Subj : Submission port (587/465) is not an MSA: authenticated submission requ
To   : GitLab note in main/sbbs
From : Rob Swindell
Date : Mon Aug 10 2026 10:18:16

https://gitlab.synchro.net/main/sbbs/-/issues/1221#note_10147

Implemented in b8332a4618 (chart-3-cause, 2026-08-10).

On the submission ports (587, and 465 for implicit TLS): SMTP authentication
is always required (`530` otherwise, RFC 6409 section 4.3); an authenticated
user sending to an external recipient is a submission rather than a relay and
no longer needs `ALLOW_RELAY`, which continues to govern port 25; and the
`MAIL FROM` and `From:` address must be at one of the system's domains and
resolve to the authenticated user, via the same lookup that decides delivery.
There is nothing to configure. The transfer port is unchanged in every
respect.

Split out rather than done here:

* #1222 -- the remaining RFC 6409 SHOULDs (`Message-ID` generation,
  `PIPELINING`, `ENHANCEDSTATUSCODES`).
* Sessions authorized via `SMTP_AUTH_VIA_IP` resolve their user at `RCPT TO`,
  after `MAIL FROM` has already been accepted, so sender validation does not
  reach them. They still go through the existing `chk_email_addr()` checks.
  Worth its own issue if that path matters to anyone; it is off by default.

Thanks @Deuce -- the reuse-the-delivery-lookup approach is what made this
land with no setting at all.

-- *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.