Why would you consider sending an email to an address that you know does not exist within the company you are performing a Penetration Test for?

NDR responses reveal mail server software and routing metadata, not account ownership information such as who holds the root or administrator account.

A single bounce-inducing email does not constitute a Denial of Service attack because it generates only one reply message and does not exhaust server resources.

The action is deliberate targeted reconnaissance generating one bounce message, not unsolicited bulk email distribution that would qualify as spam.

Mail Transfer Agents generate NDR messages when a recipient address is invalid, and these bounce messages commonly include the mail server software name, version, internal IP addresses, and SMTP banner information that a penetration tester can use to fingerprint the email infrastructure.

Antivirus scanning is triggered by attachment content or known malicious signatures, not by the act of sending to an invalid recipient address.