Subj : Submission port (587/465) is not an MSA: authenticated submission requ
To   : GitLab note in main/sbbs
From : Rob Swindell
Date : Mon Aug 10 2026 02:37:36

https://gitlab.synchro.net/main/sbbs/-/issues/1221#note_10140

## Settings collapsed to one

The three settings described in the previous note are now one. Superseding
that part of it:

| Setting | Values | Default | Applies to |
|---|---|---|---|
| `[Mail]` `SubmissionSenderValidation` | `Domain` / `User` | `User` | 587/465 only |

**`SenderValidation` is gone, and the transfer port no longer verifies
senders at all.** Sender verification follows from the MSA role: RFC 6409
section 6.1 governs submission, while port 25 answers to RFC 5321, which asks
for no such check. Extending it to the transfer port was scope the issue
never called for.

**`RequireSubmissionAuth` is gone, and authentication is now unconditional on
the submission ports.** The only use for the escape hatch was pointing
unauthenticated clients at 587, and port 25 already serves exactly that, so
the option bought nothing the transfer port does not already offer. RFC 6409
section 4.3 says "MUST, by default", which would have permitted the knob;
the redundancy is what rules it out.

`None` is likewise gone as a validation level. On the submission ports the
choice is `Domain` or `User` -- "no verification" is what port 25 is for.
An unrecognized value, including a stale `None` from an earlier
configuration, falls back to the default rather than disabling verification
(verified against a running server, not just read out of `parseEnum`).

This also shrinks the upgrade surface: port 25 behavior is now identical to
before in every respect, so the only sysops affected are those who have
deliberately enabled a submission port.

### Re-validated

17 assertions over three configurations, all passing. Beyond the earlier
set: the removed keys are inert when present in an `sbbs.ini` (an
unauthenticated `MAIL` on 587 still gets `530` with
`RequireSubmissionAuth=false` set, and a foreign `MAIL FROM` on port 25 is
still accepted with `SenderValidation=User` set), and
`SubmissionSenderValidation=Domain` accepts another local user's address
while still refusing an off-domain one.

-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.