SCENERIO-B: SUBMITTER parameter IS supported on MTA.
MAIL FROM = BOUNCE ADDRESS (NOT SPF TESTED)
SUBMITTER = OTHER ADDRESS (SPF TESTED)
RFC.2822.FROM = REPLY ADDRESS (NOT SPF TESTED)
And in this second scenario I think you are saying that the addresses
can all be different. Which does not seem to solve the phishing problem.
So what am I missing here?
I think what you're missing is this, from draft-ietf-marid-submitter-02.txt:
If the receiving SMTP server allows the connecting SMTP client to
transmit message data, then the server SHOULD determine the purported
responsible address of the message by examining the RFC 2822 message
headers as described in [SENDER-ID]. If this purported responsible
address does not match the address appearing in the SUBMITTER
parameter, the receiving SMTP server SHOULD reject the message and
when rejecting MUST use "550 5.7.1 Submitter does not match header."
Daryl Odnert
Tumbleweed Communications
Redwood City, California