administrative overhead.

1. Visit the WPS Office Website: Go to the official WPS website to download the latest version for your operating system.
2. Install the Suite: Run the downloaded installer file and follow the on-screen instructions to complete the setup.
3. Start Creating: Open WPS Writer, Spreadsheet, or Presentation to immediately start working on your files with full Microsoft Office compatibility.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx).Free and lightweight, consuming minimal system resources.Built-in PDF editing and seamless document management.Familiar user interface for a zero-learning-curve migration.

microsoft office alternative - wps office

Frequently Asked Questions

Why am I receiving an NDR immediately after receiving an external email?

This happens when your account has an automatic forwarding rule set up to send incoming emails to an external address, but your organization's outbound spam policy actively blocks external auto-forwarding. The system rejects the forward attempt and sends you a non-delivery report.

Can a standard user fix this automatic forwarding block?

No, standard users cannot adjust the outbound spam filter policy. Modifying Microsoft Defender settings requires administrative privileges. You will need to contact your IT department or Microsoft 365 global administrator to make the change.

How can I find out what external address my emails are trying to forward to?

A Microsoft 365 administrator can run a Message Trace in the Exchange Admin Center to reveal the exact routing path and uncover the masked destination address that the emails are attempting to forward to.

How long does it take for anti-spam policy changes to take effect?

Policy changes in the Microsoft 365 Defender portal typically take effect within 1 hour, but depending on the tenant size and server synchronization, it can occasionally take up to 24 hours to fully propagate.

Outlook & Email Problems