[Mimedefang] Bad RCPT Throttle in the Real World

[Kevin A. McGrail]

I've been adding BAD RCPT Throttle logging to a database through a program
we already use that watches for authentication for SMTP relay.

Currently, I am using a throttle of 2 and I plan to tie the DB of IP
addresses to MIMEDefang in the filter recipient (comments?) and issue a
TEMPFAIL for 5 minutes.

I saw solutions that also blackholed the route for the IP but I worry about
proxy servers for large ISPs getting blocked because of one bad apple.

Is anyone implementing anything in MD based on Bad RCPT Throttling?  Any
hints or warnings?

Regards,
KAM