On Mon, Sep 05, 2016 at 08:17:40PM +0200, Sebastian Nielsen wrote: > Sean Greenslade: > Thats the responsibility of the server who is authorized to act on behalf of > that domain.
Yes, however I am trying to make this discussion relevant to the OP's question. Authenticating based solely on originating server puts the authentication job onto that originating server. If that server allows users to send mail as other users on the same domain, that is a potential security hole, since the email parsing server does not know what user auth'd to the mail server, only that _someone_ did. It may be that user spoofing isn't an issue. If it's not, then this doesn't matter. But if the OP wants to, say, only allow certain users to send messages to this parser, they must verify that the mail server restricts envelope sender based on authenticated user. --Sean
