Section 7. Security Considerations

7.1.  Mail Security and Spoofing
   SMTP mail is inherently insecure in that it is feasible for even
   fairly casual users to negotiate directly with receiving and relaying
   SMTP servers and create messages that will trick a naive recipient
   into believing that they came from somewhere else.  Constructing such
   a message so that the "spoofed" behavior cannot be detected by an
   expert is somewhat more difficult, but not sufficiently so as to be a
   deterrent to someone who is determined and knowledgeable.
   Consequently, as knowledge of Internet mail increases, so does the
   knowledge that SMTP mail inherently cannot be authenticated, or
   integrity checks provided, at the transport level.  Real mail
   security lies only in end-to-end methods involving the message
   bodies, such as those that use digital signatures (see RFC 1847 [43]
   and, e.g., Pretty Good Privacy (PGP) in RFC 4880 [44] or Secure/
   Multipurpose Internet Mail Extensions (S/MIME) in RFC 3851 [45]).
   Various protocol extensions and configuration options that provide
   authentication at the transport level (e.g., from an SMTP client to
   an SMTP server) improve somewhat on the traditional situation
   described above.  However, in general, they only authenticate one
   server to another rather than a chain of relays and servers, much
   less authenticating users or user machines.  Consequently, unless
   they are accompanied by careful handoffs of responsibility in a
   carefully designed trust environment, they remain inherently weaker
   than end-to-end mechanisms that use digitally signed messages rather
   than depending on the integrity of the transport system.
   Efforts to make it more difficult for users to set envelope return
   path and header "From" fields to point to valid addresses other than
   their own are largely misguided: they frustrate legitimate
   applications in which mail is sent by one user on behalf of another,
   in which error (or normal) replies should be directed to a special
   address, or in which a single message is sent to multiple recipients
   on different hosts.  (Systems that provide convenient ways for users
   to alter these header fields on a per-message basis should attempt to
   establish a primary and permanent mailbox address for the user so
   that Sender header fields within the message data can be generated
   sensibly.)
   This specification does not further address the authentication issues
   associated with SMTP other than to advocate that useful functionality
   not be disabled in the hope of providing some small margin of
   protection against a user who is trying to fake mail.
7.2.  "Blind" Copies
   Addresses that do not appear in the message header section may appear
   in the RCPT commands to an SMTP server for a number of reasons.  The
   two most common involve the use of a mailing address as a "list
   exploder" (a single address that resolves into multiple addresses)
   and the appearance of "blind copies".  Especially when more than one
   RCPT command is present, and in order to avoid defeating some of the
   purpose of these mechanisms, SMTP clients and servers SHOULD NOT copy
   the full set of RCPT command arguments into the header section,
   either as part of trace header fields or as informational or private-
   extension header fields.  Since this rule is often violated in
   practice, and cannot be enforced, sending SMTP systems that are aware
   of "bcc" use MAY find it helpful to send each blind copy as a
   separate message transaction containing only a single RCPT command.
   There is no inherent relationship between either "reverse" (from
   MAIL, SAML, etc., commands) or "forward" (RCPT) addresses in the SMTP
   transaction ("envelope") and the addresses in the header section.
   Receiving systems SHOULD NOT attempt to deduce such relationships and
   use them to alter the header section of the message for delivery.
   The popular "Apparently-to" header field is a violation of this
   principle as well as a common source of unintended information
   disclosure and SHOULD NOT be used.
7.3.  VRFY, EXPN, and Security
   As discussed in Section 3.5, individual sites may want to disable
   either or both of VRFY or EXPN for security reasons (see below).  As
   a corollary to the above, implementations that permit this MUST NOT
   appear to have verified addresses that are not, in fact, verified.
   If a site disables these commands for security reasons, the SMTP
   server MUST return a 252 response, rather than a code that could be
   confused with successful or unsuccessful verification.
   Returning a 250 reply code with the address listed in the VRFY
   command after having checked it only for syntax violates this rule.
   Of course, an implementation that "supports" VRFY by always returning
   550 whether or not the address is valid is equally not in
   conformance.
   On the public Internet, the contents of mailing lists have become
   popular as an address information source for so-called "spammers."
