Re: Mailing lists - assumptions

> On Sat, Apr 19, 2014 at 08:15:37AM -0700, Ned Freed wrote:
> > > Some universities offer their alumni "email forwarding for life".
> > > That's a solution that would work for some.  Unfortunately, not for
> > > the less technically savvy.
> >
> > Alas, it's a solution that interacts poorly with SPF, which is also in the
> > mix. There are better technical alternatives to address SPF issues with
> > forwarders than there are to address DKIM issues with mailing lists, but
> > even so it's not a panacea.

> The way alum.mit.edu handles email forwarding for life is they provide
> an authenticated submission service for MIT alumni[1].  This handles SPF
> and DKIM on the outgoing side, and on the forwarding side, it looks to
> the e-mail provider that that an address such as "[email protected]"
> is a mailing list.

This isn't the issue; the issue is what the MAIL FROM address gets set to
when a message is forwarded.

You want any downstream delivery errors to be reported to the original sender,
so ideally you'd leave the MAIL FROM unchanged. But now an SPF check on the
MAIL FROM will fail because alum.mit.edu's IP address isn't going to be 
allowed list.

And if you do something like insert a simple forward, e.g.,
original-sender%[email protected], you've just
created an open relay.

The usual way this is solved is with a more complex forwarding address,
one that incorporates a timestamp and a verifier. As I noted 
previously the Sender Rewriting Scheme is one way to do this, but of
course you can use any encoding you want since only your systems have
to understand it.

> ...

> Actually, in practice, I've not had to use the authenticated
> submission service.  Despite that mit.edu and alum.mit.edu has an SPF
> soft fail if you don't go through their authenticated e-mail
> submission service, I've found that an SPF soft fail combined with an
> authenticated DKIM for my envelope return address (for thunk.org,
> which I control), is not a problem in practice.  I've not experienced
> any problems with my e-mail getting rejected.

The SPF policy on alum.mit.edu is not the issue. See above.

				Ned

_______________________________________________
ietf-822 mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ietf-822