When DSNs (MAIL FROM = <>) are protected by
reject_spoofed (valid SRS or SES signature required),
then they should not be rejected by the three strikes
logic. Especially since we can't (shouldn't) send a DSN.
We don't know yet in envfrom whether we are checking SRS for the RCPT. For DSNs, we are checking HELO. The 3 strike policy is configured in access, so if it is set to REJECT, it is not clear that we should accept it anyway.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
We don't know yet in envfrom whether we are checking SRS for the RCPT. For DSNs, we are checking HELO. The 3 strike policy is configured in access, so if it is set to REJECT, it is not clear that we should accept it anyway.