The Recipient SMTP Server has the role to verify the AuthKey that comes with the message and handles the message according the to rule that is set by the administrator and/or the recipient.

The Recipient SMTP Server gets the AuthKey and the sender email address. It checks the sender email address domain DNS for the TXT Field for the AS value which provide the Authentication Server and the Port Number.

It sends a VERIFY Command and waits for a reply. It includes a sequence number in the VERIFY Command that is generated by the Recipient SMTP Server. The Authentication Server replies VERIFY_REPLY with the same sequence number and the email address. The reply is either VALIDKEY or INVALIDKEY.

The Recipient SMTP Server must remove the AuthKey from the header.

The Recipient SMTP Server can check the cache first, if the Key matches and it is valid, then it will not require contacting the Authentication Server. If the key does not match the one in the cache, then it should contact the Authentication Server. If the new Key is valid, then it replaces the Key in the cache.

Recipient SMTP delivers the message according to the verification results and the preference settings that are defined by the administrator and/or the recipient.

If the AuthKey is valid, the mail should be delivered.

The possible scenarios for invalid AuthKey are as follow:

1. Accept the messages and do not mark it as Spam.
2. Accept the message and mark it as Spam or deliver to the Spam folder.
3. Reject the message without notification to recipient or sender.
4. Reject the message without notification to recipient, but with notification to sender.
5. Reject the message with notification to recipient and no notification to sender.
6. Reject the message with notification to recipient and sender.

If the key does not exist or is INVALID the Administrator/User can set the behavior to reject or quarantine the message.