Separate authenticated message submission policy from SMTP relay handling

Use this document to resolve one bounded operational decision: Separate authenticated message submission policy from SMTP relay handling. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official RFC 6409 — Message Submission for Mail from RFC Editor / Internet Engineering Task Force supports the following bounded statements:

• Port 587 identifies ESMTP message submission, while port 25 may be used only when a site explicitly distinguishes submission agents from transfer agents. The research record locates this support at Section 3.1 (Submission Identification).
• A submission agent requires authentication by default unless the session is already independently authenticated or authorized. The research record locates this support at Section 4.3 (Require Authentication).
• A submission agent may reject syntactically invalid message data or content that conflicts with the user’s permissions or site policy. The research record locates this support at Section 6.3 (Check Message Data).

These statements are the factual basis for this document. Do not extend them into a broader assurance. Review sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling only where the source and recorded environment align.

What the source does not establish

This RFC evidence supports only the named mail-protocol decision; it does not prove provider support, deliverability, or compliance for a particular flow. Do not read the source as proof of implementation or permission to change production. Its guidance remains conditional on authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers and the environment’s recorded constraints.

Applicability questions

• For source statement 1 at Section 3.1 (Submission Identification), which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at Section 4.3 (Require Authentication), which observable configuration, record, or test can confirm applicability here?
• For source statement 3 at Section 6.3 (Check Message Data), which observable configuration, record, or test can confirm applicability here?
• Within sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, which versions, roles, and configuration states define the review population?
• Could authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers invalidate the test, hide a failure, or change applicability?
• Who owns the decision, and which observation requires stopping, escalation, or rollback?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Start with applicability, then compare the observed state with the cited source. Record the source location, examined part of sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, observed and expected states, owner, and reason for deviation.

An implementation decision needs an owner, approved window, prechecks, observable outcome, stop authority, and rollback path. Validate authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers before and after the test, and store only sanitized operational evidence.

Verification and evidence

Evidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Section 3.1 (Submission Identification); Section 4.3 (Require Authentication); Section 6.3 (Check Message Data). Favor sanitized messages, DNS records, SMTP transcripts, authentication results, policy evaluation, and delivery or rejection logs, linked to stable identifiers, time, and operator.

Close the review only when the evidence, exception handling, resulting action, and after-state are linked. Schedule a new review after material technical, organizational, incident, or source changes; today’s observation is not a continuing guarantee.

Official references

• RFC 6409 — Message Submission for Mail — RFC Editor / Internet Engineering Task Force