Subject: RE: draft-ietf-marid-submitter-01.txt

From: "Harry Katz" <[email-masked]>
Date: Thu, 24 Jun 2004 23:26:32 -0700

Thanks, Hadmut.
 
Since the SUBMITTER parameter is derived from RFC 2822 headers, I
believe you could reconstruct the chain of submitters from the
Resent-From or Resent-Sender headers that are written with each Received
header.  If there is no Resent-* header, then either the Sender or From
headers would contain the SUBMITTER value. . 

________________________________

	From: Hadmut Danisch [mailto:[email-masked]] 
	Sent: Thursday, June 24, 2004 9:56 AM
	To: Harry Katz
	Cc: Jim Lyon; IETF MARID List
	Subject: Re: draft-ietf-marid-submitter-01.txt

	Harry Katz wrote: 

		Attached is the latest revision to the Responsible
Submitter internet-draft.  

	Good proposal. 
	
	But shouldn't the proposal include an extension to the
Received:-Header
	to include the given (and verified) submitter name? Or a new
header entry?
	In a chain of submissions I'd like to be able to trace the
submission back.
	
	regards
	Hadmut

---

From: Matthew Elvey <[email-masked]>
Date: Mon, 28 Jun 2004 08:44:51 -0700

On 6/24/04 11:26 PM, Harry Katz sent forth electrons to convey:

> Resent-From or Resent-Sender headers that are written with each 
> Received header.  If there is no Resent-* header, then either the 
> Sender or From headers would contain the SUBMITTER value.

Only if you're assuming that the SUBMITTER is added following 'the 
rules'.  The spec doesn't say that mail with a falsified SUBMITTER 
should be refused or discarded.  (I hate all the pussyfooting around the 
discard option.)

Also, I have thought of a possible legal problem with SUBMITTTER - The 
US' YOU CAN SPAM bill, IIRC, forbids falsified headers.  Is the envelope 
part of the header? Arguably not.  If not, will future spammers  be able 
to send email with falsified SUBMITTER info but without falsified 
headers?  OTOH, the headers are misleading if they don't match the 
SUBMITTER, just like a Subject that doesn't describe the body is 
misleading.  So this is probably a non-issue.

---

From: Greg Connor <[email-masked]>
Date: Mon, 28 Jun 2004 09:35:59 -0700 (PDT)

> should be refused or discarded.  (I hate all the pussyfooting around the 

Actually that was the original intent -- if it didn't get added to the draft 
it probably should be.  A message that claims a certain SUBMITTER but doesn't 
have that address in the right place should be rejected after DATA and should 
not be accepted.

> misleading.  So this is probably a non-issue.

The way it is defined, SUBMITTER needs to reflect one of the headers.  If the 
SUBMITTER says one thing and the headers suggest PRA is different, I would 
hope it would be rejected.  If the questionable message is not rejected for 
some reason, the MTA should probably insert something in the Received: line or 
next to it that says "MTA claimed Submitter was x@x"

--
Greg Connor
[email-masked]

Everyone says that having power is a great responsibility.  This is a lot
of bunk.  Responsibility is when someone can blame you if something goes
wrong.  When you have power you are surrounded by people whose job it is
to take the blame for your mistakes.  If they're smart, that is. 
                -- Cerebus, "On Governing"