> Another approach is to grep thru the last 10 days of maillog.*.gz and see > if this ip has every contacted your MTA before.
Good point - no contact for the last 5 weeks until last night. I'm certain that the 554 is the right thing to do in this case. I was just curious about the RCPT/VRFY sequence - you're right, it makes no sense whatsoever.
