diff --git a/README.plugins b/README.plugins
index 972ad1a..195508e 100644
--- a/README.plugins
+++ b/README.plugins
@@ -123,3 +123,12 @@ Called just before we shutdown a connection.
 The return code is ignored.  If a plugin returns anything but DECLINED
 the following plugins will not be run (like with all other hooks).
 
+=head2 deny
+
+Called when another hook returns DENY or DENYSOFT.  First parameter is
+the previous hook return code; the second parameter the message the
+hook returned. 
+
+Returning DONE or OK will stop the next deny hook from being run.
+DECLINED will make qpsmtpd run the remaining configured deny hooks.
+
diff --git a/lib/Qpsmtpd.pm b/lib/Qpsmtpd.pm
index 3ec1619..5ee6572 100644
--- a/lib/Qpsmtpd.pm
+++ b/lib/Qpsmtpd.pm
@@ -1,7 +1,7 @@
 package Qpsmtpd;
 use strict;
 
-$Qpsmtpd::VERSION = "0.20";
+$Qpsmtpd::VERSION = "0.21-dev";
 sub TRACE_LEVEL { 6 }
 
 use Sys::Hostname;
@@ -146,6 +146,14 @@ sub run_hooks {
 	  and $self->log(1, "plugin ".$code->{name}
 			 ."running the $hook hook returned undef!")
 	  and next;
+
+      # should we have a hook for "OK" too? 
+      if ($r[0] == DENY or $r[0] == DENYSOFT) {
+	  $r[1] = "" if not defined $r[1];
+	  $self->log(10, "Plugin $code->{name}, hook $hook returned $r[0], $r[1]");
+	  $self->run_hooks("deny", $code->{name}, $r[0], $r[1]) unless ($hook eq "deny");
+      }
+
       last unless $r[0] == DECLINED; 
     }
     $r[0] = DECLINED if not defined $r[0];