On Sat, 2014-05-24 at 20:55 -0400, Sam Varshavchik wrote: > Lindsay Haisley writes: > > > On Sat, 2014-05-24 at 09:00 -0400, Sam Varshavchik wrote: > > > kb2...@kb2ear.net writes: > > > > > > > With the recent DMARC implementation from AOL and Yahoo I have a very > > > > broken mailing list. Is there any way using MLM to rewrite the From: > > line > > > > to the list address and the Reply-To: line to the actual sender? > > > > > > Reply-Tos should go back to the mailing list, not the sender. > > > > This isn't an appropriate choice for most lists, which are configured > > for reply-to-sender. Munging the Reply-To header for this purpose is a > > broken way of dealing with the problem. > > I hear that often; but it does not add up for me. The whole purpose of a > discussion-oriented mailing list is to hold public discussions on various > topics; and I'd expect the replies to go back to the list too.
This is not generally the case. The courier-users list doesn't mung the Reply-To header, nor does any other technical list I'm on do so. Munging the Reply-To header destroys information essential to a recipient who wants to have a choice with regard to whether to reply to a poster directly, or to the list. A lively public discussion often involves private asides between participants which are't deemed on-topic enough for the public forum. > > > But, after doing that, you'll probably discover that it doesn't work, for > > > some reason, or something else is broken. > > > > Sam, would you please disambiguate this. What else would break? Why > > would it not work. > > Anyone's guess. SPF and Dmarc are hacks. And I say that even though I use > SPF. I wouldn't be surprised to hear that someone's also checking the Reply- > To addresses, so those will bounce too. > > > > The correct fix is to tell your Yahoo and AOL subscribers to switch > > > providers. > > > > Telling Yahoo and AOL subscribers to change ESPs is NOT a solution, nor > > is it an option for many working mailing lists. Actually getting Yahoo > > and AOL, and other ESPs which honor it, to fix their broken DMARC > > p=reject implementation _would_ be a solution. > > If Yahoo and AOL are saying that the only valid email with their domains on > it are those that are coming from their servers, it may be dumb or stupid, > but it's certainly their prerogative to do so. It's their domain. They own > it. They are free to choose to run it however they like. > > If that's what they're saying, then honoring that request would be the > correct thing to do, and bouncing mail with their domain on it, that's not > coming from their servers, is the reasonable thing to do. The "author" and the "sender" of a message are distinct entities, and it seems that they often get confused in discussions of DMARC. From RFC 2822 (3.6.2): "The "From:" field specifies the author(s) of the message, that is, the mailbox(es) of the person(s) or system(s) responsible for the writing of the message. The "Sender:" field specifies the mailbox of the agent responsible for the actual transmission of the message." Using the authorship information in a message to determine origin is a misinterpretation of the From header, which bends RFC 2822 even if it doesn't break it outright. > If someone's mail bounces because of that, or if someone gets booted off the > mailing list, because of that, well, that's that. They'll just have to stop > using Dmarc or SPF. Honoring DMARC p=reject is determined at an administrative level by an ESP, not by a list subscriber. > I haven't looked much at Dmarc, but I'd expect that a reasonable > implementation of Dmarc should take an analogous approach, to accomodate > mailing list traffic. The onus on supporting Dmarc should fall on the end- > recipient, not a mailing list intermediary. If someone's usage of Dmarc gets > them bounced off a mailing list, it's their problem, not the mailing list's. Any per-recipient choice with regard to body content filtering (and the From: header is message body content) is problematic for reasons I stated previously. This is inherent in the design of the SMTP protocol. If a message has multiple recipients on the same server there is no way to decide, during the course of an SMTP session, whether to accept or reject an entire message based on the envelope recipients when the information necessary to make such a decision isn't available until after the recipient list has been accepted. To do so would involve a two-stage process with a DSN/NDR being sent back to the envelope sender _after_ the message was accepted during the initial SMTP exchange. This is possible, and is sometimes done, but involves substantially more complexity on the receiving system. I was educated on this matter some years ago when Sam explained in very clear and excruciating detail why Courier issues "You are whitelisted ..." and similar temporary rejections in these cases. See < http://marc.info/?l=courier-users&m=108449611418159> and other messages in this thread. -- Lindsay Haisley | "UNIX is user-friendly, it just FMP Computer Services | chooses its friends." 512-259-1190 | -- Andreas Bogk http://www.fmp.com | ------------------------------------------------------------------------------ Time is money. Stop wasting it! Get your web API in 5 minutes. www.restlet.com/download http://p.sf.net/sfu/restlet _______________________________________________ courier-users mailing list courier-users@lists.sourceforge.net Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
