I am mostly in agreement with the above. But the standard for MDNs
also specifies that the notification must go to the return-path address
*if it is automatically generated* (which vacation notices are).
This may have been your intent but the documents do not say this.
from rfc 2298:
MDNs SHOULD NOT be sent automatically if the address in the
Disposition-Notification-To header differs from the address in the
Return-Path header (see RFC 822 [2]). In this case, confirmation
from the user SHOULD be obtained, if possible. If obtaining consent
is not possible (e.g., because the user is not online at the time),
then an MDN SHOULD NOT be sent.
(okay, it's a "SHOULD", not a "must". but the intent is clear.)
Keith