Plus, I have to question whether it is proper to have recursive LDAP aliases in the first place. That means that, for example, an alias that expands out to a hundred addresses will cause a hundred additional round-trip LDAP lookups. Every time. This does not sound like a right design to me.

It makes more sense to me to have all the recursive alias resolutions done once, and save the expanded alias list in the LDAP directory.

This is exactly how Courier's native mail aliases work. With native aliases, I don't look up every address every time. The makealiases script reads the alias file, expands all aliases recursively, and builds a GDBM/DB database where the aliases are already expanded. This eliminates a lot of waste from the code that receives new messages. Only a single lookup is required for an E-mail address.

An LDAP-based setup should be structured in the same way.