Re: [Mailsec] CLIENTID and ESMTP and LMTP Transmission Types Registration

[Michael Peddemors <[e-mail]>]

On 2023-03-27 10:10, Andrew C Aitchison wrote:
> 
> [ I am attempting to implement CLIENTID for Exim the MTA. ]
> 
> https://www.rfc-editor.org/rfc/rfc3848
> added ESMTPA, ESMTPS, ESMTPSA, LMTP, LMTPA, LMTPS and LMTPSA
> to SMTP and ESMTP for use in the "with" clause of a Received
> header in an Internet message.
> 
> Would we want CLIENTID to add to this list ?
> My thought is that this would risk leaking information
> which might allow a third party to infer facts about the
> heuristics or rules used, so my guess is "no".
> 
> If we *did* decide to add to this list, would ESMTPSC and ESMTPSCA
> be sufficient, or do we want LMTPSC and LMTPSCA too ?
> 
> Thanks,
> 

Sorry about the delay in responding...
Might need some other voices on this, but I dont' really see any need to 
alter the Received headers based on whether the authentication used 
CLIENTID or not, it can still use the default ESMTPSA (It would never 
use ESMTPA as that channel is not encrypted of course) and since this is 
limited to authentication at this time, I don't see even where ESMTPS 
would be used, but someone else might have an argument for that use case.

The CLIENTID should NOT be shared, even the CLIENTID TYPE, and should 
not be recorded in the email message in any way IMHO, just as you 
pointed out, even indicating that the client prefers to use CLIENTID is 
not something that needs to be spread around.

Somewhere in the future, I 'guess' knowing the sender was using CLIENTID 
'could' be considered a trust factor, but I don't think sharing that 
information will ever be desirable.

(For the record, we don't include it in our Received headers.)


-- 
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.