I did a few tests and found anyone can subscribe/unsubscribe any email address to my Smartlist by a "sub/unsub anyuser@anyaddress.domain". (The part worries me is the sub'ed/unsub'ed address does not receive a confirmation from the server - the confirmation is sent to the address that issued the requests only). I checked through the 'rc.custom' but didn't identify the line that control this behavior. Could someone please advice for my possible oversight? Also I have a comment on the format of the 'rc.custom' file -- often I am confused as which line to "uncomment", as in (quote): ----------------------------------------------------quote start #auto_subscribe = yes ##auto_subscribe # uncomment to disable unattended # subscription handling #auto_help ##auto_help = yes # uncomment to enable default help # responses to all undecipherable # requests -----------------------------------------------------quote end as the format in the quoted examples are not consistent, which leads one to twist the tongue for the logic wordings -- the first line (with single '#') or the 2nd line (with double '##')? Or the line with 'yes' or the line without 'yes'? Although I could have a good bet after a couple seconds on the 2nd ('##') line, I would suggest leave only one line for "comment"/"un-comment" for more clarity. In my opinion the first lines as perhaps headers only adds confusions. Comments? Thanks in advance. Zhiliang