[general_re]

That's fine, but it's those DNS lookups that are causing the problem described here, and that's the problem, on a global level, that needs solving.

The trade off is that a new domain, not yet available via incremental updates, or not yet in a full zone transfer, would not be reachable -- UNTIL -- either the DNS was fixed or until one of my employees sent an email to their server (it would show up in the local outbound domain cache).

How do you know if the DNS information has been updated unless you ask? Wait a week for the next zone transfer to propagate? If the answer is "no", we're back to square one ;)

[taxcontrol]

PART of the problem described is spammers using domains not in the existing system and then registering the names. By having the mail bastion host that I described, you would reduce the effectiveness this tactic and save the DNS system from the subsequently generated queries.

Not a full fix but it would help control spam and reduce the associated DNS queries. What you "loose" in unreachable domains as a result of the trade off, I would consider a minor trade off.