When Gmail Says “Message Blocked” (Backscatter Spam Explained)

When Gmail says “Message blocked” – but you never sent it

You check your inbox and see a frightening subject: Delivery Status Notification (Failure) — Message blocked. The message looks like a bounce from Google, and it even contains a forwarded email that includes suspicious images or links. Panic sets in: Did someone use my address to send spam? Is my account compromised?

Short answer: most of the time you’re seeing backscatter spam – a legitimate Gmail bounce generated because a spammer forged your address. This post explains what that means, how to check the evidence safely, and exactly what to do next.

What happened (in plain terms)

Spammers often forgery the “From” address to make emails appear to come from someone else. When those forged messages fail to deliver, mail servers produce bounce messages (DSNs). Google generates a DSN legitimately – and you receive that bounce. The bounce looks “official” (dkim/dmarc might pass because Gmail itself signed the DSN), but it doesn’t mean Google, or you sent the spam.

Common pattern you’ll see:

• Subject: Delivery Status Notification (Failure) or Message blocked
• A forwarded section showing a suspicious sender (e.g., ebay@r****ru.com) and an AWS-hosted image or HTML link.
• Headers that include Return-Path: <> and In-Reply-To pointing to the spam origin domain.

Quick header checks (safe — no clicks)

Open the message → the three dots → Show original. Look for:

• Authentication-Results: dkim=pass, spf=pass/fail/none, dmarc=pass/fail
  • If DKIM and DMARC show pass, Gmail likely generated the DSN (it didn’t mean your mailbox sent the spam).
• Return-Path: <> — typical for bounces (normal).
• In-Reply-To: may show the source domain (clue to the spammer).
• Received: read bottom→top – earliest entries show origin IP/host.

If the headers show Google generated the DSN (DKIM/dmarc pass and Return-Path: <>), you’re almost certainly a forgery victim – not the spammer.

What to do immediately (safe steps)

1. Do not click any links or attachments in the forwarded section.
2. Report phishing in Gmail (three dots → Report phishing / Report spam).
3. Download the original (EML) for records, but keep it offline and redacted before sharing.
4. Change passwords & enable 2FA if you suspect compromise (precautionary).
5. Check third-party apps in Google Account → Security → Third-party access. Revoke any you don’t recognize.
6. Scan the suspicious URL safely by copying it as text and checking VirusTotal/URLScan (don’t click).
7. Ignore the DSN: you don’t need to reply — the DSN is an automated bounce.

How DF4IT recommends you publish a case study (if you want to share)

• Redact personal emails and IPs.
• Replace links with hxxps[:]//example[.]com or show VirusTotal screenshots.
• Show only the header snippet you need (Auth results + top Received lines).
• Explain why DKIM/DMARC/SPF matter and how to interpret them.

Short checklist for elders & caregivers

• If a scary-looking letter/email arrives, don’t react. Call a trusted family member.
• Never provide login details or financial info based on an email.
• If you’re hit, consider fraud alerts with credit bureaus and report to the FTC.

Final note

Backscatter is annoying but usually harmless to you – it’s a sign of broader abuse on the internet. Use it as a prompt to tighten your account security, but don’t panic. If you want, I’ll redact your screenshot and build the DF4IT case-study page (safe to publish) so this real example teaches others.