A method that determines if a sender's message is to be sent to a recipient is presented. A challenge module analyzes the message and sends a challenge message to the sender if the sender is not in the recipient's address store. The challenge message includes a pseudo unique token for the sender recipient pair such that the sender must respond differently to each challenge message for a particular message. In one embodiment, the challenge message requires the sender to obtain a certificate from a certificate authority or a set of authorities.