On Fri, Feb 20, 2004 at 09:36:11AM -0500, David Brodbeck wrote:
Remember that almost all Internet mail has already been through one relay:
namely the smarthost at the sender's ISP. So giving a 550 response to a mail
with a forged sender doesn't help anyone much, because the smarthost is then
responsible for delivering the bounce, which it cannot.
If this becomes a problem, maybe the ISP's smarthost shouldn't be
accepting mail that doesn't appear to come from an email account provided
by the ISP.
Perhaps; if ISPs did this, and blocked port 25 to force traffic through
smarthosts, there would be no need for SPF. You could also make a strong
case that all ISP users should authenticate using SMTP AUTH, so that you can
validate exactly who the user is.
But it would be a big change to established practices and would break lots
of people:
(1) I send outgoing mail From: B(_dot_)Candler(_at_)pobox(_dot_)com, even
though that's not
my ISP's domain
(2) Several users in one household may send all their outgoing messages in
a single SMTP connection to the smarthost
(3) Users have vanity domains
(4) Mail servers handling multiple vanity domains, but behind a dial-up
connection, currently use a single local smarthost to send outgoing mail. If
they had to make different connections to different smarthosts (each with
different SMTP AUTH credentials), based on the domain of the return path for
each message, that would be a royal pain in the a***.
To make it work, I reckon ISPs would have to set up local registries binding
SMTP AUTH usernames to a list of registered, permitted E-mail addresses. SPF
is a distributed, weak form of such a registry (weak because it binds only
the domain to an IP, not a domain+LHS to a user account)
Regards,
Brian.