[Mimedefang] Both_Receive

[Jeffrey Goldberg]

On Tue, 8 Jul 2003, Carol Man wrote:

>  Thanks for your explanation, Lucas! =)
>  Hum.. do you have another good explanation to this
> question? Because now I have to try to convince my
> boss to not give a notification to the sender..

I think you've misunderstood how normal delivery notifications are
generated.

Mailservers talk to each other using a dialogue specified in the SMTP
standards.  When one mail system, C, tries to pass off mail to another
system, S, several things can happen.

If after the dialogue, S accepts the message (and informs C during the
dialogue that it has) then S is responsible for generated failure
notifications if it can't deliver the message or pass off responsibility
to someone else.

But if, during the dialogue, S rejects the message, then it is C's
resposibility to notify the sender.

On a typical MIMEDefang set-up, MD will cause a message to be rejected
during the SMTP dialog.  That way it becomes C's responsibility to notify
as appropriate that the message wasn't delivered.

Now C may be an open relay transmitting something with a forged sender
address, C may be the originating client to begin with, C may be some
intermediate SMTP server.  In all of those cases, it is better for C to
notify what it believes the sender to be than for S.

This overall scheme of passing off responsibility for a message has been
at the center of mail transport for 20 years.  When a system declines
responsibility it should tell C why (during the dialogue), but take no
other notification action.

> Just for curiosity: don't you think it's necessary to
> notify the sender that he email was blocked?

If you block the message at SMTP time, then the sending system is
responsible for notifying the sender.  Don't duplicate that.

And never, ever notificy to header addresses.

-j

-- 
Jeffrey Goldberg                            http://www.goldmark.org/jeff/
 Relativism is the triumph of authority over truth, convention over justice
 Hate spam?  Boycott MCI! http://www.goldmark.org/jeff/anti-spam/mci/