Yes I agree it is complex. Just validating the domain is not sufficient, the whole e-mail address needs to be validated, and not only that it is a valid e-mail address, but that the person trying to use that e-mail address has the rights to send mail under that address. This will require a fundamental change in the protocol currently used to send mail (SMTP), and will require that the server accepting mail to send (SMTP server) be able to identify the sending user, and verify that the user has the rights to use that e-mail address.
For web bases e-mails this is fairly straight forward, as the user has to log in (and hence verify who they are). The problem is with dialup users and as mentioned, sites that send e-mails on behalf of someone such as electronic post card sites.
Dialup user get verified as a legitimate dialup user, but there is no currently no mechanism for the mail server to 1) get this user name, 2) get a list a valid e-mail addresses that user is authorised to use.
Things get further complicated if the user has their own domain and wants to use an e-mail address which is not one assigned to them by their internet provider, there is no mechanism where the ISP can check the domain records to see if someone using a valid domain has rights to send e-mails with an address using that domain.
Things are further complicated by that there can be several different e-mail addresses in an e-mail, From, Sender, Reply-to: and different validations rules could be required when verifying these.
The fundamental underlying problem is there is no global user verification method, that allows a server to verify a request to send an mail to verify that it is being initiated by someone who has the rights to use that e-mail address in the From: or Reply-to: addresses. The Sender address should probably be used to record which service is sending the e-mail, such as a mailing list or postcard site, and this should probably be tied to be verified against a server or group of servers.
Yes I agree it is complex. Just validating the domain is not sufficient, the whole e-mail address needs to be validated, and not only that it is a valid e-mail address, but that the person trying to use that e-mail address has the rights to send mail under that address. This will require a fundamental change in the protocol currently used to send mail (SMTP), and will require that the server accepting mail to send (SMTP server) be able to identify the sending user, and verify that the user has the rights to use that e-mail address.
For web bases e-mails this is fairly straight forward, as the user has to log in (and hence verify who they are). The problem is with dialup users and as mentioned, sites that send e-mails on behalf of someone such as electronic post card sites.
Dialup user get verified as a legitimate dialup user, but there is no currently no mechanism for the mail server to 1) get this user name, 2) get a list a valid e-mail addresses that user is authorised to use.
Things get further complicated if the user has their own domain and wants to use an e-mail address which is not one assigned to them by their internet provider, there is no mechanism where the ISP can check the domain records to see if someone using a valid domain has rights to send e-mails with an address using that domain.
Things are further complicated by that there can be several different e-mail addresses in an e-mail, From, Sender, Reply-to: and different validations rules could be required when verifying these.
The fundamental underlying problem is there is no global user verification method, that allows a server to verify a request to send an mail to verify that it is being initiated by someone who has the rights to use that e-mail address in the From: or Reply-to: addresses. The Sender address should probably be used to record which service is sending the e-mail, such as a mailing list or postcard site, and this should probably be tied to be verified against a server or group of servers.
That's a short, and really good summary of what MARID finally amounts to :)
Also - my followup to Esther's article, at http://www.circleid.com/article/607_0_1_0_C/#1087811284