From 01c9d57814164c8ba84ed68eedf7942129bcf3ec Mon Sep 17 00:00:00 2001 From: Ken Murchison Date: Thu, 8 Jan 2026 09:20:58 -0500 Subject: [PATCH] Start of emailcore-as-27 (IETF LC comments) --- draft-ietf-emailcore-as.xml | 50 ++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 15 deletions(-) diff --git a/draft-ietf-emailcore-as.xml b/draft-ietf-emailcore-as.xml index 4a0199a..6901c07 100644 --- a/draft-ietf-emailcore-as.xml +++ b/draft-ietf-emailcore-as.xml @@ -21,7 +21,7 @@ Applicability Statement for IETF Core Email Protocols - + @@ -182,7 +182,7 @@
Handling of the Domain Argument to the EHLO Command If the Domain argument to - the EHLO command does not have an address record in the + the EHLO command does not have an address (A/AAAA) record in the DNS that matches the IP address of the client, the SMTP server may refuse any mail from the client as part of established anti-abuse practice. @@ -328,10 +328,11 @@
Generation - Email addresses are commonly classified as Personally - Identifiable Information (PII). Improper application of the - FOR clause in Received header fields can result in disclosure - of PII. As such, the FOR clause SHOULD NOT be generated if the + Email addresses are commonly classified as Personal Data + (see ). + Improper application of the FOR clause in Received header + fields can result in disclosure of personal data. + As such, the FOR clause SHOULD NOT be generated if the message copy is associated with multiple recipients from multiple SMTP RCPT commands. Otherwise, the value of the FOR clause MUST contain the RCPT @@ -516,9 +517,9 @@ Email addresses are frequently used as input to, or validated by, forms managed by various libraries, some - tied to Versions of HyperText Markup Language (HTML) or + tied to versions of HyperText Markup Language (HTML) or other specs and others to client-side libraries developed - in Javascript or other languages. + in JavaScript or other languages. In some cases, those who define or supply those systems may have found and corrected errors long ago, but old versions or interpretations are still in use. The allowed @@ -629,7 +630,7 @@
  • - TLS, + TLS, STARTTLS, Require TLS, MTA-STS, and @@ -674,7 +675,7 @@ Security at the Transport Layer The Internet email environment has evolved over the years so that the SMTP protocol itself can be used in conjunction with - Transport Layer Security (TLS) + Transport Layer Security (TLS) protocol to provide both confidentiality and server authentication in the transmission of messages. @@ -683,7 +684,7 @@ the terms "Authentication" and "Confidentiality" in this context, and for that we will borrow directly from the TLS specification - (although the pointers to other + (although the pointers to other sections given are to this document). @@ -710,7 +711,7 @@
    The TLS Protocol - The TLS Protocol + The TLS Protocol provides confidentiality while the message is in transit from an SMTP client to the next SMTP server. Both client and server will have access to the plain @@ -741,7 +742,7 @@ Opportunistic TLS is optional confidentiality due to provision for falling back to transmission in the clear if - a secure connection cannot be established. + a TLS_protected connection cannot be established. Opportunistic TLS is often configured to provide confidentiality without authentication, where no effort is made to authenticate the receiving server @@ -858,6 +859,8 @@ SMTP AUTH is for a person to present a username and password to their mailbox provider's outbound SMTP server when configuring their MUA for sending mail. + Credentials MUST NOT be sent without TLS, and deployments + should require use of TLS with SMTP AUTH. SMTP AUTH MAY be used to limit unauthorized use of VRFY and EXPN commands as described in . @@ -986,7 +989,6 @@ - @@ -997,6 +999,7 @@ + @@ -1019,6 +1022,12 @@ + + + + + + @@ -1442,6 +1451,17 @@
+
+ Changes from draft-ietf-emailcore-as-26 to -27 +
    +
  • Specified actual DNS address record types.
    • +
  • Changed PII to Personal Data with reference to RFC 6973.
    • +
  • Noted that SMTP AUTH should be used with TLS.
    • +
  • Added reference to RFC 9325.
    • +
  • Miscellaneous editoral changes.
    • +
+
+