Your last post clarifies the issue perfectly. Your symptoms are not a bug; they are expected behavior.
Recipient verification and "Inbound SMTP" spam filtering occur while the SMTP session is active. If a problem, is detected, the adjacent system is given a failure result code. Notification of the recipient becomes the responsibility of that adjacent system.
All other tests occur after the SMTP session is closed, so there is no adjacent server to notify. Your system is responsible for generating a non-delivery report (NDR) email to notify the sender that a problem has occurred. If your system is not configured to send NDRs, the sender never finds out about the failure.
If you have an inbound gateway running SmarterMail, and configured to use SmarterMail Gateway mode, I believe it will detect both invalid accounts and disabled-no-mail accounts. (You can check with support to confirm this. For many reasons, I recommend using an inbound gateway and performing all of your spam filtering there.
Disabled accounts are detected during the delivery phase. If Recipient Verification was not performed during the SMTP session, then invalid recipients will also be detected during the delivery phase. The delivery log will have information about all of the failed deliveries.
After checking the admin interface, I notice that SmarterMail describes these messages as "Delivery Status Notifications (DSNs)", not NDRS. That term is better because it includes confirmation of receipt notices. You enable or disable DSNs as an admin using: Setttings... SMTP In... "Message limits and delivery".
If you choose to send DSNs, you should also set these options at: Settings... Antispam... Options:
- Autoresponders: Require message pass SPF
- Content Filter bouncing: Require message pass SPF
I have argued elsewhere that notifying senders about delivery problems will rarely benefit legitimate senders, will rarely trigger automatic subscription removal when it is wanted, but will occasionally activate subscription removal in response to a false positive. What it will do is help directory harvesters perfect their knowledge of your address list, will help attackers know that they need to change their attack strategy, will dramatically increase your volume of outbound mail, and will occasionally cause backscatter to an entity that was not involved in the attack. (The SPF requirements are intended to prevent or minimize backscatter risk.)
So I accept every message, do my own recipient verification and message filtering in Declude after the SMTP session is closed, and discard or quarantine anything that is not acceptable. Senders get silence unless the message is delivered and the recipient chooses to send a reply.
Choose the appropriate configuration for your system based on your needs and the expectations of your users.