>> How about using SMTP AUTH and verifying the envelope MAIL FROM to match >> the actual user authenticating? > > that doesn't work if you have more than one email address.
Wouldn't address resolution take care of that if properly configured? Some implementations allow you to specify what email addresses the user is allowed to send from, that's something that needs to be managed carefully. -GSH
