> I could have sworn I saw someone post a list of Exchange's flaws regarding
> internet standards compliance, but when I searched the archives, I couldn't
> come up with anything.  I would appreciate any information on (1) how the
> Exchange-Outlook combination violates internet standards; (2) any known
> security risks other than email worms, which we already know about! :-\
> and (3) miscellaneous usability issues, bugs, and other issues.

Here's my list:

Problems with Micrsoft Exchange on the Internet
May 8, 2000

(1) Messages containing text received from the Internet or imported
from a file and then sent back out to the Internet are often word
wrapped at inappropriate places.

(2) Exchange bounce messages aren't in the Internet standard Delivery
Status Notification (DSN) format (RFCs 1891-4).  This means that
Exchange bounces can't be automatically processed by mailing list
servers.

(3) Users seeing messages from Internet mailing lists in their inbox
see who sent the message, but not what mailing list the message came
from.  The value of the Sender header, if present, should also be
displayed.

(4) The infamous MS-TNEF files still appear occasionally.  Sometimes
attachments are incorporated into the MS-TNEF file and are therefore
inaccessible to users of other email clients.

(5) The IMS does not add a Return-Path header when incoming messages
are delivered, as required by RFC 821.  This makes it more difficult to
solve certain problems, as the SMTP MAIL FROM address is lost.

(6) The IMS needs spam protection:  (1) The ability to block incoming
mail by domain name as well as IP address range, (2) the option of
checking that the SMTP MAIL FROM address is in the DNS and not
accepting the message if it is not, and (3) the option to prevent the
IMS from being used as a relay (with exceptions by domain name).

(7) Exchange should implement MDNs (Message Disposition Notifications)
for receipts, instead of using Return-Receipt-To.  The MDN document has
been approved as an Internet Proposed Standard and will soon be
published as an RFC.

(8) Out of Office notifications have problems.  They are sent to the
wrong address and there is no filtering for mailing lists.