spf-discuss
[Top] [All Lists]

Re: A couple of thoughts

2004-02-17 06:53:13
On Tue, Feb 17, 2004 at 05:30:05AM -0800, John Warren wrote:
Egads, I just notices something about SRS that going to hurt all 
Mercury mail users.

Mercury can use the "+" between the user name and a optional tag, i.e., 
"user+tag(_at_)domain(_dot_)com" so the user can track names used in mailing 
list 
etc. Since their are thousands of Mercury installations out there I 
STRONGLY suggest that a different seperator be used and that the SRS 
string come after the user name not before it.

I don't really see the problem: if Mercury is not SRS-aware then it will
never send any mails with SRS-signed sender addresses, and therefore it
won't receive any bounces to those addresses.

i.e.
(1) mails originating from Mercury will have sender 'user(_at_)domain' as normal
    and therefore any direct bounces will go back to that address

(2) mails relayed or forwarded via Mercury will have the sender unchanged
    and therefore the bounce will be returned directly to wherever was
    specified (even if that is srs0+foo(_at_)some(_dot_)other(_dot_)domain)

(3) mails originating from Mercury which go via SRS forwarding will have
    that stripped off by the SRS-aware bouncing machine, e.g.
         Mercury MAIL FROM:<user(_at_)domain1>
                 RCPT TO:<foo(_at_)domain2>

         domain2 forwards the mail and knows about SRS
                 MAIL FROM:<srs0+sig+domain1+user(_at_)domain2>
                 RCPT TO:<bar(_at_)domain3>

         domain3 says bar does not exist and returns a bounce
                 MAIL FROM:<>
                 RCPT TO:<srs0+sig+domain1+user(_at_)domain2>

         domain2 strips off SRS and returns the bounce
                 MAIL FROM:<>
                 RCPT TO:<user(_at_)domain1>

If Mercury is modified to send SRS mails, then equally it can be modified to
recognise 'srs0+...' and 'srs1+...' as special cases. Indeed those could be
pseudo-users 'srs0' and 'srs1'. Of course you would be unable to have users
on your system called 'srs0' or 'srs1' if foo+extra(_at_)domain is an implied
mail to account 'foo'

Regards,

Brian.