Microsoft Office 365 Top senders and recipients report shows that 15-20 % of messages in the tenant are from
email@example.com i.e. Office 365 Exchange sends a lot of Non-Delivery Notifications (NDN).
Testing with recipient
firstname.lastname@example.org from an external sender I instantly get a NDN with error
550 5.1.10, created by Office 365 instead of the sending server, proving that I can't get a connection-stage rejection even when the mailbox doesn't exists.
This makes me think Office 365 is vulnerable of sending spam backscatter. Is there any way to configure Office 365 Exchange to use connection-stage rejection, instead, when it's possible? Microsoft probably uses an arsenal of other methods for preventing backscatter. Are they powerful enough? AFAIK SMTP connection-stage rejection is the single most powerful practice against it.