@lowk3y@infosec.exchange This looks like what Exim calls a callout verification where you connect to sender's MX and see if it rejects RCPT. If so, then no. I'm not using it. Never did. Default config on Debian in fact has it so that you can only enable callouts for a list of sender domains not globally. I only have lighter weight sender verification enabled which more or less just does a DNS lookup and checks if the sender's domain has a valid MX.