Subject: Heads-up: you may be silently missing list mail from proton.me senders
Hi all,
Short version: if you've had the feeling that you're missing messages from this
list, you probably are. The mails do reach the list and they are in the
archives at lists.apache.org — they're being quarantined at the receiving end.
This came up with one contributor posting from a proton.me address, but it's a
domain-level issue, not a person-level one.
What's going on
Proton publishes the following for proton.me:
v=DMARC1; p=quarantine; fo=1; aspf=s; adkim=s;
When a message from such an address goes through the list, two things happen:
the envelope sender becomes the ASF relay, so SPF no longer aligns with the
From domain; and if the list appends a trailer, the DKIM body hash breaks as
well. DMARC then fails, and receivers apply the published policy — quarantine.
ASF Infra has a mitigation for exactly this scenario. For lists that modify
messages, the From header gets rewritten with a .INVALID suffix and the DKIM
signature is dropped, based on a lookup of the sender domain's policy. But that
lookup keys on p=reject. proton.me is p=quarantine, so the mitigation never
fires and the message goes out unprotected.
Why nobody noticed
Quarantine means the receiving provider accepts the message at SMTP time and
then files it away. No bounce goes back to the ASF relay, so ezmlm never counts
a bounce and nobody gets auto-unsubscribed. There is no visible signal at all —
the mail just quietly doesn't appear in your inbox.
What you can do right now
- Check your quarantine or spam folder. Microsoft 365: security.microsoft.com
-> Quarantine (30 day retention). Google: the Spam folder.
- If you administer your own Microsoft 365 tenant, a mail flow rule matching
messages where the header List-Id contains plc4x.apache.org, with the action
"set SCL to -1", bypasses spam filtering for list mail only. That's narrower
and safer than a general sender allowlist, which EOP largely ignores for
authentication failures anyway.
- Other providers: allowlist on List-Id if your filter supports it.
And in general: before assuming a question on the list went unanswered, check
the archives. Replies in affected threads may be missing from your inbox too.
Proposed next step
I'll file an INFRA ticket asking whether the DMARC mitigation can be extended
to cover p=quarantine domains and not just p=reject. Most domains sit at
quarantine rather than full reject these days, and Proton is common enough
among contributors that we're unlikely to be the only project running into this.
The narrower alternative would be asking Infra to switch our lists to a
non-munging configuration (ezmlm-make -+ -TXF), so the original DKIM signature
survives and DMARC passes on DKIM alignment. That fixes things here but leaves
the general case open, so I'd rather try the first option.
One last thing: if you post from a proton.me address, there is nothing wrong on
your side and nothing you can configure — the DMARC policy belongs to Proton,
not to you. Posting from an address on a domain where you control the DMARC
record avoids it in the meantime.
Chris
