On Tue, 21 Mar 2006 14:03:22 EST, Michael DeGregory said: > Is there anything specific we can look for when we sniff the port and get a > probe failure? Look for a *second* piece of mail coming back the other way that looks like a bounce message. Some sites are poorly set up, and will give a '250 OK' to essentially any address, including a bad one - and then send a bounce message when they discover the mailbox is in fact totally invalid. A better configuration is to have the box able to issue a 450/550 "no such user" error at the mail gateway - that way you get the benefit of: 1) You never have to accept and queue the mail for an invalid address. 2) If the MAIL FROM: is bogus (as it is for much spam), it means you don't end up trying to bounce the mail to a bogus address (or even worse, a legitimate address that has been joe-jobbed).