OK, I've got a working solution and best of all, no recompiling necessary! I discovered that using the aliasdir feature along with localfilter would allow me to customize the "last ditch effort" error message for unknown local users. What I did:

#Set maildrop to run as the localfilter: echo "/usr/lib/courier/bin/maildrop" > /etc/courier/maildropfilter

#Setup .courier files and .mailfilters/ files for "last ditch" aliasdir account touch /etc/courier/aliasdir/.courier touch /etc/courier/aliasdir/.courier-default mkdir /etc/courier/aliasdir/.mailfilters/ touch /etc/courier/aliasdir/.mailfilters/rcptfilter ln -s /etc/courier/aliasdir/.mailfilters/rcptfilter-default chown -R daemon.daemon /etc/courier/aliasdir/.mailfilters/ chmod -R 0700 /etc/courier/aliasdir/.mailfilters/

#/etc/courier/aliasdir/.mailfilters/rcptfilter should be edited to contain:

include "/etc/courier/maildroprcs/baduser.md" echo "User $BADUSER unknown" EXITCODE=1 exit

#/etc/courier/aliasdir/maildroprcs/baduser.md should contain: (might need to make maildroprcs folder) BADUSER=substr($MAILFILTER,11) BADUSER=escape($BADUSER) BADUSER=`echo "$BADUSER" | sed 's/:/./g'`

What all this does:

Courier will try using /etc/courier/aliasdir as a last ditch effort to find delivery instructions (see http://www.courier-mta.org/dot-courier.html for details on this). What we're doing is actually setting up some delivery instructions. But we're using a rcptfilter to reject all messages with a custom error (User <xxx> unknown). The $MAILFILTER variable is the only environment variable we seem to have that contains the bad address in it, we need to clean it up by removing "rcptfilter-". Also, for some reason, it replaces all periods in the address with colons so we have to run through sed to fix that, which means we need to include a file from the special maildroprcs folder so that we have the ability to execute shell commands.

Possible issues:

Courier used to return: "550 User unknown" it now returns "511 User baduser unknown", I'm not sure if 511 will cause different behavior from the client, of course it's still a fatal error so I don't think it matters.

Ugly I know, but works for me :-)

Jay