[Last-Call] Re: [Emailcore] Re: [secdir] draft-ietf-emailcore-as-28 ietf last call Secdir review

[Nico Williams <[e-mail]>]

On Sat, May 02, 2026 at 01:00:00PM -0700, Eric Rescorla wrote:
> And then we have the following text from the AS:
> 
>    SMTP-receivers MUST be configurable to allow for receiving messages
>    without specific confidentiality mechanisms, or even without
>    confidentiality, between SMTP-senders and SMTP-receivers in order to
>    maximize interoperation and avoid refusal of legitimate messages.
>    While that provision is extremely important to promote delivery of
>    legitimate messages whenever possible, mechanisms that provide
>    confidentiality are still strongly preferred when they are feasible.
> 
> I read this text as prohibiting implementations from implementing only
> a mode where they, require STARTTLS prior to accepting, as Viktor
> says, '"MAIL FROM", "RCPT TO" and "DATA"'. That is what I am objecting
> to. Phrased in the other direction, I think we should allow
> implementations to be written that only accept "MAIL FROM", etc. after
> STARTTLS.

I agree that the I-D does just that.  The I-D does not specify a
protocol.  It specifies an applicability statement with less than
universal applicability -- it may not apply to your use case.  Moreover,
the reasons given (long tail, etc) are solid, but you will not respond.
By all rights your view must be in the rough until you elect to respond.

Nico
--