Subject: Re: [spfbis] Authentication-Result (Issue 10?)

From: Arthur Thisell <[email-masked]>
Date: Fri, 31 Aug 2012 06:23:04 -0700 (PDT)

> Which part of Section 5 of RFC5322 talks about Received field ordering?

My mistake, I meant RFC 5321, not RFC 5322.  RFC 5322 talks about the general data format of a message and is careful not to stomp on things defined by RFC 5321, so it treats the Received header field very lightly.

Not surprisingly, since Section 5 of RFC 5322 is the security section, it doesn't talk about the Received header. about trace header fields.

Trace header fields are defined by RFC 5321 section 4.4.  It contains all sorts of MUSTs, in particular, it says:

   An Internet mail program MUST NOT change or delete a Received: line
   that was previously added to the message header section.  SMTP
   servers MUST prepend Received lines to messages; they MUST NOT change
   the order of existing lines or insert Received lines in any other
   location.

There is, needed a security section of RFC 5321 about Received headers, but that is only about information disclosure.  The SPF RFC already talks about that.

But, this does bring up a problem:  Currently, both RFC 4408 and bis-06 give RFC 2822/5322 as references in the definition of the Received-SPF field.  It should be changed to RFC 5321.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 31 Aug 2012 07:12:41 -0700

>    the order of existing lines or insert Received lines in any other

And then the citation I provided from RFC5322 warns that despite this
normative requirement, there exist programs that do such reordering,
and one must not rely on order.  That's what RFC5451 attempted to
address, and we could make use of that here.

-MSK