[mail-vet-discuss] Re: Auth-Results issues? #7 section 4.1

Bill.Oxley at cox.com Bill.Oxley at cox.com
Fri Apr 28 06:48:36 PDT 2006


I receive a message  that purports to be from myself at an edge mta, I
am going to drop it not process it.

Any removal of a header that is obviously falseflagged introduces a
security risk, not reducing such risk. At most a flag -This header is
bogus would be more useful.
Thanks,

Bill Oxley 
Messaging Engineer 
Cox Communications, Inc. 
Alpharetta GA 
404-847-6397 
bill.oxley at cox.com 

-----Original Message-----
From: mail-vet-discuss-bounces at mipassoc.org
[mailto:mail-vet-discuss-bounces at mipassoc.org] On Behalf Of SM
Sent: Friday, April 28, 2006 12:40 AM
To: mail-vet-discuss at mipassoc.org
Subject: Re: [mail-vet-discuss] Re: Auth-Results issues? #7 section 4.1

Hi Murray,
At 12:43 27-04-2006, Murray S. Kucherawy wrote:
In section 4:

>"For security reasons, an MTA SHOULD remove ..."

Shouldn't that be:

"For security reasons, an MTA MUST remove any discovered instance"

The draft mentions "If an MTA applies any authentication test, it 
MUST add this header" and the removal should be a MUST as well.

Modified text for Section 4:

    For security reasons, an MTA MUST remove any discovered instance of
    this header for which the "hostname" is its own, i.e. headers which
    claim to be from the MTA but were added before the mail arrived at
    the MTA for processing.  A border MTA MAY also delete any discovered
    instance of this header which claims to have been added within its
    trust boundary.  For example, a border MTA at mx.example.com MUST
    delete any instance of this header claiming to come from mx.exam-
    ple.com and MAY delete any instance of this header claiming to come
    from any host in example.com prior to adding its own headers.  This
    applies in both directions so that hosts outside the domain cannot
    claim results MUAs inside the domain might trust.

Regards,
-sm 

_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html 



More information about the mail-vet-discuss mailing list