Re: New proposal for the interactive message tracking protocol

    >> 2. The tracking activity is kept away from the e-mail
    >> system, so that an SMTP server cannot be saturated with
    >> tracking requests by malicious users.

But since tracking the message is intimately tied to SMTP AUTH,
I don't see how this could be done (easily) outside of SMTP while
staying inside the framework of SMTP AUTH.

    >> > 3. It requires only slight changes in SMTP, namely to
    >> generate the logs.

    Alexey> In most cases MTA already generate logs.

However you cannot assume the MTA generates logs anyplace accessable
to you. I could very easily ship all the logging info to a seperate
write-only log server that the tracking software has no access to.

And for popular MTAs that log through syslog(3) (e.g. sendmail),
you cannot trust the log data unless you've secured your entire
syslog environment.

--lyndon