Subj : docs/v322_new.md src/sbbs3/mailsrvr.cpp
To   : Git commit to main/sbbs/master
From : Rob Swindell (on Debian Linux)
Date : Tue Aug 18 2026 22:04:59

https://gitlab.synchro.net/main/sbbs/-/commit/f8d0bd2f64b441e91fe3e662
Modified Files:
	docs/v322_new.md src/sbbs3/mailsrvr.cpp
Log Message:
mailsrvr: honor ALLOW_RELAY for foreign submission sender addresses

Since b8332a4618 (chart-3-cause, 2026-08-10), the submission ports verify
that an authenticated user's MAIL FROM and From: address is at one of the
system's domains and resolves to that user. That rejects the sysop who
points a mail client at another BBS as a smarthost and submits as their own
domain -- which worked on 587 before that commit, and still works on port 25
wherever ALLOW_RELAY is set.

Both of Vertrauen's authenticated submissions on 2026-08-18 were refused
this way, one of them from a domain whose SPF record already authorizes
Vertrauen to send for it. The reply named an address the submitter had no
reason to want, so it read as a problem with the server hostname rather than
with the sender address.

A sender address in a foreign domain is a relay, so honor the permission the
sysop already granted for relaying: with ALLOW_RELAY enabled, accept one
from an authenticated user who is not restricted from relaying (G/M). An
address in one of the system's own domains must still resolve to the
authenticated user, so this is no license to forge a local address -- the
case that would lend the system's DKIM reputation to the forgery.

RFC 6409 section 6.1 (Enforce Submission Rights) is a MAY, in a section
titled "Optional Actions", so declining to enforce it is conformant. The
authentication requirement of section 4.3, a MUST, is unaffected.

Issue #1221 asked for sysop-selectable strictness here. ALLOW_RELAY is a
coarse stand-in for that -- a dedicated option or an ARS (issue #107) would
express it properly -- but it does pick out the systems that mean it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.