> and yes, they have to be all set one by one, because there is no deny-all in the spec. No doubt this spec was designed with end-users' privacy and security in

> and yes, they have to be all set one by one, because there is no deny-all in the spec. No doubt this spec was designed with end-users' privacy and security in mind. In fairness that spec was designed in a much more naive time, when open SMTP servers were commonplace, along with other things that would be a security red flag these days. Also, “designed” may be too generous a word. Back then (~96/97?) web related things were being thrown together on a whim.