Three ways to answer an unwanted email
Every time a mail server receives an email, it answers the sending server with a three-digit code. For unwanted messages, three answers matter. 451 means "not now, try again later." 550 means "rejected." 250 means "accepted." The first two are explicit refusals. The third confirms receipt, even when the message goes no further. That's the response we use for confirmed attack traffic.
A rejection is information
Rejecting an email feels decisive, but every 550 tells the sender three things: the address exists, it's being filtered, and this particular message triggered the filter. For an attacker, that's useful feedback. Email bomb campaigns are often preceded by short test bursts that check whether an address is active and whether anything pushes back. A pattern of rejections answers both questions. Silent acceptance answers neither. Every message appears delivered, which leaves nothing to learn and nothing to adjust.
Rejections can cut you off from legitimate senders
When a legitimate company's mail server receives a 550, the rejection has consequences. It records a hard bounce and usually adds your address to a suppression list, which means it stops sending to you. During an attack, that sounds helpful. But filters make mistakes, and attacks are when they make the most. If your bank, your accountant or your payroll provider gets rejected in the middle of a flood, their system may quietly mark you as undeliverable. The invoices and statements stop, and nobody tells you. A discarded message can be recovered. Restoring delivery from a sender who has suppressed your address, often without you even knowing, is much harder.
The companies caught in the middle
A registration bomb doesn't only affect the recipient. Every sign-up form the attacker uses belongs to a real business: a webshop, a software company, a local newsletter. Each one sends its confirmation email in good faith. If those emails are rejected, the business records a hard bounce it did nothing to cause. Email providers monitor bounce rates closely, and a sudden spike can damage a company's sender reputation or put its account under review. From their side, the pattern is confusing: an address signs up, bounces or unsubscribes, and then signs up again. It isn't unusual for a business to contact the address owner and ask what is going on, without realising both of them are dealing with the same attack. They shouldn't be penalised for it. Accepting their messages and then unsubscribing cleanly is the least disruptive outcome for everyone involved.
The cost of silence
Discarding isn't without risk. The sender believes the message arrived, so if a legitimate email is caught by mistake, no error is returned and the message disappears. That's why silent discard only works with a safety net. Discarded messages are archived for review, seven days by default, adjustable to each organisation's preference, and a daily report lists what was blocked and who sent it. If something legitimate ends up in the archive, it can be found and released, and the sender whitelisted. The principle is simple: never discard mail without a way to review it.
Which response, when
MX Moat uses each code for a specific purpose. Unknown first-time senders receive a 451. Legitimate mail servers retry within minutes, many spam tools never do, and the delay gives us time to see whether a flood is building. Suspicious but unconfirmed messages also receive a 451, which holds them while we watch how the volume develops. Confirmed attack traffic receives a 250 and goes directly to the archive. Hard 550 rejections are disabled entirely. Having weighed the trade-offs, we found no situation where rejecting did more good than harm. One effect remains. Because every service believes its email was delivered, the newsletters and reminder emails continue, and dealing with them is a challenge of its own.