Path: csiph.com!newsfeed.xs4all.nl!newsfeed9.news.xs4all.nl!bofh.it!news.nic.it!robomod
From: Andy Smith <andy@strugglers.net>
Newsgroups: linux.debian.user
Subject: Re: Slightly off-topic: anybody know of a way to keep one's Debian  User List posts from failing DMARC?
Date: Wed, 09 Jun 2021 23:10:02 +0200
Message-ID: <CodCx-41R-3@gated-at.bofh.it>
References: <Co9IB-1qY-3@gated-at.bofh.it>
X-Mailbox-Line: From debian-user-request@lists.debian.org  Wed Jun  9 21:06:01 2021
Old-Return-Path: <andy@strugglers.net>
X-Amavis-Spam-Status: No, score=-7.6 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FOURLA=0.1, LDO_WHITELIST=-5, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
X-Policyd-Weight: using cached result; rate: -4.6
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Openpgp: id=BF15490B; url=http://strugglers.net/~andy/pubkey.asc
X-URL: http://strugglers.net/wiki/User:Andy
User-Agent: NeoMutt/20170113 (1.7.2)
X-Sa-Exim-Connect-IP: <locally generated>
X-Sa-Exim-Mail-From: andy@strugglers.net
X-Sa-Exim-Scanned: No (on mail.bitfolk.com); SAEximRunCond expanded to false
X-Mailing-List: <debian-user@lists.debian.org> archive/latest/776534
List-ID: <debian-user.lists.debian.org>
List-URL: <https://lists.debian.org/debian-user/>
List-Archive: https://lists.debian.org/msgid-search/20210609210543.vexi46ywhutixi45@bitfolk.com
Approved: robomod@news.nic.it
Lines: 30
Organization: linux.* mail to news gateway
Sender: robomod@news.nic.it
X-Original-Date: Wed, 9 Jun 2021 21:05:43 +0000
X-Original-Message-ID: <20210609210543.vexi46ywhutixi45@bitfolk.com>
X-Original-References: <7a85867b-8512-fd40-a3f6-42a45456b118@touchtonecorp.com>
Xref: csiph.com linux.debian.user:235962

Hello,

On Wed, Jun 09, 2021 at 09:58:13AM -0700, James H. H. Lampert wrote:
> I'm told that the Debian List Server doesn't rewrite "From"
> headers for DMARC-enabled senders, and neither does it do anything
> else to handle DMARC-enabled senders.

Correct, so the SPF test will always fail as the list pretends to be
your domain when it sends out mail from you. But the DKIM test can
still pass, because the Debian list software does not alter the body
of your mail or any of the headers you are likely to sign with DKIM.

And indeed, your email that I am replying to was a DKIM pass and
thus would be a DMARC pass as only one of the two is needed.

Many mailing lists modify the body, e.g. to prepend tags to the
subject and/or to append a footer with list information. These
mailing lists can never pass DKIM because the mail content is
signed. Their only option if they care about a DMARC pass is to
rewrite the sender address so that their mail comes from their own
domain, then they can make SPF and DKIM pass and alter the content
as they like.

You will see many DMARC failures from such mailing lists.

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting