> There is really no good reason to allow any server to send emails on behalf of any random domain. Except for mailing lists. And email forwarding. And a lot

> There is really no good reason to allow any server to send emails on behalf of any random domain. Except for mailing lists. And email forwarding. And a lot of other stuff you take for granted. Users might not explicitly know about the technical details of how a lot of things work, but that doesn't mean they don't expect the resulting behavior. It's fashionable, these days, to put authentication and authorization in the transport layer. It's not a natural law, though. As an example, consider s/mime or pgp message signing. MDAs could validate signatures and discard messages that are not correct. This is an example way to solve the auth problems you describe without breaking existing mailing lists, since you'd be validating the content instead of the envelope. Just food for thought. SMTP isn't as broken as you think, and replacing it isn't necessary to solve today's problems.