On Thu, 14 Oct 2004 11:58:14 -0400, Guy wrote
If the SPF check is not done when it is received, then how will the
error be returned to the sender? Malformed domain! What about
forged addresses, would you send a bounce back to the forged
address? Not good! This is what SPF is trying to stop!
What about SPF checks that are used as part of a spam tagging system?
SpamAssassin, for example, uses SPF checks this way. This would be an example
of where it might be okay to check after the SMTP transaction.
Please consider changing SHOULD to MUST in this line:
Software SHOULD perform this authorization check during the
processing of the SMTP transaction that injects the mail.
Thanks,
Guy