David MacQuigg wrote:
If the SPF check is done before the body of the message is received,
it ought to go just below the Received: header.
If you can't do better... but it violates a SHOULD in 4408, see Alex'
answer for the reason of this SHOULD.
RFC 2821 requires that all "trace" headers be kept in strict
chronological order
Yes, but it doesn't talk about various trace header fields inserted
at the same hop, after all Received-SPF is the only existing trace
header field in an RFC introduced after the invention of SMTP... :-)
And RFC 2821 was published five years before RFC 4408, but I digress.
one could argue that an authentication header is not a trace header
No, it's explicitly a trace header field. Otherwise its intuitive
"Received" prefix would be misleading.
If the final SPF standard says to do something else, I will follow
the standard.
The SHOULD + related MUSTard is in RFC 4408 section 7 on page 25:
| The Received-SPF header field is a trace field (see [RFC2822]
| Section 3.6.7) and SHOULD be prepended to the existing header,
| above the Received: field that is generated by the SMTP receiver.
| It MUST appear above all other Received-SPF fields in the message.
Frank
-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735