   The use of EXPN to "harvest" addresses has increased as list
   administrators have installed protections against inappropriate uses
   of the lists themselves.  However, VRFY and EXPN are still useful for
   authenticated users and within an administrative domain.  For
   example, VRFY and EXPN are useful for performing internal audits of
   how email gets routed to check and to make sure no one is
   automatically forwarding sensitive mail outside the organization.
   Sites implementing SMTP authentication may choose to make VRFY and
   EXPN available only to authenticated requestors.  Implementations
   SHOULD still provide support for EXPN, but sites SHOULD carefully
   evaluate the tradeoffs.
   Whether disabling VRFY provides any real marginal security depends on
   a series of other conditions.  In many cases, RCPT commands can be
   used to obtain the same information about address validity.  On the
   other hand, especially in situations where determination of address
   validity for RCPT commands is deferred until after the DATA command
   is received, RCPT may return no information at all, while VRFY is
   expected to make a serious attempt to determine validity before
   generating a response code (see discussion above).
7.4.  Mail Rerouting Based on the 251 and 551 Response Codes
   Before a client uses the 251 or 551 reply codes from a RCPT command
   to automatically update its future behavior (e.g., updating the
   user's address book), it should be certain of the server's
   authenticity.  If it does not, it may be subject to a man in the
   middle attack.
7.5.  Information Disclosure in Announcements
   There has been an ongoing debate about the tradeoffs between the
   debugging advantages of announcing server type and version (and,
   sometimes, even server domain name) in the greeting response or in
   response to the HELP command and the disadvantages of exposing
   information that might be useful in a potential hostile attack.  The
   utility of the debugging information is beyond doubt.  Those who
   argue for making it available point out that it is far better to
   actually secure an SMTP server rather than hope that trying to
   conceal known vulnerabilities by hiding the server's precise identity
   will provide more protection.  Sites are encouraged to evaluate the
   tradeoff with that issue in mind; implementations SHOULD minimally
   provide for making type and version information available in some way
   to other network hosts.
7.6.  Information Disclosure in Trace Fields
   In some circumstances, such as when mail originates from within a LAN
   whose hosts are not directly on the public Internet, trace
   ("Received") header fields produced in conformance with this
   specification may disclose host names and similar information that
   would not normally be available.  This ordinarily does not pose a
   problem, but sites with special concerns about name disclosure should
   be aware of it.  Also, the optional FOR clause should be supplied
   with caution or not at all when multiple recipients are involved lest
   it inadvertently disclose the identities of "blind copy" recipients
   to others.
7.7.  Information Disclosure in Message Forwarding
   As discussed in Section 3.4, use of the 251 or 551 reply codes to
   identify the replacement address associated with a mailbox may
   inadvertently disclose sensitive information.  Sites that are
   concerned about those issues should ensure that they select and
   configure servers appropriately.
7.8.  Resistance to Attacks
   In recent years, there has been an increase of attacks on SMTP
   servers, either in conjunction with attempts to discover addresses
   for sending unsolicited messages or simply to make the servers
   inaccessible to others (i.e., as an application-level denial of
   service attack).  While the means of doing so are beyond the scope of
   this Standard, rational operational behavior requires that servers be
   permitted to detect such attacks and take action to defend
   themselves.  For example, if a server determines that a large number
   of RCPT TO commands are being sent, most or all with invalid
   addresses, as part of such an attack, it would be reasonable for the
   server to close the connection after generating an appropriate number
   of 5yz (normally 550) replies.
7.9.  Scope of Operation of SMTP Servers
   It is a well-established principle that an SMTP server may refuse to
   accept mail for any operational or technical reason that makes sense
   to the site providing the server.  However, cooperation among sites
   and installations makes the Internet possible.  If sites take
   excessive advantage of the right to reject traffic, the ubiquity of
   email availability (one of the strengths of the Internet) will be
   threatened; considerable care should be taken and balance maintained
   if a site decides to be selective about the traffic it will accept
   and process.
   In recent years, use of the relay function through arbitrary sites
   has been used as part of hostile efforts to hide the actual origins
   of mail.  Some sites have decided to limit the use of the relay
   function to known or identifiable sources, and implementations SHOULD
   provide the capability to perform this type of filtering.  When mail
   is rejected for these or other policy reasons, a 550 code SHOULD be
   used in response to EHLO (or HELO), MAIL, or RCPT as appropriate.