On Mon, 24 Mar 2003, Chuq Von Rospach wrote:
To avoid making changes to existing protocols, instead of modifying DNS
for new fields, I thought I'd do it using a well-known host name (which
also allows a large site to scale with load balancers or perhaps round
robins, while allowing small sites to simply virtual host it to their
machine). Call it, say, hostauth.yahoo.com (if mail is from
lists.apple.com, say, the authorizer is hostauth.lists.apple.com;
through aliasing, it can all be tied to single server or single
administration if you want). for sake of simplicity, I'll assign it
port 5555.
This moves responsibility for authorizing mail from the connecting host to
the owner of the hostname of the connecting host. Currently the host
itself must prevent relay, and needs to use SMTP AUTH or POPAUTH for
roving users. Under this proposal that would be unecessary because the
receiving host would query the authorizer for authorization. Now the
authorizer is the one that decides if mail is legitimate or not.
What is missing is an argument for why this is better, or is better in
combination. Is there a large group of MTAs who would do this but would
not do SMTP AUTH? Is SMTP AUTH to hard? But a whole new authorization
protocol is not likely to be easier. Are there particular problems with
SMTP AUTH that are insoluble?
Furthermore, the authoriser has less information than the sending host. It
doesn't know the actual sending address, or if the actual sender knows the
login id and password for his account, or anything about the message
content.
I would have guessed that most mail originates from servers that are
controlled by the same entity that controls the DNS server of the host
name, and that therefore this proposal does not shift responsibility in
most cases. However many MTAs are on DSL lines where the ISP has effective
control over DNS but the customer controls the machine itself. In these
cases I would guess there was much less liklihood of this proposal being
effected correctly.
Daniel Feenberg
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg