I have some insight into what is happening here. L-Soft just updated listserv v 16 to do exactly what you describe (I belong to L-Soft’s site manager and list owner groups). The patch causes listserv to check for a DMARC DNS record, and if one exists with p=reject it rewrites the FROM field in the header with what you describe. If the originating IP does not have a DMARC record or has one and does not have p=reject listserv ignores it. So either Google uses listserv or they read the listserv lists also and copied it.
Either way, it is a very ugly workaround. best, Larry On Apr 25, 2014, at 1:38 PM, Al Iverson <[email protected]> wrote: > On Fri, Apr 25, 2014 at 1:19 PM, Michael Storz <[email protected]> wrote: > >> Interesting, my experience is different. The last example of a From field >> with an aol.com or yahoo.com domain via googlegroups.com I've seen in my >> logs is from Apr 22 20:16:33. The first rewritten From field is from Apr 22 >> 18:12:23. But this is only the case for aol.com and yahoo.com, yahoo.de and >> other yahoo domains without DMARC policy=reject are not rewritten. > > This fits with what I am seeing as well. I tested Google Groups just > about an hour ago and ended up whipping up a quick blog post about it: > > http://www.spamresource.com/2014/04/google-groups-rewriting-from-addresses.html > > Regards, > Al Iverson > _______________________________________________ > dmarc-discuss mailing list > [email protected] > http://www.dmarc.org/mailman/listinfo/dmarc-discuss > > NOTE: Participating in this list means you agree to the DMARC Note Well terms > (http://www.dmarc.org/note_well.html) -- Larry Finch [email protected]
_______________________________________________ dmarc-discuss mailing list [email protected] http://www.dmarc.org/mailman/listinfo/dmarc-discuss NOTE: Participating in this list means you agree to the DMARC Note Well terms (http://www.dmarc.org/note_well.html)
