Subject: [ietf-smtp] Received header corretness (was Proposed Charter for the "SMTP Headers Unhealthy To User Privacy" WG)

From: Brandon Long <[email-masked]>
Date: Thu, 3 Dec 2015 16:47:25 -0800

On Tue, Dec 1, 2015 at 9:51 AM, Ned Freed <[email-masked]> wrote:

> Ned Freed writes:
>> > Gmail:   Webmail does not disclose originating client IP, apparently
>> using
>> >         invalid Received: field to avoid doing so.
>>
>
> Invalid, how so?
>>
>
> I looked at one now, and the oldest Received contained "by", "with" and
>> "id" received-tokens. 5322 says all received-tokens are optional, 5321
>> says
>> that SMTP servers MUST add a "from" received-token, but that Received
>> wasn't written by an SMTP server and 5321 3.7.2 explicitly allows other
>> software to be different. 2476 says nothing.
>>
>
> What am I overlooking?
>>
>
> In my testing I saw the following sorts of fields:
>
> (webmail)
>
> Received: by lffz202 with SMTP id z202so35306770lff.3 for
> <[email-masked]>; Wed, 21 Oct 2015 22:32:47 -0700 (PDT)
>
> (submit)
>
> Received: by pasz6 with SMTP id z6so88255027pas.2 for <
> [email-masked]>;
> Thu, 22 Oct 2015 07:30:31 -0700 (PDT)

That's added by the outgoing smtp server, but it didn't receive the message
"with" SMTP.  Unfortunately, we can't just say "with gRPC" since the with
value has to be IANA registered.  I guess we could make it an X-Received
header instead, or just add the from clause.  That said, we also use "with
HTTP" and no one has complained about those, so maybe...  OTOH, I was once
told to use "with UTF8" to know that a message was RFC 6532 instead of RFC
5322, so that wouldn't be very helpful unless we also had a 'with gRPCUTF8'

Brandon

---

From: Ned Freed <[email-masked]>
Date: Thu, 03 Dec 2015 17:58:35 -0800 (PST)

> 5322, so that wouldn't be very helpful unless we also had a 'with gRPCUTF8'

First, why do you need to say "with" anything? The "with" clause is optional in
both RFC 5321 and RFC 5322.

Seems to me that it's a hell of a lot better to omit an optional clause than
to include with with a bogus value.

And if you want to nitpick this, there's a loophole in RFC 5321 in regards to
with clauses. In regards to additional protocol fields, it says:

Attdl-Protocol = Atom
                  ; Additional standard names for protocols are
                  ; registered with the Internet Assigned Numbers
                  ; Authority (IANA) in the "mail parameters"
                  ; registry [9].  SMTP servers SHOULD NOT
                  ; use unregistered names.

SMTP servers aren't supposed to use unregistered, but this says nothing
about other kinds of servers. So you actually can use "with gRPC" if you
really want to.

				Ned