Thanks for the replies. Since mail goes out straight from our exchange server and never touches the spam gateway, I'm increasing the filtering of NDRs coming through the spam gateway. There should be very few legit ones ever coming through there. As Michael stated, most bounces should be happening while the sending and receiving servers communicate.
I've been going through and retraining the filter this morning. Nothing quite as exciting as pouring through message logs and ticking boxes. Bill ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
