I've found conflicting opinions on enabling "out of office" email messages, especially outside of the bank. Is there any generally accepted guidance on this topic?

Unless they want spam ... I would discourage it ...

Read this short article ... it has good reasons for disabling out-of-office reply capabilities ... (enter "out-of-office" in the search field and this article will appear) ...

http://searchwindowssecurity.techtarget.com/tips/

Also ... here is guidance from NIST ...

Disabling auto-replies – disabling auto-replies for messages received via the IMS. Users can set up out-of-office messages that are sent automatically on receipt of a message. In some cases, it is possible that the information a user might include in this message should not be shared outside the organization. This could create a problem if the out-of-office messages were sent in response to emails from the Internet. In addition, by default, the IMS includes the sender’s display name, in addition to the sender’s address, in outbound messages. This can be disabled as well.

While I see some reasons not to use these, there is also a good reason to include them, they tell legitimate users you will not be responding. Perhaps strong firewalls and security measures will render the risks lower than the benefits of this form of communication.

I know I appreciate an auto response to my message of "I need to get an answer on this ASAP" which tells me not to hold my breath.

At my bank, the auto-reply in Outlook does not include the sender's "signature" but it does include the first and last name in the "sender" field. The signature is where employees put their title, location, phone #, etc.

As far as receiving confirmation that an email address is legitimate, the fact that a sender does not receive a "Message Delivery Failure" notice pretty much tells them it is at least a valid email address.

I agree with Andy that it can be very important to receive an out of office message, particularly in customer contact situations. I would rather put better security in place than risk a customer loss, or a legal problem because some deadline was missed.

If you can't use out of office, then emails should be forwarded to other staff so that important matters are addressed.