Email Submission Operations: Access and Accountability Requirements
Email has become a popular distribution service for a variety of socially unacceptable, mass-effect purposes. The most obvious ones include spam and worms. This note recommends conventions for the operation of email submission and transport services between independent operators, such as enterprises and Internet Service Providers. Its goal is to improve lines of accountability for controlling abusive uses of the Internet mail service. To this end, this document offers recommendations for constructive operational po
This document is current and has been amended. 1 later RFC has changed part of it. Nothing on the RFC itself tells you this.
Normative requirements
Every sentence in this RFC carrying an RFC 2119 keyword, with the section it came from. 9 must, 7 should, 2 may.
3.1 Best Practices for Submission Operation
- MUSTIf external submissions are supported -- that is, from outside a site's administrative domain -- then the domain's MSAs MUST support the SUBMISSION port 587 [RFC4409].
- MAYOperators MAY standardize on the SUBMISSION port for both external AND LOCAL users; this can significantly simplify submission operations.
- SHOULDMUAs SHOULD use the SUBMISSION port for message submission.
- MUSTMSAs MUST perform authentication on the identity asserted during all mail transactions on the SUBMISSION port, even for a message having a RCPT TO address that would not cause the message to be relayed outside of the local administrative domain.
- MUSTAn operator of an MSA MUST ensure that the authenticated identity is authorized to submit email, based on an existing relationship between the submitting entity and the operator.
- SHOULDFor a reasonable period of time after submission, the message SHOULD be traceable by the MSA operator to the authenticated identity of the user who sent the message.
3.2 Transitioning to Submission Port
- MUSTIn order to promote transition of initial message submission from port 25 to port 587, MSAs MUST listen on port 587 by default and SHOULD have the ability to listen on other ports.
- MUSTMSAs MUST require authentication on port 587 and SHOULD require authentication on any other port used for submission.
- MAYMSAs MAY also listen on other ports.
- MUST NOTRegardless of the ports on which messages are accepted, MSAs MUST NOT permit relaying of unauthenticated messages to other domains.
- SHOULDAs a default, MUAs SHOULD attempt to find the best possible submission port from a list of alternatives.
- SHOULDThe SUBMISSION port 587 SHOULD be placed first in the list.
- SHOULDSince most MUAs available today do not permit falling back to alternate ports, sites SHOULD pre- configure or encourage their users to connect on the SUBMISSION port 587, assuming that site supports that port.
4.1 Best Practices for Support of External Submissions
- MUST NOTAccess Providers MUST NOT block users from accessing the external Internet using the SUBMISSION port 587 [RFC4409].
- MUSTWhen receiving email from outside their local operational environment, email service providers MUST distinguish between unauthenticated email addressed to local domains (MX traffic) versus submission-related authenticated email that can be addressed anywhere (MSA traffic).
5 Message Submission Authentication/Authorization Technologies
- SHOULDOrganizations SHOULD choose the most secure approaches that are practical.
- SHOULDIt simply provides a warning that transmitting user credentials in clear text over insecure networks SHOULD be avoided in all scenarios as this could allow attackers to listen for this traffic and steal account data.
- MUSTIn these cases, it is strongly suggested that an appropriate security technology MUST be used.