There is an option in Exchange System Manager to prevent or allow Out of Office messages to be sent to external addresses. Technically, this is pretty easy to configure - and Exchange 2007+ lets you set a different message for internal and external use - but the question I have today is whether it's a good idea.

My manager asked what is "best practice" on this. I think the answer is that there are arguments both ways and have detailed some to him, but I suspect there are other reasons that I haven't yet thought of.

I'll create two answers; one for "yes, let people do it" and the other for "no, no, no, this is a terrible idea" and put in the reasons I can think of. Can I ask other people to edit in any more arguments they can think of?


Yes, it should be sent externally.

  1. The sender of an email to a business address, often a customer, has a reasonable expectation that they should get a timely reply; getting an OOO message gives them a warning to adjust their expectation.

No, it should not be sent externally

  1. If a spam is sent from forged sender address, the unfortunate forgee gets deluged by OOO messages.
  2. OOO messages should not be sent to mailing lists, in reply to email newsletters, etc. (a rule that prevents OOO replies to Precedence: Bulk can resolve this).
  3. OOO messages can give criminal social engineers useful information on who is out of the office - they can pretend to be someone from another office who is actually on holiday as they don't risk meeting the person they are impersonating.
  4. OOO messages can give out information you don't want to give out to the general public, eg mobile phone numbers.
  5. For employees in "groups" (like support), customers shouldn't be contacting them directly anyway - they should be going through the group PDL or ticketing system: the exact tech who works with them should be irrelevant.
  6. Any personal or legitimate business contacts who must know you're going to be OOO should get a personal email from you, not an automated responder.

This is a question that I think you need to zoom out and think about the overall thought process/strategy to reach a satisfactory answer.

It's generally accepted for things like user accounts or building access that you use the principle of "least privilege". (ie. Bank tellers don't have the combination to the vault, because they don't need it) Your principles/philosophy on communications scenarios like this needs to be driven by your business.

If you are the State Department, knowledge of staff travel schedules or presence may put people in danger of physical harm. If you are a real estate agent, keeping customers informed, setting expectations and providing alternate contacts for emergencies is probably more important.

  • Agreed that you need to take account of your own situation to reach a satisfactory answer. I take the view that there isn't a "best practice" as such; there's a best practice process for making a decision and I was looking for any other factors I hadn't thought of myself - and SF has been wonderful in finding several. – Richard Gadsden Dec 3 '09 at 11:07

Like you said, arguments for and against. The "identify an email address as being valid to spammers" argument against can seem quite compelling, but these spam emails really should be caught by a filtering system at your gateway before they even get to the users mailbox. Other arguments hanging off that tend to fall apart as a consequence.

I tend to see an OOO as being functionally similar to a read or delivery receipt in certain ways, so it may be useful to look at it from the perspective of how you handle those.


We send Out of Office replies to all emails, but the sender gets stored in a list of already-sent addresses. This ensures that each sender receives a maximum of one reply (per day, but is configurable in lots of software packages).

We have a company policy that the content of the vacation message includes the email address and phone number of the person taking your responsibilities during the vacation. This makes sure that clients, vendors, etc are not left hanging while you're tanning on the beach.


We send OOO to external, but after antispam feature. It don't answer to lists (I am on Linux and vacation don't answer to lists, postmaster, ...). If a spam is received, we don't send the vacation to block the knowlegement of our emails.


There's more options than just different messages to internal vs. external. In Exchange 2007, you can set external replies on a per-user basis, as well, users can select to send external emails only to a set of contacts. As a global option, External replies should NOT be turned off.

At my company, our parent corp disabled external replies, and our sales guys are not happy about it. They have to work around it by setting up a set of rules when they go away on vacation, so it's not nearly as well integrated (and the reasoning for it was ridiculous anyways, they didn't want people to know when they weren't going to be at the HOMES because they were on vacation). Conversely, there's some employees who have no need for external contacts, so we could turn OOO off for them for security reasons. But even then, we have a solid SPAM system, so there's so few that actually make it to our users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.