diff --git a/mox-/lookup.go b/mox-/lookup.go
index 8eaf0a2..1fae8d5 100644
--- a/mox-/lookup.go
+++ b/mox-/lookup.go
@@ -63,7 +63,10 @@ func LookupAddress(localpart smtp.Localpart, domain dns.Domain, allowPostmaster,
 	canonical := smtp.NewAddress(localpart, domain).String()
 
 	accAddr, alias, ok := Conf.AccountDestination(canonical)
-	if ok && alias != nil && allowAlias {
+	if ok && alias != nil {
+		if !allowAlias {
+			return "", nil, "", config.Destination{}, ErrAddressNotFound
+		}
 		return "", alias, canonical, config.Destination{}, nil
 	} else if !ok {
 		if accAddr, alias, ok = Conf.AccountDestination("@" + domain.Name()); !ok || alias != nil {
diff --git a/smtpserver/alias_test.go b/smtpserver/alias_test.go
index 9312de2..b32374b 100644
--- a/smtpserver/alias_test.go
+++ b/smtpserver/alias_test.go
@@ -1,6 +1,7 @@
 package smtpserver
 
 import (
+	"errors"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -62,6 +63,12 @@ func TestAliasSubmitMsgFromDenied(t *testing.T) {
 	ts := newTestServer(t, filepath.FromSlash("../testdata/smtp/mox.conf"), dns.MockResolver{})
 	defer ts.close()
 
+	// Trying to open account by alias should result in proper error.
+	_, _, err := store.OpenEmail(pkglog, "public@mox.example")
+	if err == nil || !errors.Is(err, store.ErrUnknownCredentials) {
+		t.Fatalf("opening alias, got err %v, expected store.ErrUnknownCredentials", err)
+	}
+
 	acc, err := store.OpenAccount(pkglog, "☺")
 	tcheck(t, err, "open account")
 	err = acc.SetPassword(pkglog, password0)
diff --git a/smtpserver/server.go b/smtpserver/server.go
index f4ea91c..43ff2ca 100644
--- a/smtpserver/server.go
+++ b/smtpserver/server.go
@@ -751,6 +751,7 @@ func command(c *conn) {
 		if errors.As(err, &serr) {
 			c.writecodeline(serr.code, serr.secode, fmt.Sprintf("%s (%s)", serr.errmsg, mox.ReceivedID(c.cid)), serr.err)
 			if serr.printStack {
+				c.log.Errorx("smtp error", serr.err, slog.Int("code", serr.code), slog.String("secode", serr.secode))
 				debug.PrintStack()
 			}
 		} else {