Re: List is being blocked as source is SPAMmy...

--0000000000008b7af205edac46a1
Content-Type: text/plain; charset="UTF-8"

On Thu, Nov 17, 2022 at 2:52 AM Matthias Andree <[email protected]>
wrote:

> Am 13.11.22 um 17:26 schrieb Charles Cazabon:
> > Raman Gupta <[email protected]> wrote:
> >> Charles, are you sure it isn't some kind of misconfiguration related to
> >> DMARC (DKIM, SPF)? Perhaps there is some munging happening for list
> messages
> >> that may cause DKIM signatures to fail?
> > My domain has DKIM, SPF, and DMARC validly configured.  I have a
> restrictive
> > SPF policy that only validates email for my domains coming from my
> (single)
> > mail server.
> >
> Charles,
>
>
Ironically, I never received this reply from the list.

I've never run a mailing list myself so I can't say I'm familiar with all
the details, but some more info that may be useful:

It seems like ezmlm is signing a lot of emails via domain "lists.pyropus.ca",
which has SPF and is doing DKIM signing and also has a p=reject DMARC
policy (subdomains can override parent domain DMARC policies):

_dmarc.lists.pyropus.ca. 86400  IN      TXT     "v=DMARC1; p=reject;
sp=none; rua=mailto:[email protected]; ruf=mailto:
[email protected]; fo=1; aspf=s; adkim=s;"

I also see some messages that are not DKIM signed but I suspect ezmlm is
re-signing messages that come with a DKIM signature inbound, and ignoring
the others. Which should be OK for DMARC too as long as the SPF passes and
is aligned. But this setup means any SPF alignment failures will cause a
rejection for non-DKIM signed messages.

DMARC should accept any valid DKIM signature and aligned SPF without DKIM,
so this should be ok, but unfortunately with a p=reject policy I don't see
the Authentication headers for messages that are failing.

Maybe temporarily change the policy temporarily so that we can debug the
problem, if there is one?

Regards,
Raman

--0000000000008b7af205edac46a1--