Subject: [Emailcore] EHLO domain validation requirement in RFC 5321

From: Alessandro Vesely <[email-masked]>
Date: Mon, 28 Sep 2020 19:56:57 +0200

On Sun 27/Sep/2020 17:23:50 +0200 John C Klensin wrote:
> 
> Also, a substantive note:  people decided (fwiw, over my
> objections) to create a separate email list for the emailcore
> effort.   With the very recent formal creation of that WG, I'm
> not going to track proposed changes for the potential 5321bis
> posted to this list (and hope that the WG Chairs will soon take
> that responsibility off my hands).  So, if someone would like to
> see changes, take them there.

Here:

The wording in Section 4.1.4 needs to be changed so as to distinguish 
submission[*] from server to server relaying.  As for the latter, there seems 
to be consensus on "SHOULD NOT":

On Sun, 27 Sep 2020 22:00:07 -0400 Keith Moore wrote:
> On 9/27/20 9:51 PM, Sam Varshavchik wrote:
>>
>> To me, "SHOULD NOT" is a better match for "should not be encouraged". The 
>> current phrasing, "MUST NOT", prohibits it.
> 
> I might agree with that, though I would also like to see some elaboration as to 
> why it's a Bad Idea in the long run, rather than just SHOULD NOT.

Explanations are worth as advice for both client expectations and server filtering.

Best
Ale
-- 

[*] Appendix G.6.1 and CREF13 of the dangling draft.

---

From: Jeremy Harris <[email-masked]>
Date: Mon, 28 Sep 2020 19:57:04 +0100

On 28/09/2020 18:56, Alessandro Vesely wrote:
> submission[*] from server to server relaying.  As for the latter, there
> seems to be consensus on "SHOULD NOT":

Side issue: should the standard point out that a local MTA transmitting
to a "smarthost MTA" counts, at least in some senses, as submission?

I think it does, in so far as there should be authentication done
on such clients (possibly as limited as "local subnet IP").
I'm ambivalent on suggesting 587/465 vs. 25 for it.
-- 
Cheers,
  Jeremy

---

From: "John Levine" <[email-masked]>
Date: 28 Sep 2020 16:48:57 -0400

>to a "smarthost MTA" counts, at least in some senses, as submission?

Take a look at RFC 6409 which I don't think we're planning to update.

Its section 3 describes the differences between submission and SMTP
relay. If the client is authenticated somehow (SMTP AUTH or known
local IP range) that sure sounds like submission to me.

There's also other criteria, submission usually cleans up the message
and adds missing headers, and allows relay to non-local addresses.