On Tue, 21 Mar 2006 14:03:22 EST, Michael DeGregory said:

> Is there anything specific we can look for when we sniff the port and get a
> probe failure?

Look for a *second* piece of mail coming back the other way that looks like
a bounce message.

Some sites are poorly set up, and will give a '250 OK' to essentially any address,
including a bad one - and then send a bounce message when they discover the
mailbox is in fact totally invalid.

A better configuration is to have the box able to issue a 450/550 "no such user"
error at the mail gateway - that way you get the benefit of:

1) You never have to accept and queue the mail for an invalid address.
2) If the MAIL FROM: is bogus (as it is for much spam), it means you don't
end up trying to bounce the mail to a bogus address (or even worse, a legitimate
address that has been joe-jobbed).