Subject: Re: 551: Do MTAs try forward-path???
From: [email-masked]
To: "Martin R. Garcia" <[email-masked]>
Cc: [email-masked]
Date: Wed, 31 Mar 2004 10:00:09 -0500
List-Id: <ietf-smtp.imc.org>

On Wed, 31 Mar 2004 04:33:05 PST, "Martin R. Garcia" <[email-masked]>  said:

> About the 551 reply code:
> 
> "...The receiver refuses to accept mail for this user,
> and the sender must either redirect the mail according
> to the information provided or return an error
> response to the originating user..." (rfc821)
> 
> Which should be the correct action to take as a
> sender???
> 
> Whats happening "today" on the Internet??? Is there a
> "general behaviour"??? Do MTAs go for a redirection of
> they choose to return an error response???

Has anybody actually seen this "in the wild"?  I can't recall ever having seen
one of these....

It *may* make sense to revive this - it would be at least partial mitigation of
the b0rkage that things like SPF render unto forwarded mail (as the sending
site can retry the mail directly, and the "MTA validation" will then be looking
at the original site and original MAIL FROM, rather than the SPF-ish b0rkage of
forwarding site and original  MAIL FROM.

We should either deprecate it or add language about the various information
leakage and similar concerns noted by others.

In particular, "never use this info unless the destination MTA is authenticated"
(i.e. so a spoofed MX doesn't let you forward somebody's mail w/o their OK).