Mime-Version: 1.0
Message-Id: <v0410111bb1f004ea1174@[129.46.219.133]>
In-Reply-To: 
 <Pine.GSO.4.02.9808051431050.7380-100000@atlantis.csc.umd.edu>
References: 
 <Pine.SOL.3.95.980804135710.29185B-100000@elwood.innosoft.com>
Date: Thu, 6 Aug 1998 18:17:11 -0700
To: "Randall S. Winchester" <rsw@Glue.umd.edu>
From: Randall Gellens <randy@qualcomm.com>
Subject: Re: Call for Concensus on Recent issues (4.5.3)
Cc: DRUMS WG Chair <Chris.Newman@innosoft.com>,
        Detailed Revision/Update of Message Standards <drums@cs.utk.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"

At 3:00 PM -0700 8/6/98, Randall S. Winchester wrote:

>   "The general principle that relaying SMTP server MUST NOT, and delivery
>   SMTP servers SHOULD NOT, perform validation tests on message headers...."
>
>This statement is no longer accurate. With current anti-spam SMTP servers
>(relaying or not), performing validation tests on message headers, is a
>feature.
>
>As an aside, I could not find where this "principle" came from.

It's in general a bad idea, and has caused interoperability problems
(delivery or even relay servers take it on themselves to police
messages, and decide that something or other isn't to their liking,
usually incorrectly, and often corrupting the message in a misguided
attempt at fixing it.

>2) I sent mail about this before, but am not sure I ever recieved a
>resonable responce, and since there was no wording changes...
>
>I currently reject any message with more then 500 (configurable) "Exposed
>Recipients". This is not a temporary failure, and is not something that gets
>"let in 100 at a time", like the "recipients buffer" section suggests.
>
>I have no limits on the total number of "RCPT TO" addresses, but do "perform
>validation tests on message headers", to verify the number of "Exposed
>Recipients".

SMTP does allow you to reject a message for any reason you choose.  You
can always fall back on that general principle, even though you may be
violating a rule by basing your decision on something that is likely a
bad idea.  In your specific case, I'm sure you have ample past
experience to justify what you're doing.