<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
Magnus Holmgren wrote:
<blockquote cite="mid200611032104.05955@proffe.kibibyte.se" type="cite">
<pre wrap="">On Friday 03 November 2006 19:36, Marc Perkel took the opportunity to say:
</pre>
<blockquote type="cite">
<pre wrap="">IMAP requires a password. SMTP it's optional. I think that consumer SMTP
should be replaced with not only something that requires a password, but
that the user has to log into the account that they are sending email
from. SMTP doesn't have to be tied to IMAP accounts. If you have an SMTP
account you can spoof anyone. My idea with IMAP sending is to deny the
ability of the sender to use a different email address that the one that
they are logged into. This is to prevent spam and spoofing.
</pre>
</blockquote>
<pre wrap=""><!---->
You never give up, do you? Every time you propose submission by IMAP many
people tell you that there is no fundamental difference between that and
authenticated SMTP. Every ISP in the world, including the large-scale
spammers who act as ISPs themselves, would have to employ suitable policies
to avoid transmitting spoofed email. SMTP will still be used to transmit the
mail to its destinations. Real authenticity is achieved using digital
signatures, e.g. DKIM, in combination with SPF and your personal trust
preferences. For example, GMail allows their users to send mail from any
email address they can demonstrate that they own. That's good, that's what
yoy want, and it is completely unrelated to IMAP.
</pre>
</blockquote>
<br>
There is a fundamental difference.<br>
<br>
1) You can use SMTP or authenticated SMTP to authenticate and send
email through ANY server and it doesn't require that the authentication
have anything to do with the authentication of the IMAP account. If you
had an IMAP protocol to send email then you could lock out the SMTP
protocols for end users and force the to have to authenticate using the
same protocols. This gives you several advantages. You can make it so
that the from address and reply to address match the IMAP account
prohibiting spoofing of email addresses. It can be used to prevent user
mischief.<br>
<br>
2) It eliminated 50% of user setup in that once you set up IMAP you
need not set up oupgoing email.<br>
<br>
3) It gets you around port blocking. If you can receive email you can
send email This is good for those traveling who have trouble finding a
working SMTP server.<br>
<br>
4) A server who advertizes through DNS that they have these
restrictions can prevent spam as other servers can reject spam from
that domain that comes from outside the rules advertized.<br>
<br>
5) Why use 2 protocols when you can use one?<br>
<br>
</body>
</html>