| It's my understanding that DROP just drops the connection, while DENY
| issues an error and allows the connection to stay up until the
| session ends.
Hmmm - reading this thread seems to imply "drop" closes the connection
without issuing an error message.
This is not the case - both "deny" and "drop" issue the error. The
difference being "drop" closes the connection straight after.
Section 38.8 of TFM confirms this:
drop: This verb behaves like deny, except that an SMTP connection is
forcibly closed after the 5xx error message has been sent.