Security & scope
10Base SMTP does not prove the author named in a header. Transport protections, relay policy, and message authentication solve different problems.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7 ↗
RFC 5321 · § 7EXAMPLE
3 / 3
03
Deliver with accurate assurances.
The recipient must distinguish a protected transfer from authenticated end-to-end authorship.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Separate transport trust from end-to-end authorship.
- A sender address in the SMTP envelope or message is not by itself authenticated identity.
- Hop authentication does not automatically authenticate an entire relay chain or the message author.
- Protect blind-copy privacy, limit unauthorized relay use, and consider the disclosure caused by VRFY, EXPN, greetings, and traces.
STARTTLS and SMTP AUTH are separately specified extensions. Signed-message mechanisms can establish different assurances from a secured connection between adjacent servers.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy