You have reached a real place
Something in your stack picked this address because it looked obviously fake.
It isn't fake. It was registered years before your message showed up, and every
mail your system has addressed to noreply@noreply.net
has been arriving the whole time.
You didn't send that to nobody. You sent it to me.
Nothing was intercepted and nothing was broken into. Your own configuration picked the recipient, DNS did what DNS does, and a stranger got the mail.
How mail ends up here
The address you actually wanted
.invalid is set aside by RFC 6761 for exactly this. It has no
registry, no owner, and no possible MX record. It does the job you assumed
this domain was doing, and it will keep doing it after you stop paying attention.
example.com is not a substitute. It has live DNS and mail records,
and some senders will still attempt delivery. It's meant for screenshots and
documentation, not for values your production mailer will read at runtime.
What happens to mail sent here
It gets counted. This domain is part of ongoing research into how much real mail gets routed to placeholder addresses and what leaks along the way, so what matters is the volume and the shape of it: who sends, how often, what kind of data arrives by default.
If a specific message needs to be removed, write to contact@wronginbox.com
Making it stop on your end
- Grep your source, configs, and seed data for
noreply@,donotreply@,deleteduser, and the rest of the usual suspects. - Point anything that survives at a
.invalidaddress. - Restrict outbound mail to domains you approve, so the next hardcoded placeholder bounces at your own edge instead of at a stranger's.
- Check whether the placeholder domain in your code is currently registerable. If it is, someone will get there eventually.