Re: Scope of SMTP Verify

On 2004-02-28 20:24:30 -0500, Yakov Shafranovich wrote:
> What I do want to discuss here, is different ways to deal with spam on
> the SMTP level OTHER than LMAP, which is what I tried to start with my
> message on different possibilities such as SMTP level passing of
> parameters, etc. This is something that should be done here, while the
> LMAP proposals can be discussed at the IMC.

I can think of several items which can be verified at the SMTP level
(not necessarily in any useful order):

1) The identity of the SMTP client. SMTP auth exists, but doesn't seem
   to be much use between random hosts on the internet (It is useful for
   authenticating users to their "home MTA").

   Various plausibility checks (check for PTR records, check HELO
   parameter against IP, ...) also fall into this category.

2) The identity of the sender of a message.

    This is currently only possible with cryptographic signatures in the
    message, not at the SMTP level. (That distinction might be academic)

    An ESMTP extension to pass a signature of relevant envelope
    information (return path, envid(?), size(?), ...) and a timestamp
    could be devised.

3) The right of the SMTP client to send mails on behalf of the alleged
   sender.

   This is what LMAP tries to do.

4) The existence of the sender.

    Check for MX and A records of the return path.

    SMTP callback.

	hp


--
   _  | Peter J. Holzer    | I think we need two definitions:
|_|_) | Sysadmin WSR       | 1) The problem the *users* want us to solve
| |   | [email protected]         | 2) The problem our solution addresses.
__/   | http://www.hjp.at/ |    -- Phillip Hallam-Baker on spam

[demime 0.99d.1 removed an attachment of type application/pgp-signature]