Subject: [Asrg] I-D: Email Submission Between Independent Networks

From: "John R Levine" <[email-masked]>
Date: 6 May 2005 18:51:28 -0400

Here's the latest draft of the proposed BCP from Carl Hutzler et al about
mail submission.  I think it's pretty good and barring a lot of hate mail
I'd like to say that the ASRG likes it so I can nudge it down the path to
BCP-hood.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
"I dropped the toothpaste", said Tom, crestfallenly.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Fri, 6 May 2005 16:35:16 -0700

>  I'd like to say that the ASRG likes it so I can nudge it down the path to

Folks,

For reference, the authors have already submitted the document to an Area 
Director, requesting BCP status.  

The background material given to the AD cites the ASRG history. It was 
announced in this forum a few times, although there was little or now 
discussion about it.

  d/
  ---
  Dave Crocker
  Brandenburg InternetWorking
  +1.408.246.8253
  dcrocker  a t ...
  WE'VE MOVED to:  www.bbiw.net

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 07 May 2005 07:59:09 +0200

John R Levine wrote:
 
> I think it's pretty good

And five pages shorter than -03.  Something deleted "E. Allman"
from the header on page one, bye, Frank                  [...]
                                                    P. Resnick
                                         QUALCOMM Incorporated
                                                    R. Sanders
                                               Earthlink, Inc.
                                                Sendmail, Inc.
                                                   May 5, 2005

---

From: Richard Clayton <[email-masked]>
Date: Sat, 7 May 2005 20:52:27 +0100

In article <[email-masked]>, John R
Levine <[email-masked]> writes

>[ A MIME TEXT / plain part was included here. ]

it includes the text

  Best practices are:

   o  MSAs MUST support the SUBMISSION port, for MUAs accessing from
      outside the MSA's local environment.

but probably means

   o  MSAs MUST support the SUBMISSION port if MUAs are permitted
      access from outside the MSA's local environment.

- -- 
richard                                              Richard Clayton

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.         Benjamin Franklin

---

From: Matthew Elvey <[email-masked]>
Date: Sat, 07 May 2005 13:26:19 -0700

>I'd like to say that the ASRG likes it so I can nudge it down the path to
It's not too hot and it's not too cold.  I like it.
(I provided feedback on it here in the past.)

---

From: William Leibzon <[email-masked]>
Date: Sun, 8 May 2005 06:40:48 -0700 (PDT)

> I'd like to say that the ASRG likes it so I can nudge it down the path to

This document effectively says that all users are to send their email by 
relaying it through their ISP SUBMIT service (not only home but also while
traveling) rather then make attempts to do it directly.

I entirely agree with such system, but I just want to make sure everyone 
is aware that is an intent that specifies consensus of the community as
previously there has been a lot of disagreements to making restrictions to 
roaming users of this nature (starting with debates about when open relays 
were closed few years back).

---
William Leibzon
   mailto: [email-masked]
Anti-Spam and Email Security Research Worksite:
   http://www.elan.net/~william/emailsecurity/
Whois & DNS Network Investigation Tools:
   http://www.completewhois.com

---

From: "Larry Seltzer" <[email-masked]>
Date: Sun, 8 May 2005 09:45:39 -0400

Or they can use port 587 to submit to external services. That's what I
remember reading

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
[email-masked]

---

From: William Leibzon <[email-masked]>
Date: Sun, 8 May 2005 07:20:37 -0700 (PDT)

> Or they can use port 587 to submit to external services. That's what I

Correct. External services that made prior arrangement with user for using
such a service, i.e. its an xSP (ISP/ASP/MSP..) service.

That is effectively the same thing as ISP email service, we just separate 
meaning of email service being provided by ISP into email receiving service
and email sending service and specify that both may involve separate 
independent arrangements and separate providers. I suspect that in 99%
of cases its still going to be the same provider, but its good to provide 
for possibility of alternative just in case.

---
William Leibzon

---

From: Bill Cole <[email-masked]>
Date: Sun, 8 May 2005 12:25:54 -0400

At 6:40 AM -0700 5/8/05, William Leibzon wrote:
>Content-Type: MULTIPART/signed;
>	BOUNDARY="-1747394880-789508825-1115559648=:7484";
>	protocol="application/x-pkcs7-signature"; micalg=sha1
>
>
>This document effectively says that all users are to send their 
>email by relaying it through their ISP SUBMIT service (not only home 
>but also while

Not exactly. It says that access providers SHALL NOT impede SUBMIT 
and MSA operators MUST support authenticated submission on port 587 
if they accept external submission.

MSA and access providers have been telling users a mix of things over 
the past decade, and the result has been a muddle, with less-skilled 
users and providers failing to understand what is reasonable and 
safe. This draft does not state  anywhere that I can see that a 
roaming user should not adjust his mail submission practices based on 
where he is hooked into the net, which is one common practice that 
works much of the time (but breaks sender domain verification schemes 
like SPF.) In fact, it seems that the  diagram in Section 4 implies 
this to be an acceptable practice, as it shows traditional port 25 
submission between a MUA and MSA on the same network.

It is useful to note in reading this draft (and I would hope in any 
other that reaches the same point) the use of the theoretical 
MSA/MDA/MTA/MUA model. When the word 'submission' is used, it is 
referring not only to port 587 submission, but to the act of a MUA 
handing mail to a MSA.

In the end, nothing in this draft says that anyone should not use an 
MSA associated with the network they are connected to, it only draws 
the guidelines for how access providers and MSA providers should both 
behave to make it possible for users to do otherwise in an orderly 
and safe manner.

>I entirely agree with such system, but I just want to make sure 
>everyone is aware that is an intent that specifies consensus of the 
>community as
>previously there has been a lot of disagreements to making 
>restrictions to roaming users of this nature (starting with debates 
>about when open relays were closed few years back).

I am quite pleased with the draft, but I think you are reading into 
it a little more than is there.

-- 
Bill Cole                                  
[email-masked]

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 14 May 2005 10:35:43 +0200

[typo]
> Something deleted "E. Allman" from the header on page one

RFC 2476bis was just approved, I guess that means replacing
all 2476 by 2476bis in the I-D, especially in the normative
references, see:

<http://mid.gmane.org/[email-masked]>

                      Bye, Frank