Subject: RE: alternate submitter syntax

From: "Terje Petersen" <[email-masked]>
Date: Thu, 29 Jul 2004 12:07:53 +1000

Yes,

However Meng seems to be saying that SUBMITTER does not need to match
the header in RFC.2822 that is presented to the end users MUA as the
FROM address. He is quite adamant that the SUBMITTER address need not be
the address that the end user is presented with. 

And there is no direct SPF checking of RFC.2822 headers.

So how does this stop phishing. 

Regards,

Terje.

  _____  

From: Daryl Odnert [mailto:[email-masked]] 
Sent: Thursday, 29 July 2004 3:24 AM
To: Terje Petersen; IETF MARID WG
Subject: RE: alternate submitter syntax

> SCENERIO-B:   SUBMITTER parameter IS supported on MTA. 
> 
>       MAIL FROM     =   BOUNCE ADDRESS  (NOT SPF TESTED) 
>       SUBMITTER     =   OTHER ADDRESS   (SPF TESTED) 
>     RFC.2822.FROM =   REPLY ADDRESS   (NOT SPF TESTED) 
> 
> 
> And in this second scenario I think you are saying that the addresses 
> can all be different. Which does not seem to solve the phishing
problem. 
> So what am I missing here? 

I think what you're missing is this, from
draft-ietf-marid-submitter-02.txt: 

   If the receiving SMTP server allows the connecting SMTP client to 
   transmit message data, then the server SHOULD determine the purported

   responsible address of the message by examining the RFC 2822 message 
   headers as described in [SENDER-ID].  If this purported responsible 
   address does not match the address appearing in the SUBMITTER 
   parameter, the receiving SMTP server SHOULD reject the message and 
   when rejecting MUST use "550 5.7.1 Submitter does not match header." 

Daryl Odnert 
Tumbleweed Communications 
Redwood City, California

---

From: Meng Weng Wong <[email-masked]>
Date: Thu, 29 Jul 2004 01:22:41 -0400

On Thu, Jul 29, 2004 at 12:07:53PM +1000, Terje Petersen wrote:
| 
| However Meng seems to be saying that SUBMITTER does not need to match
| the header in RFC.2822 that is presented to the end users MUA as the
| FROM address. He is quite adamant that the SUBMITTER address need not be
| the address that the end user is presented with. 
| 

Yes, if you read the core spec that describes PRA you will
see this.

Perhaps the slideshow which starts at
http://spf.pobox.com/slides/thenewspf/0010.html will be more
informative.  I apologize for the naming, but the slideshow
was drawn before the name Sender ID was chosen.