On Fri, 2004-08-20 at 11:07 +0200, Hochstrasser Benedikt wrote: > I always had problems with bounce messages and ended up not bouncing at
> all (in case of non-existing sender and recipient user the mail systems
> often hot-potato the bounce messages between each other)
Something was _severely_ broken here. Bounces messages have an _empty_
sender, so no bounce can be sent in response to them.
> I implemented a recipient lookup at RCPT time and refuse unknown
> recipients right on the doorstep. This of course requires knowledge
> about the user base on the relayed-to domains. We solved that by
> generating a flat recipient list every night via one or more ldap
> queries against the relayed-to domains. Of course if you cater for 250
> 000 users this may be sub-optimal...
However you do it, just do it. Otherwise you end up accepting crap
claiming to be from innocent third parties, then later generating a
bounce -- thereby making yourself part of the problem.
You should ideally also do sender verification -- why accept the mail in
the first place, if you can't send a bounce to the address it claims to
come from?
