Our mail provider provides the MXs for our domains, performs some screening on the mails (spam checks etc.) and then delivers the mails to our internal mail server. (They use Cisco Ironport.)
They have configured recipient verification/callout/call-ahead using a static MAIL FROM address (firstname.lastname@example.org). This poses problems for internal email accounts which have a restricted set of external domains from which they can receive mail. (The ISP thinks the account does not exist, and bounces the mails, while the account does indeed exist but accepts only mail from certain domains of which the static mail from address used for the callout is not a part.)
Do you think they are doing this correctly? I did not find a best practice or an RFC on that subject... Any idea why they would not use the empty envelope sender to perform the check? (i.e.
It seems there are three possibilites to perform the callout:
- Use the (from,to) tuple from the original mail (since the Ironport apparently caches the result, it probably can't do this, or the cache would be very ineffective). However, this is what e.g. the Exim manual suggests.
- Use the empty envelope sender as outlined above. Unless the recipient would refuse bounces or delivery notifications or the like, this would probably work.
- Use a static FROM address. This appears to be the most stupid choice.