Re: Fwd: Re: mailing list question

I think the problems here are:

1.  Email not authorised to send email on behalf of sending domain

When forwarding on emails to recipients, this mailing list is incorrectly
purporting to be an email server that is authorised to send mail from the
domain of the sender.  So if I submit a message to the list from
[email protected], mydomain.com will have some dns records set up (mx, spf)
that state which IP addresses are allowed to send email on behalf of
[email protected].   This mailing list then sends the message as if it
came from [email protected] (ie in the smtp headers), but uses it's /own/
mail server to send that message, which will /not/ be in the dns records for
mydomain.com.

The receiving email server(s), as part of dmarc authentication will lookup
the dns records for the mail server, and determine that this lists's email
server is not authorised to send on behalf of mydomain.com, then according
to the dmarc configuration that mydomain.com has (together with it's own
rules), decides whether to deliver, discard, whatever.

I know this because I have my own email server set up with dmarc
authentication, and whenever I send a message to this list, within 24 hours,
I get a load of dmarc reports back from gmail, yahoo etc. telling me that a
mailing server is sending messages from my domain, and isn't authorised to
do so.

2.  Reputational damage from mailing list server

As google, yahoo continue to receive messages send via the mechanism above,
they will most likely keep reputation scores on individual email server mx
domain names and ip addresses. Initially, it might let messages through, but
after a while it will start dropping them permanently, as the email server
is a persistent offender.

3.  Sending domain dmarc configuration tightening.
As part of dmarc configuration of a mail server of a domain I control, eg.
mydomain.com, I can state what I want to happen should emails *not* sent
from my configured email servers.  Currently, I have it set to monitor, so
that it won't do anything special, such that if eg. I forgot to add an email
server IP to the dns configuration, the dmarc bounce reports give me the
chance to add that IP to my configuration, without damaging the reputation. 
This could be tightened, such that I say 'always reject', in which case the
reputation of the mailing list server would probably be impaired over time.

So it looks like that all mail server providers are now tightening away from
'monitor' to a higher setting, resulting in more message simply being
discarded.. ie the mailing list server won't even see a bounce.. the message
will simply be discarded.

So, problem 1 may be fixable my changing the configuration of the mailing
list server so it always sends eg. [email protected], or whatever. 
This will always be the identity of the sender, regardless of the real
person eg. [email protected].  It should be possible to inject the original
email into the message body or subject somehow to indicate where it came
from, or left off completely / whatever.    So yahoo, gmail will lookup eg.
swi-prolog.com and find that the ip address of the mailing server IS
authorised to send emails on behalf of that domain, and will deliver them.

But even if that is done, I fear that problem 2 - the reputational damage
might not be recoverable, even over time.  

If it were me, I would start off with new domain, with undamaged mail server
reputation, then setup a single sender eg. 'swi-mailer', and configure all
the mx, spf and dmarc records to ensure in the future that no other person
can impersonate this mailing list in the same way that it is currently
impersonating the senders.  

Additionally, having all the dmarc stuff setup will increase the chances of
having mail delivered successfully, since you are openly saying 'this
message definitely came from my domain.. you have verified this using the
public key I gave you, and from my mx and spf records', so you will be
trusted more.

I have never set up a mailing list server, so my knowledge ends there
unfortunately.  There are lots of commercial providers who send millions of
emails a day eg. aweber, who get them delivered, so I don't thinbk this is
not a problem of mailing lists in general, and boycotting individual email
server providers won't help - they are all using dmarc now - I know, I get
the failure reports on my domains every day.








--
View this message in context: http://swi-prolog.996271.n3.nabble.com/Fwd-Re-mailing-list-question-tp14894p14900.html
Sent from the SWI Prolog mailing list archive at Nabble.com.