Exchange handling of NDR to individual vs. group

Hello,

Background:

Exchange Server 2007 (EXCH) behind a Sonicwall Email Security (SEMS)
behind a Sonicwall Firewall. No Exchange anti-spam plugins.
All email, except internal within the Exchange Server itself, goes
through the SEMS.
SEMS employs Bounce Address Tag Verification (BATV) to block NDR back
scatter and does ALL SPAM filter/blocking.

Application Server (APPS) sends customers (OPT IN) monthly account
notices via SEMS (as smart host) and using a return email address that
is a distribution group in Exchange.


If an end user sends an email to an invalid external email address
(either bad user at valid domain or invalid domain) they get an NDR.
If an email is addressed to the distribution group it gets delivered to
the members.

The problem:

1) If APPS sends to an invalid external address the logs show the NDR
arrives at EXCH but never gets delivered to the members.
2) If an external server accepts the email and then sends back its own
NDR email, it gets delivered to the group members.

Because of #2 I don't think EXCH is using any form of BATV of its own.
Where do I find the setting that looks at the difference of an NDR
getting delivered to a group versus an individual and get the NDRs
delivered to the group members?

TIA.

Roger Vicker, CCP