When you activate the Sender address verification, the "From:" addresses of incoming emails will be checked for consistency. Without the additional Callout function, it will only be checked if the envelope sender address (also known as "return path") has a valid MX or A record in DNS. With the Callout function activated, the proxy connect to the return-path host and issue a RCPT command to see if the sender address is really deliverable. If that is not the case, the proxy will not accept mail coming from that address.
