John Levine said:
I don't understand how an SMTP server is supposed to tell the
difference between a MAIL FROM that doesn't have SUBMITTER
because it's the same as the bounce address and a MAIL FROM
that doesn't have SUBMITTER because it doesn't implement
SUBMITTER.
Today, an SMTP server who receives a MAIL command without SUBMITTER must
get the PRA in order to perform Sender ID checks.
The documents contemplate a future standards action that says that:
1. An SMTP client MUST use SUBMITTER whenever it differs from MAIL-FROM.
2. After some date, an SMTP server MAY assume that SUBMITTER ==
MAIL-FROM whenever SUBMITTER is omitted.
Clearly, step 2 will not fly until step 1 has been widely deployed.
Regardless of the hypothetical future, the documents for today state
that:
1. An SMTP client MAY use SUBMITTER.
2. If an SMTP client does use SUBMITTER, the value MUST equal the PRA
from the message headers.
3. If an SMTP server receives SUBMITTER, it MUST reject the message is
SUBMITTER != PRA from headers.
4. If an SMTP server receives SUBMITTER, it MAY use that value to
perform Sender ID checks at MAIL command time.
There were some in the room at the WG meeting who thought that elevating
the PRA to the 2821 protocol would be useful for reasons unrelated to
MARID -- I believe Pete Resnick was the prime proponent of this
position.
-- jimbo
Internet commerce will never really take off until you can buy something
online without getting spammed by the vendor.