Why are my custom error pages returning HTTP status 200 headers? Drupal 6 on IIS 7.
We have webconfig.xml setup to "Execute" the error pages when an error occurs, but the problem is that this now send status code 200 to the client (it is successfully serving the custom error content), which now means that unpublished URLs get indexed by search engines and other crawlers.

I notice that a default Drupal install send the correct HTTP status codes (404, 500, 403, etc), so it must be something in our configuration.

The option to use the default Drupal error pages is likely not on the table with this client.
I believe you still have to return the proper status code from your custom error page. For instance, for a custom 404 page, you need:

&lt;?php header("HTTP/1.0 404 Not Found"); ?&gt;