ON-DEMAND MAIL RELAY (ODMR) SMTP with Dynamic IP Addresses
Extracted elements (18)
ODMR addresses the problem of mail delivery to hosts with dynamic IP addresses, which cannot use ESMTP ETRN (designed for static IPs). The solution reverses client/server roles after authentication so the intermittently-connected customer can pull queued mail from the provider.
The EXTERNAL SASL mechanism may be useful when the provider has already authenticated the customer at a lower layer (e.g., during PPP connection establishment), avoiding redundant credential exchange.
ODMR is a restricted SMTP profile; the provider's ODMR listener need not be a full SMTP server but must implement EHLO, AUTH, ATRN, and QUIT, plus function as an SMTP client with access to outgoing mail queues.
If the customer's authentication does not cover all domains specified in ATRN, the provider MUST NOT send mail for any domains and MUST reject the ATRN command with a 450 code.
Implementations MUST support the CRAM-MD5 SASL mechanism for authentication interoperability. A site MAY disable CRAM-MD5 if more secure methods are used.
The ATRN command MUST be rejected with response code 530 if the session has not been authenticated.
The EHLO response MUST include AUTH and ATRN capability keywords to advertise ODMR support.
The provider MAY reject all commands other than EHLO, AUTH, ATRN, and QUIT with response code 502 (Command not implemented).
The timeout for the ATRN command MUST be at least 10 minutes to allow the provider time to process its mail queue.
After ATRN success, the customer sends a standard SMTP greeting line. The provider then issues EHLO followed by normal SMTP commands (MAIL FROM, RCPT TO, etc.) to deliver queued mail.
ATRN (Authenticated TURN) optionally takes one or more comma-separated domains as parameters. An ATRN with no domains is equivalent to requesting all domains the customer is authorized for. ABNF: atrn = 'ATRN' [SP domain *(',' domain)].
If no queued mail exists for any authorized domain, the provider normally rejects ATRN with 453. The provider MAY instead issue 250 and after role reversal send QUIT following EHLO.
ODMR is a restricted profile of SMTP operating on port 366. The customer initiates a connection, authenticates, then roles reverse and normal SMTP proceeds for mail transfer.
Response code 450 is used to reject ATRN due to authorization failure or to refuse multiple requests within a time interval. Code 451 indicates the provider cannot verify domain access (e.g., mapping database unavailable).
Access to the ODMR port (366) may be restricted via TCP wrappers, firewalls, or server configuration to limit connections to the provider's network, since the service is only useful to pre-arranged parties. This supplements but does not replace the AUTH requirement.
Use of SASL in the AUTH command allows substitution of more secure authentication mechanisms in the future, making the protocol extensible for stronger security without protocol revision.
ODMR has three states: Initial (EHLO, AUTH, QUIT valid), Authenticated (ATRN, QUIT valid), and Reversed (roles swap; provider becomes SMTP client, customer becomes server). Transitions: AUTH success → Authenticated; ATRN success → Reversed; QUIT → Termination from any state.
ATRN command syntax: 'ATRN' optionally followed by a space and one or more domains separated by commas. Domains are dot-separated sub-domains composed of alphanumeric characters and hyphens (ldh-str format).