Re: Fwd: Re: mailing list question

After submitting a message to the list last week from eg. [email protected],
this is an example dmarc report from yahoo saying it received 3 messages
from IP 131.220.8.4/lists.iai.uni-bonn.de, which is not authorised to send
email from mydomain.com (domain name changed.. for privacy).  You can see
the dmarc verifications (dkim and spf) both failed, which is why I got the
report.  

<feedback><report_metadata><org_name>Yahoo!
Inc.</org_name>[email protected]<report_id>1398244772.446320</report_id><date_range><begin>1398124800</begin><end>1398211199
</end></date_range></report_metadata><policy_published><domain>mydomain.com</domain><adkim>s</adkim><aspf>s</aspf><p>none</p><pct>100</pct></policy_published><record><row><source_ip>131.220.8.4</source_ip><count>3</count><policy_evaluated><disposition>none</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>mydomain.com</header_from></identifiers><auth_results><dkim><domain>lists.iai.uni-bonn.de</domain><result>neutral</result></dkim><spf><domain>lists.iai.uni-bonn.de</domain><result>none</result></spf></auth_results></record></feedback>

So this is definitely a 'specific mailing list' sender impersonation problem
in the first instance.  I have similar ones from gmail etc.

As per the last email, I would configure the outgoing mails so it always
sends from eg. [email protected], and see if you have any luck
getting more successful deliveries. But the complete solution is to start
afresh with an untainted domain, and get all the dmarc keys etc. configured
on it.



--
View this message in context: http://swi-prolog.996271.n3.nabble.com/Fwd-Re-mailing-list-question-tp14894p14901.html
Sent from the SWI Prolog mailing list archive at Nabble.com.