I think that Hadmut is moving us in the right direction, but I continue
to urge us to be more precise:
Identity Sending MTA's IP address
This means the peer, SMTP client, right?
Exactly. And (in contrast to Microsoft's CallerID) within the time
of the running SMTP connecting. Basically, this is what the receiving
MTA gets with the getpeername() function (before finishing the SMTP
connection, and even before replying OK to DATA).
Authentication Verifying the Identity (TCP sequence numbers)
Authorization Domain owner's statement
Which domain?
The domain given in the sender's address (or whatever part of the
message. That who's held responsible in case of spam).
For example, I suspect that the definition, for this level of
discussion, needs to be something like "the owner of a domain that is
obtained from some portion of an SMTP transaction."
Exactly. Good description. It is just that we somehow use the
incoming message to locate a domain willing to authorize the sending
MTA.
Policy Receiving MTA's way to treat messages with or
without Signature, LMAP authorization, or from
domains without LMAP record, or DNS server down
Most discussions have described a policy as guidance, from the domain
owner and to the server SMTP, concerning the way the server should treat
messages...
That is, the policy comes from the domain owner; the server SMTP decides
whether to conform to it.
No, that's what I do not agree with.
The domain owner gives the authorization to use his domain or not.
In my receiving SMTP relay I do not conform to anyone else's decisions.
In my SMTP receiver I am the emperor, the one and only. (Wow!)
I am the master of the dark forces and the configuration files.
I am the one instructing the relay what to do with mails which
failed the authorization check for the various reasons. I do instruct
whether to burn them, tag them, move the priority down to junk or
whatever. This decision given by me, the emperor, shall be known
as my policy. My receiving MTA enforces my policy, because I am the
one to write the configuration file. And it is my decision whether
to accept mails which fail the check or not. This is not the domain
owner's decision. And for exactly this reason it could also be my
decision (spell: my policy) to not accept messages from domains which
authorize 0.0.0.0/0 (=everyone).
There are two statements need to make this all work:
- The domain owner's statement, called the authorization
- The receiving MTA owner's statement what to do with
suspect mails, called the policy.
regards
Hadmut