# Are out-of-office auto-replies a security risk?

URL: https://iblockspam.com/blog/out-of-office-auto-reply-security-risks
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> What out-of-office replies leak, why replying to spam confirms your address, and how to limit external auto-replies in Microsoft 365, Outlook and Gmail.

## Short answer

They can be. An external auto-reply tells any sender, including spammers and scammers, that your address is live, that you're away and for how long, and often who to contact instead. Keep external replies short and generic, send them only to contacts where you can, and let admins limit them with Microsoft 365 remote domain settings.

An out-of-office reply feels harmless: you're away, and you want people to know. But it goes to whoever writes to you, including spammers and fraudsters, and it often says more than you intended. This guide covers what auto-replies reveal, how they interact with spam, and the settings in Microsoft 365, Outlook and Gmail that keep them useful without the risk.

## What do out-of-office replies reveal?

A typical auto-reply answers several questions an attacker would otherwise have to work for.

| Detail in the reply | What it gives an attacker |
|---|---|
| "I'm away until 14 October" | A window when you can't easily confirm or deny a request |
| "I'm at a conference in Lisbon" | A believable pretext: "I'm stuck at the airport, can you pay this today?" |
| "For urgent payments contact Jane Smith, Finance Manager" | A name, a role and who handles money, ready for impersonation |
| Mobile or direct phone numbers | A channel for callback scams and voice phishing |
| Your signature, title and reporting line | Material for a convincing fake email from you or your manager |

The standard for automatic responses, [RFC 3834](https://www.rfc-editor.org/rfc/rfc3834.html), anticipated this. It lists "use of such responders to obtain personal information about recipients" as a known risk, and says automatically generated information "SHOULD NOT include personal information about the recipient which is not already known to, or easily available to, the sender". It even asks that user interfaces warn people that their reply text goes "not only to local colleagues but also to the entire Internet, including potential attackers."

This matters most for business email compromise. Payment fraud succeeds most easily when the real person is unreachable, and an auto-reply announces exactly that. Our guide to [business email compromise prevention](https://iblockspam.com/blog/business-email-compromise-prevention) covers the controls that stop a fake payment request, and [callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails) explains why published phone numbers get abused.

## What happens when an auto-reply answers spam?

Spam rarely comes from the address it claims. That causes two problems.

### Confirming your address

A reply proves a real mailbox exists and is being read. RFC 3834 names "use of such responders to determine whether recipient addresses are valid" as an abuse of auto-responders. An address that confirms itself is worth more on a spam list.

### Backscatter

When spam uses a forged return address, your auto-reply goes to an innocent third party. RFC 3834 warns that "return addresses are easily forged", and our guide to [backscatter](https://iblockspam.com/blog/backscatter-spam-bounce-messages) explains how those misdirected replies harm the person who receives them and, over time, your domain's reputation.

RFC 3834 sets out rules that good responders follow:

- Never reply to a null return path (`MAIL FROM:<>`), such as a bounce.
- Don't reply to messages with an `Auto-Submitted` header set to anything except `no`.
- Don't send the same notice to the same sender more than once in several days; "A 7-day period is RECOMMENDED as a default."
- Only reply when your address appears explicitly in To, Cc or Bcc, not to mail that reached you through a list.
- Responders "MAY refuse to generate responses except to known correspondents".

That last one is the most useful setting most users never change.

## How do you limit external auto-replies in Microsoft 365?

Microsoft 365 gives you two layers: what users choose, and what admins enforce.

### What users can choose in Outlook

In new Outlook and Outlook on the web, users turn on **Automatic replies** and can select **Send replies only to contacts**. In classic Outlook, under **File** > **Automatic Replies**, work accounts have **Inside My Organization** and **Outside My Organization** tabs. Microsoft's own advice is direct: sending replies to everyone outside "will send your automatic reply to every email you receive", "including newsletters, advertisements, and potentially, junk email", and it recommends the contacts-only option ([Microsoft Support](https://support.microsoft.com/office/how-to-set-up-out-of-office-automatic-replies-in-outlook-9742f476-5348-4f9f-997f-5e208513bd67)).

Encourage users to write two messages: a fuller one for colleagues and a short, generic one for outsiders.

### What admins can enforce with remote domains

Remote domain settings in Exchange Online apply to all mail going to external domains, and Microsoft says they "override settings that your users might configure in Outlook or Outlook on the web" ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/remote-domains/remote-domains)). If a remote domain blocks a reply type, "the reply is generated, but then it's deleted before it's sent. No error message is sent."

Every tenant has a remote domain named **Default** that covers all external domains without their own entry. Its out-of-office setting is the `AllowedOOFType` parameter ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-remotedomain)):

| AllowedOOFType | What external recipients get |
|---|---|
| `External` (default) | Only the reply users wrote for people outside the organization |
| `ExternalLegacy` | External replies, plus replies not marked internal or external |
| `InternalLegacy` | Internal replies, plus unmarked ones; useful for a close partner |
| `None` | No out-of-office replies at all |

To review or change it:

1. In the Exchange admin center, go to **Mail flow** > **Remote domains** and open **Default**.
2. Under **Out of Office reply types**, check which replies go to external recipients.
3. Under **Automatic replies**, decide whether to allow automatic replies and automatic forwarding.
4. Save, and test from an outside account.

In PowerShell, Microsoft's own example turns off all three for every domain without its own entry:

```powershell
Set-RemoteDomain -Identity Default -AutoReplyEnabled $false -AutoForwardEnabled $false -AllowedOOFType None
```

That's a strong setting. A gentler approach for most businesses is to leave `AllowedOOFType` at `External`, so internal detail never leaves, and use [manage remote domains](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/remote-domains/manage-remote-domains) to give specific partner domains different treatment. Note that `AutoReplyEnabled` is separate from out-of-office: Microsoft describes it as covering automatic replies "generated by rules in Outlook". Turning off automatic forwarding to external domains also helps against [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).

