>how would that help? > >The msg is rejected, not bounced, by IMGate so the sending MTA, not the >forged sender, sees the reject (the forged sender would see the bounce). > >By rejecting, the forged sender is protected from becoming a joe-job victim.
That's true if the workstation (not an MTA) is doing the sending, since the workstation worm won't bother to send the forged sender a failure delivery msg. but, when novarg comes through a real MTA, then rejecting will cause that MTA to send a failure delivery msg, joe-jobbing the @sender.domain. so DISCARD is better, and it costs no more since the DATA command has been received anyway. Len
