gep2@terabites.com wrote:
We're talking about different 'From' addresses. None of the proposals we're working on deal with the 'From:' header as it appears in the message body. From what I've seen, it's possible that Yahoo's "Domain Keys" proposal might, but we don't know.[snip]I'm not convinced that it's necessarily practical and maybe not even desirable to even try.What actions can *YOU* take that would allow verification/authentication of the "From:" during the SMTP transaction ?
First of all, there are many legitimate reasons for people to send E-mails through relays, foreign ISPs, or other services not usually associated with their From: address. They might be travelling (perhaps even internationally) at an Internet cafe, airport waiting lounge E-mail kiosk, cruise ship Internet access lounge, in-airplane E-mail service, public library, or post office. In each of these cases, they clearly want the replies to come to their own (perhaps "vanity") domain, and maybe they never will ever again even be at the point where the prior E-mail message was actually sent from.
What's more, consider the case of mailing lists (Yahoogroups is a good example) as "anonymizers" of sorts of messages. They forward messages (as individual messages or perhaps as digests) and these sorts of mailing lists are terribly important to large classes of internet users. Sometimes these messages bear the original sender's From address, sometimes they bear the list's From address.Mailing lists are a different case. Most mailing lists rewrite the return path so that bounces are delivered to the mailing list server or administrator rather than random posters on the list. Any modern mailer that doesn't do this better have pretty damn good reasons not to.