On 2026-10-14 20:44:30 (+0800), Dan Mahoney wrote:
On Oct 14, 2026, at 5:26 AM, Otto J. Makela <[email protected]> wrote:
On 12/10/2026 19.15, Al Iverson via mailop wrote:
Keep reaching for that brass ring, but making this list "forwarding
fail proof" isn't possible based on how the world works today. If
you
modify the MLM to stop making changes to prevent DKIM failures
you're
still going to have problems with SPF failures. Given that Microsoft
and Google require both SPF and DKIM pass for bulk senders, that
just
shifts the pain, it doesn't eliminate it.
I'm certain you know your stuff re SPF, but apparently I don't.
Can you please expand a bit about SPF failures, since AFAIK on a
properly configured mailing list the SMTP "mail from" (aka envelope
sender) of messages sent through it would be to mailing list server,
and naturally you'd include that in your domain's SPF?
Naturally?
My day job is JTD.org <http://jtd.org/> (rot1), and lots of us
participate in open source mailing lists. (We also run a bunch) I'm
not going to include mailop.org <http://mailop.org/> , nanog.org
<http://nanog.org/> , and ietf.org <http://ietf.org/> in our SPF
records, nor should I magically know what lists my users may or may
not participate in.
What we do include in our SPF records is things like our salesforce
setup, which is specifically, contractually, allowed to send mail on
our behalf.
Other than this, we would expect that either the mailing list either
would rewrite messages such that the From: address is the list address
itself, and perhaps add a reply-to of the original sender -- or that
it will not interfere with the headers at all (such as in the case of
a simple alias-list, so DKIM survives -- no mody mods, and no mods of
the standard list of headers. With DMARC, either of DKIM or SPF
typically has to pass, not both.
For what it's worth: for FreeBSD.org we took the second approach. We
try very hard not to mangle the message so that DKIM survives. We also
add our own DKIM signature for good measure. This works for most
messages. Exceptions include cases where senders oversign headers we
have to add (e.g. List-*). This happens infrequently. (We also leave
Reply-To: alone.)
We do have a munge path for mailing lists which, for hysterical raisins,
rewrite the Subject:.
Some mailing lists have knobs to look at the p= value of the sending
domain, and only do the rewriting if the domain has p=reject or
p=quarantine, but honestly, consistent behavior is the better option.
I agree. And I like to think that the probabilistic models that have
replaced all previous spam filters at the large mailbox providers value
consistency too.
Philip
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
