Re: List is being blocked as source is SPAMmy...

Raman Gupta <[email protected]> wrote:
> Charles, are you sure it isn't some kind of misconfiguration related to
> DMARC (DKIM, SPF)? Perhaps there is some munging happening for list messages
> that may cause DKIM signatures to fail?

My domain has DKIM, SPF, and DMARC validly configured.  I have a restrictive
SPF policy that only validates email for my domains coming from my (single)
mail server.

> I received the message below from elmlm @ pyropus as part of the list
> warning that several messages to me were undeliverable -- looking at DMARC
> for pyropus.ca, the policy is reject so any misalignment on SPF or failing
> DKIM will cause an issue:

Neither of those should be the case here.  The list only delivers mail from
one machine.  My SPF policy allows that machine both by the "MX" policy and
explicitly by its IP address.

Normally what causes problems with list mail delivery is that a receiving
mailserver checks the message's From: header field contents - the domain of
the address in that message header field - against the IP address of the
incoming connection, rather than checking the domain of the envelope sender
address (aka return-path address or SMTP "MAIL FROM" address), specifically
against the recommendations of RFC 7208 section 2.2.

The receiving mailserver then refuses messages because it's coming from my
server, but the list message's author's domain only authorizes its own servers
to originate messages in that domain name.  The RFC *specifically* uses this
exact situation as the reason *not* to check the From: header address domain.

The other one I run into semi-regularly is where list subscribers are
forwarding messages from their subscribed address to a different SMTP server
hosting their "real" address.  Some of these setups appear to leave the
envelope sender address of the forwarded message the same when forwarding, so
the final destination server sees a message with an envelope sender in the
lists.pyropus.ca domain, but coming from an unauthorized address - and then
bounces it back to the list manager.

This is completely broken, too.  When forwarding mail like this in the modern
context of SPF (which yes, is broken by design), the forwarder should be
changing the envelope sender address to one under its control, not re-using
the original domain.

> See below for the bounce the list received:

Oh, I get these all the time.  Anyone sending to a mailing list using a From:
header address with a domain with a restrictive SPF policy probably sees a few
of these every time they post.  Most mailing lists will have at least one
subscriber with a broken setup as described above.

Sometimes the bounces I get will include full headers, and they clearly show
exactly what happened.  The one you quoted doesn't include anything like that.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon
GPL'ed software available at:               http://pyropus.ca/software/
-----------------------------------------------------------------------