David Doan writes:

Neither. This is the correct behavior.

When an E-mail address gets expanded through an alias, Courier will disable any resulting bounces. The original sender has no clue whatsoever, obviously, which addresses you're expanding to internally. It is considered to be rather rude, and antisocial, to send the sender back a bounce to an address the sender has no information for. If the sender is an automated source, such as a mailing list, the automated sender will not know how to process the bounce since the sender has no information on the aliased address. The situation is exacerbated if the alias includes multiple addresses, thus potentially flooding the sender with multiple bounces, that the sender will have no way to know what to do with, and punt all the crap to the human administrator for manual action. But the sole reason for using an automated mail processing software is to handle the mailing task automatically, so the human administrator will look at who they're getting this garbage from, and take the appropriate action.

What happens when a mail gets sent to an aliased address depends on the recipient's mail server. If the mail server advertizes the ESMTP DSN extension, Courier will preserve the sender's address, but use an explicit NOTIFY=NONE, to instruct the recipient's server to suppress any resulting bounces. If the recipient's mail server is an ancient dinosaur, that does not implement ESMTP DSN, Courier will just remove the return address, and supply the empty one. This is why sometimes you see the return address on the aliased mail, and sometimes you do not, depending on the recipient.

If I start getting bounces to addresses that I haven't sent anything to, I would blacklist whatever's spewing this crap at me. This is a rather rude, obnoxious, and an antisocial thing to do.