On 2020-12-16 at 12:10 -0500, Dave Shevett via mailop wrote: > Wer're actually running on a linode now that's pretty much dedicated > to running mailman. The issue is there's still a lot of yak-shaving > to make it all work, in particular understanding how to get dkim > signatures to work when mailman rewrites the envelope. Could be the > next version of mailman will fix this, but we're all old fart geeks, > and at some point you just have to go "Y aknow what? I'mg oing to pay > someone else to do this."
Not going to argue against outsourcing, that can be a good call, but in case it helps you buy time to evaluate the options: DKIM doesn't touch the envelope, only the message headers. I've found that what works the best is "REMOVE_DKIM_HEADERS" set to 3, BUT editing Handlers/CleanseDKIM.py to not rename the authentication-results header, which is needed for ARC validation. Let it rename the others out of the way but not that header. Set DEFAULT_DMARC_NONE_MODERATION_ACTION to Yes, so that the sender's domain owner doesn't get deliverability reports from sites with folks subscribed to the list; DMARC reports are otherwise a major privacy problem. Then the MTA for the domain needs to sign outbound mail. If doing ARC, you're also going to need to record the decision to ARC-sign, which I do by having the MTA shove that into a header when feeding into Mailman, then remove that header from the messages out from Mailman. Given all the steps I put into <https://bridge.grumpy-troll.org/2020/07/small-mailserver-bcp/> it's hard to argue against outsourcing. Ugh. Some days I truly hate email. -Phil _______________________________________________ mailop mailing list [email protected] https://list.mailop.org/listinfo/mailop
