Re: HELO vs. MAIL FROM

Hadmut Danisch wrote:
> 
> On Thu, Oct 23, 2003 at 02:29:06PM -0400, Raymond S Brand wrote:
> > Telling domain name owners how to manage their namespace isn't going
> > work. Forget the concept of a host component and treat the HELO
> > parameter as a domain name.
> 
> Most MTAs present their hostname. The domain owner would have to
> provide a RMX entry for every single relay. This is an argument
> for slicing away one component. On the other hand you gave good
> arguments for not doing so.

Most MTAs present what they are configured to present. Often it is
_ONE_ of the names that map to the host. The domain name owner (usually)
already provides a domain name (A RR) for every server and (usually) a
PTR RR. We are talking about one or two more records per FQDN. For
most sites/MTAs, this is a "do it once" situation. The very large sites
that add and remove MTAs often will need to add and remove authorization
records often also but they probably already have a provisioning system
that does the rest of the DNS records that this can be added to. The
very large sites also only represent a fraction of all MTAs.

> Difficult. Should we do a double lookup?

The reason that DRIP SUGGESTS searching the parent domains when no
authorization records are found for a domain (and failing if any parent
records are found) is to allow domain name owners to do DNS delegations
(NS RRs) to other organizations while still protecting the domain name.
This means that ``joes_desk.sales.example.com'' will get NOT_AUTHORIZED
if example.com has any authorization records and joes_desk.sales.example.com
does not.


Raymond S Brand