I have different sources of messages with invalid recipients:
- Directory harvesters and spammers who are trying to guess their way into my system. I do not want to give them any information. Bad guessing gets bad guys added to my unconditional block list.
- Legitimate correspondents who are trying to reach terminated employees. I want those organizations to learn that the employee is gone, stop sending messages to the employee, and disable the employees login on the sending companies website.
There are problems with the SmarterMail implementation of recipient verification on an incoming gateway:
- A high volume of recipient verification checks is a denial of service attack on my main server. The purpose of an incoming gateway is to offload work from the main server. Recipient verification needs to be able to answer the query using a copy of the main server's data.
- It does not distinguish between trusted and untrusted sources, so it leaks information that I do not want leaked.
Currently, I am doing recipient verification after the SMTP session is closed, with no feedback to senders. This protects me from directory harvesters, but it does not provide desirable feedback to legitimate correspondents.
Recipient verification is not a minor problem. Messages to invalid recipients are more than 50% of all incoming messages, down from a peak of 65%.
I am looking for SmarterMail to provide an option to call a locally-defined function to perform recipient verification during the SMTP session. That will allow me to keep silent with bad guys, speak truth to good guys, and keep unwanted workload away from my main server.
Am I the only one who wants this?