(I can still verify it was working yesterday afternoon, as the type of spam had the correct rule added to X-SPAM-STATUS - while later not anymore.)

Solution in the initial post.

would a discard rule work better for your set up?

Yes, that was what I have been using before. But that still makes the mta first accept the mail, my goal was to produce a bounce message for the sender in the hope that at some point they realise it does not exist anymore.

If you want to claim to have never received something it is better to reject than to silently delete.

The only downside is that for the bounce message the "real address" of the mailbox is shown and not the alias that was used for sending.

Right... mmm.. The mail comes from dovecot and dovecot has no idea about aliases. This information gets lost in the email delivery flow

You can also "Discard with message" but this exposes the translated email address though.

It ends up in junk as expected:

• create a mailbox dev-null@my-domain.com
• through curl I have set a mailbox quota of 1kb (through the ui the smallest size is 500mb)
• when I want one address to no longer be received I am assigning this as an alias to my dev-null mailbox

Now whenever something is sent to one of these aliases the sender gets a "permanent delivery error". The only downside is that for the bounce message the "real address" of the mailbox is shown and not the alias that was used for sending.