RFC 7208, Sender Policy Framework (SPF) section 2.4 has a nice summary in
paragraph 2:
[RFC5321] allows the reverse-path to be null (see Section 4.5.5 in
[RFC5321]). In this case, there is no explicit sender mailbox, and
such a message can be assumed to be a notification message from the
mail system itself. When the reverse-path is null, this document
defines the "MAIL FROM" identity to be the mailbox composed of the
local-part "postmaster" and the "HELO" identity (which might or might
not have been checked separately before).
I agree with the general consensus that such messages should be delivered
locally or within the "family". If you're getting e.g. undeliverable
messages from the wild internet and sending out postmaster notifications
in response, rethink the externalities (or find someone who can) or expect
a lot of your mail to be undeliverable in practice.
--
Fred Morris
