What you say makes sense, but I'm wondering if we may be trying to solve two different problems. Suppose I have a virtual-user, say test...@virtual-dom.com. his info in ldap routes his mail to a maildir in /var/spool/mail/domains/virtual-dom.com/testuser . That is working just fine. Now he comes along and wants to check his email (via pop3 or imap--pop3d, imapd respectively of course). I would like the authentication to check to see if his password has expired. If I were to create an alias entry for test...@virtual-dom.com, where would I point it to? An auto-responder of some kind telling the sender of email that the account is disabled? My intention is not to disable the ability to receive email into the users maildir, but instead to prevent the user from retrieving email (via imapd, pop3d) until they change their password. (I have outside resources to support the user changing their password and updating the expire date field in the ldap backend). Or is the intent to tell imapd to look in a different maildir directory, say /var/spool/mail/password_expired/, and then have a read-only email message in there stating that "your email password has expired, please update to access your account."? From looking at the man pages, I don't see how an aliases file changes the behavior of imapd or pop3d.

Thanks for your help with this, Bryan