Re: "Header Reordering", yet again

At 14:58 31/05/2005, Hector Santos wrote:

> ----- Original Message -----
> From: "Paul Smith" <paul(_at_)pscs(_dot_)co(_dot_)uk>
> To: "Frank Ellermann" <nobody(_at_)xyzzy(_dot_)claranet(_dot_)de>; 
> <ietf-smtp(_at_)imc(_dot_)org>
> Sent: Tuesday, May 31, 2005 9:05 AM
> Subject: Re: "Header Reordering", yet again
>
>
> > >Now you might be able to sort the timestamp lines by their
> > >timestamps, or more likely by "I know what happens behind
> > >my MX".  Or you just use `nslookup -q=mx`.
> >
> > If you specified that the timestamp on the Received-SPF field MUST be
> > IDENTICAL to the timestamp on the Received: line added by the same server,
> > that might solve some problems.
> >
>
> Good point,
>
> but I'm still scratching my head on this issue,  what's the problem again?
Not entirely sure.. I've lost the start of this discussion as the subject 
has changed a few times.. :)
> Why would a downlink software assume the headers are or could be out of
> order?  and why would it assume mediocrity exist or even allow it to be
> used?    I mean, if a piece of software was doing this,  then you go to the
> developer and shame them for screwing things up.  If they don't bother to
> fix it, then you dump it and get something else.  That's how it usually
> works.
Unless that other developer is Microsoft or that of any other widely 
deployed software or used by any big ISP. In that case, they are unlikely 
to change just for you, and you'll lose customers if you do anything bad 
because of the faulty data.
> Is this what you are doing?  Using SPF in your VPOP3?  (Assuming VPOP3 is
> some user's pop3 proxy application)
Don't get me involved ;)
It wasn't my original suggestion..

We can do SPF in our VPOP3, but only on direct incoming SMTP (so header 
lines are irrelevant, it just looks at the sender's IP address)
(VPOP3 is a POP3/SMTP/IMAP4 mail server, not a proxy, BTW)

But - we do get requests for SPF support on incoming SMTP via an ISP's 
server, or on incoming POP3 mail. At the moment, we're reluctant to do it 
because of the problem of knowing exactly which mail server in the trace 
headers was the one we should be checking. This could be handled by a 
knowledgeable user telling our software which mail server(s) were the 
recipients' ISPs - but knowledgeable users are few and far between in our 
market (SMEs) so you need to do it automatically, or not at all..


Paul                            VPOP3 - Internet Email Server/Gateway
support(_at_)pscs(_dot_)co(_dot_)uk                      http://www.pscs.co.uk/