## How do you limit vacation responders in Gmail?

In Gmail, the vacation responder is under **Settings** > **See all settings** > **General** > **Vacation responder**. Google's [help page](https://support.google.com/mail/answer/25922?hl=en) describes the options:

- A checkbox to send the reply to your contacts only.
- Replies usually go only "the first time they message you", and again if the same person writes "after four days and your automatic reply is still on."
- "Emails sent to your spam folder or addressed to a mailing list you subscribe to don't get your reply."

Gmail's behavior of skipping messages in spam helps, so good spam filtering directly reduces auto-reply leaks. The better the filter, the fewer spammers ever receive your reply.

## Should shared mailboxes and helpdesks auto-reply?

Many businesses set info@, sales@ or support@ to acknowledge every message. Those addresses receive more spam than personal ones, so they send more replies to forged addresses. RFC 3834 asks responders to avoid being used "to launder or amplify abusive messages", and recommends that they "not relay significant content from the subject message".

In practice:

1. Don't quote the incoming subject or body in the acknowledgment. A spammer can otherwise make your server repeat their text to a third party.
2. Keep the reply short and in plain text.
3. Let your helpdesk skip messages your filter marks as spam, if it can.
4. Mark replies with `Auto-Submitted: auto-replied` if your system lets you, so other responders don't answer back.

## What does a safe out-of-office template look like?

Write two versions. The internal one can name a colleague and give context. The external one should be short and give nothing an attacker can use.

**External reply:**

> Thank you for your email. I'm currently away and will reply when I'm back. If your message is urgent, please contact our team at info@example.com or call our main office number on our website.

**Internal reply:**

> I'm out of the office until Wednesday 14 October. For client questions, contact Sam. For anything urgent on Project X, message the project channel.

Checklist for the external version:

1. No destination, travel details or reason for absence.
2. No return date unless customers really need it; "when I'm back" is usually enough.
3. A shared team address, not a named colleague's direct address.
4. The main office number already published on your website, not a mobile number.
5. No instructions about payments, approvals or who handles finance.
6. Contacts-only, or organization-only, wherever your client allows it.

Pair the template with a simple rule for staff: while someone is away, any request that claims to come from them and involves money, gift cards or credentials gets checked by phone using a number you already have. Our [awareness training guide](https://iblockspam.com/blog/email-security-awareness-training-small-business) suggests how to teach that.

## Next steps

- Check your Default remote domain in the Exchange admin center and confirm external out-of-office replies are set the way you intend.
- Send staff the two-version template before the next holiday season.
- Ask users to choose contacts-only replies in Outlook and Gmail, or to turn off replies outside the organization in Outlook.
- Reduce the spam that triggers auto-replies in the first place. Filtering before delivery means fewer spammers ever see a reply; iBlockSpam filters at the MX and gives each user a [quarantine with digests](https://iblockspam.com/features/quarantine-and-digests).
- Make sure your own domain can't be used to fake those replies: check SPF and DMARC with the [Email Health Check](https://iblockspam.com/tools/email-health-check).

## Frequently asked questions

### Does an out-of-office reply confirm my email address to spammers?

It can. A reply proves that a real mailbox exists and someone reads it, which makes the address more valuable to spammers. RFC 3834 lists using auto-responders to find valid addresses as a known abuse. Limiting external replies to your contacts, and relying on Gmail's habit of not replying to messages in spam, reduces the exposure.

### What should I not put in an out-of-office message?

Leave out where you're going, your exact return date if it isn't needed, personal or mobile phone numbers, and details of who approves payments while you're away. Don't list colleagues' direct lines or job titles for outsiders. A short message with a shared team address gives people what they need without giving attackers a script.

### Can I turn off external out-of-office replies for my whole organization?

In Microsoft 365, yes. Remote domain settings override users' own choices. Setting the Default remote domain's out-of-office type to None stops external out-of-office replies to every domain without its own remote domain entry. You can then create remote domains for trusted partners that should still receive replies.

### Do Gmail vacation responders reply to every message?

No. Google says the reply usually goes only the first time someone messages you, and again if they write after four days while the responder is still on. Messages that go to your spam folder or are addressed to a mailing list you subscribe to don't get a reply. You can also limit replies to your contacts.

### Why did my auto-reply get flagged or bounce back?

Replies to spam often go to forged or invalid addresses, so they bounce or land in someone else's inbox as backscatter. Many receivers also treat unsolicited automated mail with suspicion. Sending external replies only to contacts cuts most of these, and keeps your domain out of trouble with receivers that track complaints.

## Sources

- [RFC 3834: Recommendations for Automatic Responses to Electronic Mail](https://www.rfc-editor.org/rfc/rfc3834.html)
- [Microsoft Learn: Remote domains in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/remote-domains/remote-domains)
- [Microsoft Learn: Manage remote domains in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/remote-domains/manage-remote-domains)
- [Microsoft Learn: Set-RemoteDomain](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-remotedomain)
- [Microsoft Support: Send automatic out of office replies from Outlook](https://support.microsoft.com/office/how-to-set-up-out-of-office-automatic-replies-in-outlook-9742f476-5348-4f9f-997f-5e208513bd67)
- [Gmail Help: Send automatic replies when you're unavailable](https://support.google.com/mail/answer/25922?hl=en)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/out-of-office-auto-reply-security-risks (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt