Re: Fwd: Re: mailing list question

There's no logical reason why me submitting an email to the swi list /must/
be treated as an smtp 'forward', with the list server acting effectively as
an smtp proxy (but dumping the contents on the web at the same time),
retaining the original 'From:', and then failing DMARC verification as it is
not a configured proxy by the sender domain.

Me sending a message to the list could be just repackaged and sent as a
fresh email from '[email protected]', whose identity /can/ be
verified by looking up eg. swi-prolog.com and verifying the email servers
are allowed to send email for that domain, with dkim, spf and dmarc
verification by the receiving email server. 

The underlying / temporary problem here is that sending email used to have
no authentication.. it was the wild west out there... which is why we moaned
about spam so much... and there will be teething problems along the way. 

And DMARC might be a flawed implemention, but it has been implemented by ALL
the big email ISPs (google, yahoo, aol, hotmail, and xs4all, yeah.net, ).. I
have DMARC reports to prove it, and we have to deal with it, or our mailing
lists won't work.   Yahoo has just tightened their criteria to 'reject'
expect the others to do the same as soon as the lessons were learned from
Yahoo's strongest attempt yet at turning the screw on spammers.

In the meantime, replacing 'From: [email protected]' to
'From:'[email protected]', or whatever is the first step/only game
in town, so far as I know.  DMARC is very fussy when it comes to subdomains,
and can still reject  an email because it came from
[email protected] rather than [email protected], so
read up DMARC and subdomains, and also ensure that if you have subdomains,
then they have mx records set up too, else it will still bounce.

If it's true that Yahoo/others are/will be insisting on a 100% compliant
DMARC policy for verifying sending domains, then you might have to also get
all the spf/dkim records & keys set up on your dns - be 100% compliant,
before it will not get bounced.  

Assuming your mx server reputation is not already destroyed of course... in
which case all bets are off / you need to start with an uncompromised domain
/ ip address for your mx servers as well.  But hopefully this will be a last
resort.

Also have a google around for 'dmarc testing' - I used online tools to
verify that my dmarc/dkim/spf dns records were configured correctly before I
started sending emails.  And you can see from email smtp headers in your
email client/mailing list server) whether DMARC passed or not - the headers
will show what passed or failed, on a message by message basis.

It's a big mess, but we are where we are. Repeat: moving from yahoo to
temporarily looser/different email provider probably won't help you in the
long term.



--
View this message in context: http://swi-prolog.996271.n3.nabble.com/Fwd-Re-mailing-list-question-tp14894p14906.html
Sent from the SWI Prolog mailing list archive at Nabble.com.