On 2026-09-08 at 13:58:39 UTC-0400 (Tue, 8 Sep 2026 13:58:39 -0400)
Matt Corallo <[email protected]>
is rumored to have said:
Apologies, I've attached a sample.
OK, so this isn't so much tricking SA as it is an apparently real Apple
Developer using the TestFlight system to invite random(?) targets.
Is 'e22dde6c-9a31-60ae-64d0-5e2ff84a6b79' a specifically real local
address, does it match some general pattern that you accept, or is
mattcorallo.com a "catch-all" that accepts any local address? Are all
the messages to the same UUID-like localpart or do they vary?
I'm only asking because it points at one possible *practical* solution
for you: make your catch-all more discerning.
As a fix of the SA-side issue, I'm revising the default welcomelist
entries for Apple. The only real excuse they could have is if you have
in fact subscribed to TestFlight invites in a general way, but as
they've never offered that to me in decades of being a paid-up Mac
developer, I assume that you did not do so. Also, the mail lacks any way
for you to tell the mail handler (Apple) to stop and that's generally
unacceptable. If I were a lawyer I might even argue that this is in
violation of US law (CAN-SPAM) because it only lets you unsub from the
one developer's mail. Even if you had specifically subscribed that
address to TestFlight invites generally, the lack of an unsub *from
TestFlight mail generally* is enough for me to kill the whitelisting.
On 9/8/26 1:39 PM, Bill Cole wrote:
On 2026-09-08 at 13:32:33 UTC-0400 (Tue, 8 Sep 2026 13:32:33 -0400)
Matt Corallo <[email protected]>
is rumored to have said:
It seems people are now spamming testflight invites at random and
bypassing SA due to the combo of the DKIM_WL and SPF_WL for mail
from [email protected].
It would help if we could see concrete examples. There are multiple
def_welcomelist_auth entries relevant to Apple in the default rules
and it would help to know precisely how they are using
"[email protected]" in a way that seems properly
authenticated to SA.
--
Bill Cole
[email protected] or [email protected]
(AKA @[email protected] and many *@billmail.scconsult.com
addresses)
Please keep discussion mailing list replies *on-list*
Not Currently Available For Hire
