> -----Original Message----- > From: Claus Assmann [mailto:ca+sasl@xxxxxxxxxxxx] > > IMHO the server could fall back to a default realm (e.g. it's FQDN) > if no realm is sent by the client. > This won't work (in general). The realm used in the hash has to be exactly the same by the client and the server, otherwise it won't check. If the client uses a realm value, it might as well send it. Paul