Dave Crocker wrote:
RFC2821.MailFrom specifies a return (bounce, notification,
...) address, not a source address.
| a MAIL command which gives the sender identification.
| Such a transaction consists of a series of commands to
| specify the originator and destination of the mail
| It consists of an originator address (to which error reports
| should be directed)
| The <reverse-path> portion of the first or only argument
| contains the source mailbox (between "<" and ">" brackets)
...............^^^^^^
Maybe you should read this source again.
It is "set by" the rfc2821.sender, but does not specify a
source. The difference is quite important.
It's extremely important to understand, that the MAIL FROM
address is not only some potentially unrelated Errors-To
address, it is THE source, THE sender, THE originator.
And having the MailFrom specify some other address is not
"forgery" as folks often call it.
If it doesn't specify THE source, THE sender, THE originator,
then it's either forged or redistributed or behind a gateway.
Or in the parallel universe of mail-arch with its "bounces-to".
Bye, Frank