Just a question - do people still find the DHAP (Directory Harvest Attack Prevention) still useful? We've had it on for years but in the last couple of months had two major "denial of service" of email due to DHAP triggering and causing way more harm than actual good.
Scenario 1 - a person works at one institution and forwards email to us for a few years. She then ceases her secondment at our organisation and we cancel her account. The forwarding from her original account continues and the emails are not accepted by LDAPACCEPT - they are using Mimecast and they start to generate hourly "not delivered year emails" which are also attempted to be forwarded to us (to be not accepted by LDAPACCEPT and in turn generate warning emails from Mimecast). Eventually due to one persons forwarded email we end up having DHAP triggerring on Mimecasts Australian email cluster and most of the Australian university sector and other customers can't email us anymore (until we manually disable DHAP).
Scenario 2 - Outlook.com cluster (16000 IP addresses - I extracted them myself) all have low reputation due to some malware which creates free accounts and then sends malicous emails with URLs to email addresses (many out of date). This is what the Cisco TAC told us anyway. This triggers DHAP and the malicous content also lowers the reptuation. Eventually again we have to manually disable DHAP to allow all the genuine freemium email in from Outlook.com hosted email (Hotmail.com/Outlook.com/Live.com etc) as again customers can't contact us.
I can see how DHAP is useful if there is a server which is wholy malicious in nature - but when you have multi tenancy IP addresses sending you email (and their admins don't seem to care about deliverability) it seems to be somewhat dangerous to the quality of your email service.
