and then forward it to an internal machine that actually knew what mailboxes
were valid addresses. If you don't do that, then you have to make your
authentication system visible to machines on your DMZ, which has it's
own touchy implications....
Or push a list of valid addresses to the secondaries that they keep locally
and use, update as needed. You don't need to 'authenticate' -- just know
what is/isn't valid.