I received an undelivered mail, is it malicious?

In case of Undelivered mail, you might also want to double check the headers of the attached mail. In particular, pay a lot of attention to the Received: from header (well.. the header is just Received...). Two circumstances (assume mx.example.org is the server who sends the return): You don't find your own MX on the stack. ✔ Case closed, someone is (failing at) spoofing your email You do find your own MX somewhere on the stack. Now check: If your server is the first entry after mx.example.org…  You must investigate further. Your account might really have been pwned (because of a leaked password) to be used for spam. You may want to check your password for leakage at haveibeenpwned.com and the server logs for suspicious activity. Another interpretation is that the header, which is just a plaintext header, was forged. This would mean that there is no attempt to deliver mail at someone@example.org but instead someone else is trying to deceive you into thinking you sent an undeliverable mail. It is unlikely, but without checking the contents of the attached email for malware, it's just hypothetical. Also, don't forget that the foreign mail server could be poorly configured, worse than not just checking for SPF/DKIM.

If your server is not the first entry after mx.example.org… ⚠ This means that the email claims to have bounced back and forth. It is unlikely, especially for how SPF works. Unless some strict corporate routing configuration for firewalled stations, emails travel non-stop from the origin ISP to the destination ISP 99.9% of cases. In that case, the header was very likely forged to give more credibility to the email, deceiving the old anti spam filter ("hi Mr. mail server, I have to deliver mail to you that was given to me by the intended sender"). I'd still trash it, but maybe you would take a look, low priority, at the logs for message id. Just as a triple-check. You can somewhat reduce the problem of such misuse by having strict SPF policies (and better also DKIM and DMARC) but this does not help much if the initial mail server will not check such policies or not block the mail based on the policies. This was my case, and apparently the server never enforced those policies on their side to discard that mail allegedly coming from myself. Case closed.