On Mon, 13 Sep 2004, Stephane Bortzmeyer wrote:
On Mon, Sep 13, 2004 at 06:38:39AM -0700,
william(at)elan.net <william(_at_)elan(_dot_)net> wrote
a message of 76 lines which said:
I request formal discussion on possibility of replacing current
SenderID/PRA proposal with one that is based primarily on the
extended Submitter draft with additional extension that would
involve new Submitted-By RFC2822 header.
I agree with the idea but, to be sure we understand each other, may I
add some details? Tell me if I am on the right track.
Ok.
If there was reintroduction of email (such as mail list or
forwarder), then this mail list of forwarder is such responsible
party and it is supposed to add Submitted-By header (it may also add
Resent-From or Sender headers if appropriate just like they do now)
Do note that, in the pure forwarding case (use of Unix .forward), no
header is added by sendmail and a custom header is added by Postfix
(unlike what -core says in 7.2). Seeing the discussions about
"forwarding" (a very loose word here and not really clearer in RFC
2822), it would be better to specify it.
It is difficult to write good description of what forwarding is
(part of what is there I already posted when quiting 2822 yesterday).
But I do think it is intent of this WG to specify case of forwarding
in its documents. In fact core draft does it already in section 7.2
and submitter draft provides example of forwarding.
It is most likely that section from core draft would have to be moved
and modified to be in submitter draft (in addition to example that will
also stay). Perhaps case of forwarding with .forward can be mentioned
separately too or possibly an example added for that.
For verification of email by means of SPF protocol, the SUBMITTER
scope would be used and clients that support it would be required to
base their decision based on either SUBMITTER parameter of MAIL or
based on the Submitted-By header if is top-most header in the
email. If it is not top-most header, then client SHOULD find the
first Submitted-By header
First in message order, meaning last in time order.
Correct.
and attempt to verify that. If it passes,
everything is good,
Do not forget that the client MUST check that SUBMITTER agrees with
Submitted-by.
Yes.
Like with current SUBMITTER draft, at the end after data is received,
the MTA must also double-check that SUBMITTER MAIL parameter value
corresponds properly with RFC2822 headers, i.e. that first Submitted-By
header in email is the same.
The results of the verification are to be reported using
"Authentication-Results:" header as to be defined further and based
on the draft-kucherawy-sender-auth-header-00.txt. If this header is
present (and MUA believes it was added by known MTA entity), then
MUA program SHOULD display the Submitted-By header and inform the
end-user that it has been verified. Otherwise, MUAs programs MAY
display the first found Submitted-By header but MUST then inform
user that it has not been verified.
The MUA MAY does its own SenderID check on the submitted-By header it
found.
The problem is that MUA does not know for certain ip address of SMTP
client that it needs to authorize. It must rely on the Received headers
for that and they maybe forged along with submitted-by. So I would be
very carefull on MUA doing this kind of verification and if it is
mentioned, a separate security section about possibility of special
type of forging that could pass MUA vericiation must also be present.
---
William Leibzon, Elan Networks:
mailto: william(_at_)elan(_dot_)net
Anti-Spam Research Worksite:
http://www.elan.net/~william/asrg/