(MUA 1) The ADMD's MSA authenticates the user, either based on its IP address or some other SMTP Authentication means. Depending on the recipient address, the message can follow the normal path or pass through a mailing list or a forwarding service. B can be an outbound SMTP proxy or a smarthost. If the local network does not block outbound port 25 connections, the user can deploy some "direct-to-mx" software. Typically, zombies and other malicious hosts behave that way. If the MUA is badly configured, it can also use a different relay, such as an outmoded open relay, that often doesn't authenticate the user. Roaming user (MUA 2) Most of the times it is still possible to use one's own ADMD MSA. Outbound connections to port 25 can be intercepted and tunneled to a transparent proxy. A MUA can be configured to use an SMTP relay that the local network provider offers as a bonus. Disconnected user An e-card can send mail on behalf of a customer who typed email addresses on the local keyboard; some web forms can be considered to work similarly. Section notes Authentication methods in widespread use SPF SPF allows the receiver to check that an email claimed to have come from a specific domain comes from an IP address authorized by that domain's administrators. Usually, a domain administrator will authorize the IP addresses used by their own outbound MTAs, including any proxy or smarthost. The IP address of the sending MTA is guaranteed to be valid by the Transmission Control Protocol, as it establishes the connection by checking that the remote host is reachable. The receiving mail server receives the HELO SMTP command soon after the connection is set up, and a Mail from: at the beginning of each message. Both of them can contain a domain name. The SPF verifier queries the Domain Name System (DNS) for a matching SPF record, which if it exists will specify the IP addresses authorized by that domain's administrator. The result can be "pass", "fail", or some intermediate result - and systems will generally take this into account in their anti-spam filtering. DKIM DKIM checks the message content, deploying digital signatures. Rather than using digital certificates, the keys for signature-verification are distributed via the DNS. That way, a message gets associated to a domain name. A DKIM-compliant domain administrator generates one or more pairs of asymmetric keys, then