One claimed problem with rejecting unknown local addresses at SMTPtime is that it enables a spammer to do a cheap dictionary scan ofyour domain to find valid usernames; all they have to do is try abunch of RCPT TO s and see which ones get accepted (or don't get apermanent failure). The easiest way around this is simple: just do yourgreylisting before you give permanent rejections.

This doesn't completely block dictionary scanning (or other versions ofaddress scanning), but it does force

As illustrated in yesterday's entry , one of the problems of the (E)SMTPprotocol is that after a SMTP server has accepted all of the message'sdestination addresses and gets to see the actual message, it has noway to tell the client that the message was delivered to only some ofthose addresses. This decision made perfect sense at the time thatSMTP and then ESMTP were being created, because back then most of theplausible per-address problems could be detected at RCPT TO timeand if