http://www.ietf.org/internet-drafts/draft-hutzler-spamops-00.txt
Yay for this draft!
The only thing I would suggest adding to it is a reference to RFC2476,
saying that the MSA is responsible for verifying not only that the user is
a known local user, but also that the local user is allowed to use the
claimed return path:
If an MSA is not able to determine a return path to the submitting
user, from a valid MAIL FROM, a valid source IP address, or based on
authenticated identity, then the MSA SHOULD immediately reject the
message. A message can be immediately rejected by returning a 550
code to the MAIL FROM command.
In other words, just because I am authenticated and known to the MSA,
doesn't mean I can send using whatever MAIL FROM I want... the MSA *SHOULD*
validate that I am authorized to use that return path.
You could probably use this with multiple user-owned domains like this.
1. User logs on to www.isp.net and enters his name and password.
2. User enters another email address he would like to send from, using
isp.net as a relay
3. isp.net sends a confirmation message to the claimed mail address. (If
the user claims to own the whole domain, confirmation can be sent to
postmaster(_at_)userdomain(_dot_))
4. User replies to the confirmation message or clicks the link, verifying
that he is the owner of the personal domain.
5. isp.net's MSA can now accept the personal domain as a return path,
rather than forcing the user to send from username(_at_)isp(_dot_)net(_dot_)
6. isp.net suggests an appropriate include that the user can add to the
SPF record of the personal domain (and can add it for him, if the personal
domain is hosted on isp.net)
--
Greg Connor <gconnor(_at_)nekodojo(_dot_)org>