Let me run an idea past you all. How about an SPF parameter to indicate
that only permitted senders may relay messages? That is, nobody else
would be allowed to relay messages from the sender, period. (This is
not the same as "-all".)
AOL, could for example, have a billing.aol.com subdomain (or whatever
they choose) that they never plan to relay, but aol.com could be left
free to be relayed via via SRS, the SUBMITTER parameter, etc.
Rationale: much sensitive mail doesn't really need to be relayed via
hosts that are not controlled by the sender, this allows direct-to-MX
mail to be passably authenticated without crypto.
Corollaries: this would mean that *both* MAIL FROM and SUBMITTER must
pass and I think we would want to require in this case that the RFC 2822
From: must match the RFC 2821 MAIL FROM and SUBMITTER.
Daniel
--
Daniel Quinlan
http://www.pathname.com/~quinlan/