On Thursday, March 27, 2003, at 11:20 AM, Tony Preston wrote:
What I mean is that if joe(_at_)example(_dot_)com is the FROM user, he should
exist
on example.com, a query to example.com would check to see if that is
true.
Minor semantical change (but important): joe(_at_)example(_dot_)com should be
AUTHORIZED to send email from example.com. You will have both addresses
that exist to send e-mail but aren't users, and users that exist that
shouldn't be sending email. If you just check for existance of the
user, spammers can simply start sending all of their mail from, say,
bin(_at_)example(_dot_)com, or uucp(_at_)example(_dot_)com, or root(_at_)example(_dot_)com, things that
exist.
Better to be able to explicitly decouple user from permission, and set
up a permission scheme that allows you to have users, but not send
e-mail, to get away from forged role account issues.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg