But none of this brings us any closer to understanding why we should or
should
not perform authorization checks based on the MAIL FROM address. So this
will
be my last message on this subtopic.
That's unfortunate. "why *we* should or should not perform such checks" is
a moderately interesting question (at best), but liable to get rather
noisy. Whether "we" should work to produce a (global) mechanism which
enables such checks (and others, in support of local, or publisher's,
policies) is a rather more interesting question. It may be somewhat less
"religious".
But, "whatever", if you want a nice and tidy 'ruling' on the first
question, good luck to you.