rcpthosts - domains that we accept mail for - mostly used for vpopmail virtual domains that reside in /home/vpopmail/domains

If rcpthosts does not exist, you are an open relay. If it exists and is empty and there is no "morercpthosts.cdb" file as well, then your server will reject all incoming mail.

locals - domains that we deliver locally - mostly used for local delivery /home/$USER/Maildir

What to put in rcpthosts and locals: domain names
What NOT to put in rcpthosts: IP Addresses

Taken from http://www.lifewithqmail.org