> plus any address @blah.com This is an extremely ill-advised practice; spammers have tried using @example.com addresses to send to example.com users for years. Hopefully you're using whitelist_from_rcvd or checking authentication or similar techniques.
Also, are you using network tests? Assuming your timestamps are accurate all of these should have hit on one or more URIBL rules. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across the finish line broadside, thoroughly used up, worn out, leaking oil, and shouting GERONIMO!!!" -- Bill McKenna
