> On Mar 28, 2014, at 7:02 AM, Matt Sergeant <notifications@github.com> wrote:
> 
> In plugins/rcpt_to.qmail_deliverable.js:
> 
> >  
> > -    if (cfg[domain]) {
> > -        if (cfg[domain].host) options.host = cfg[domain].host;
> > -        if (cfg[domain].port) options.host = cfg[domain].port;
> > +    var email = params[0].address();
> > +    if (!email) {
> > +        if (connection.notes.auth_user) {
> > +            results.add(plugin, {fail: 'null sender auth', emit: true});
> > +            return next(DENY, "An authenticated null sender? Sorry, no.");
> We normally just check connection.relaying for this. I don't understand why it's checking auth_user instead?
> 
It's not instead, it's in addition to. The motivation behind this is limiting the  abuse compromised email accounts and/or infected PCs can perform. 

MUAs (with relaying *and* AUTH) don't send legit bounce messages, but bots often attempt to. 

A legit mail server with IP based relaying is likely to generate bounces, but as Steve pointed out, he's turning on AUTH in some of those cases. 

Matt