Rewrite Microsoft's bounce messages before your users ever see them

A system filter piping matching mail through a rewrite script

Exim doesn't implement the Milter protocol, so the equivalent mechanism is a system filter — a filter file that runs against every message Exim receives, before any per-user filter, which is what makes it apply to all mailboxes on the server. Enable it in exim.conf:

system_filter = /etc/exim4/microsoft-bounce.filter
system_filter_user = mail

The filter file uses Exim's own filtering language to cheaply test for any bounce before handing it to an external script — it can't usefully pre-filter on From or a Microsoft-specific Subject the way you might expect, because the common case is Exim generating this DSN itself (Microsoft rejected the original message outright, mid-conversation), so those headers are Exim's own, not Microsoft's. That deeper, Microsoft-specific match happens in the script instead, against the delivery-status part:

# /etc/exim4/microsoft-bounce.filter
if error_message
then
  pipe "/usr/local/bin/rewrite-microsoft-bounce.py"
  seen finish
endif

And the script, which does the real MIME-level matching and either re-injects a rewritten copy or leaves the original to be delivered normally — a sketch, add the same near-miss logging and testing called out above before relying on it:

#!/usr/bin/env python3
# rewrite-microsoft-bounce.py - reads the message from stdin (Exim's `pipe`).
# Targets DSNs Exim generated itself, reacting to Microsoft rejecting the
# original message outright mid-SMTP-conversation - the common case, where
# Microsoft's fingerprint lives in the delivery-status part, not the
# headers. (Microsoft generating and sending the DSN itself is rare enough
# by comparison that this doesn't match for it separately - those few
# bounces just get re-injected unchanged below, same as anything else that
# doesn't match.)
# Re-injects a rewritten copy via sendmail -t if it matches; otherwise
# re-injects the message completely unchanged. Either way, the system
# filter's `seen finish` stops Exim delivering the original a second time.
import sys, re, subprocess, email

MICROSOFT_HOST = re.compile(r"\b[\w.-]*\.(protection\.outlook|outlook|hotmail)\.com\b", re.I)
REPLACEMENT_TEXT = (
    "This is a delivery failure notice for a message you sent to a "
    "Microsoft-hosted address. Microsoft's mail servers block legitimate "
    "senders unpredictably, and their original wording below is often "
    "unhelpful. Details: https://dumpmicrosoft.com\n"
    "A more reliable option for the recipient: https://dumpmicrosoft.com/users.html\n"
    "\n-- Original notice follows --\n")

raw = sys.stdin.buffer.read()
msg = email.message_from_bytes(raw)
content_type = msg.get_content_type()

# Microsoft's fingerprint isn't in the headers above - this DSN is
# Exim's own, so its headers are Exim's, not Microsoft's. Look in the
# delivery-status part instead.
delivery_status = ""
for part in msg.walk():
    if part.get_content_type() == "message/delivery-status":
        delivery_status = part.get_payload(decode=True).decode(errors="replace")
        break

is_microsoft = bool(MICROSOFT_HOST.search(delivery_status))

if content_type == "multipart/report" and is_microsoft:
    for part in msg.walk():
        if part.get_content_type() == "text/plain":
            original = part.get_payload(decode=True).decode(errors="replace")
            part.set_payload(REPLACEMENT_TEXT + original)
            break   # only the first text/plain part - the human-readable one

subprocess.run(["/usr/sbin/sendmail", "-t", "-oi"], input=msg.as_bytes())

Test the filter syntax with exim -bf /etc/exim4/microsoft-bounce.filter before reloading. The seen finish plus unconditional re-injection in the script (matched or not) is what avoids either dropping mail the pattern missed or delivering two copies of what it caught — get that pairing wrong in either direction and you'll lose messages or duplicate them, so test with real captured DSNs before this runs against live mailboxes. Because error_message is true for every bounce Exim delivers, not just Microsoft-triggered ones, the script will see (and correctly ignore) plenty of unrelated DSNs — that's expected, not a sign the filter needs tightening further.

A MIMEDefang milter with direct MIME::Entity access

As on the other Sendmail tabs in this guide, a milter is the natural fit — and MIMEDefang in particular gives you the message as a Perl MIME::Entity object, which is exactly what's needed to reach into a specific part and replace its content. In your filter.pl:

use MIME::Entity;

sub filter_end {
    my ($entity) = @_;

    return unless $entity->head->mime_type eq 'multipart/report';

    my $subject = $entity->head->get('Subject') || '';

    # Microsoft's fingerprint isn't in the headers - if Microsoft rejected
    # the original message outright, mid-SMTP-conversation (the common
    # case this targets), THIS bounce was generated by your own Sendmail/
    # MIMEDefang, not by Microsoft, so its headers are yours. Look inside
    # the message/delivery-status part instead, where the Remote-MTA/
    # Diagnostic-Code fields name Microsoft's server and quote its
    # rejection text.
    my $delivery_status = '';
    for my $part ($entity->parts) {
        if ($part->mime_type eq 'message/delivery-status') {
            $delivery_status = $part->bodyhandle ? join('', @{ $part->bodyhandle->as_lines }) : '';
            last;
        }
    }

    my $is_microsoft = $delivery_status =~ /\.(protection\.outlook|outlook|hotmail)\.com/i;
    my $looks_like_dsn = $subject =~ /^(undeliverable:|message not delivered|delivery has failed|undelivered mail returned to sender)/i;

    return unless $is_microsoft && $looks_like_dsn;

    for my $part ($entity->parts) {
        next unless $part->mime_type eq 'text/plain';
        my $original = join('', @{ $part->bodyhandle->as_lines });
        my $io = $part->bodyhandle->open('w');
        $io->print(
            "This is a delivery failure notice for a message you sent to a " .
            "Microsoft-hosted address. Microsoft's mail servers block " .
            "legitimate senders unpredictably, and their original wording " .
            "below is often unhelpful. Details: https://dumpmicrosoft.com\n" .
            "A more reliable option: https://dumpmicrosoft.com/users.html\n\n" .
            "-- Original notice follows --\n" .
            $original);
        $io->close;
        action_change_body($entity);
        last;   # only the first text/plain part - the human-readable one
    }
}

Adjust to match your existing MIMEDefang filter structure and version — as with the milter examples on the deliver-and-notify page, this is illustrative of the hook and matching logic, not drop-in production code. Test against real captured DSNs, not assumptions about their format, before it runs against live mailboxes.

Same Exim system filter, added via WHM

cPanel/WHM servers run Exim under the hood, so the system filter from the Exim tab applies the same way. Upload the filter file and the rewrite script via File Manager or SSH, then in WHM → Service Configuration → Exim Configuration Manager → Advanced Editor, add:

system_filter = /etc/exim4/microsoft-bounce.filter
system_filter_user = mail

Make rewrite-microsoft-bounce.py executable and confirm the path referenced by the filter's pipe command matches where you uploaded it, then Restart Exim. Because a system filter runs ahead of every account's own mail filters, this applies across all mailboxes on the server without touching each account individually.