Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #235958 > unrolled thread

Slightly off-topic: anybody know of a way to keep one's Debian User List posts from failing DMARC?

Back to article view | Back to linux.debian.user

Contents

  Slightly off-topic: anybody know of a way to keep one's Debian User  List posts from failing DMARC? "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2021-06-09 19:00 +0200
    Re: Slightly off-topic: anybody know of a way to keep one's Debian  User List posts from failing DMARC? Dan Ritter <dsr@randomstring.org> - 2021-06-09 19:30 +0200
    Re: Slightly off-topic: anybody know of a way to keep one's Debian User List posts from failing DMARC? deloptes <deloptes@gmail.com> - 2021-06-09 19:40 +0200
    Re: Slightly off-topic: anybody know of a way to keep one's Debian  User List posts from failing DMARC? Andy Smith <andy@strugglers.net> - 2021-06-09 23:10 +0200

#235958 — Slightly off-topic: anybody know of a way to keep one's Debian User List posts from failing DMARC?

Please excuse the off-topic post, but I'm hoping this has come up with 
others here:

I've been tasked with implementing DMARC on our domain. And I'm told 
that the Debian List Server doesn't rewrite "From" headers for 
DMARC-enabled senders, and neither does it do anything else to handle 
DMARC-enabled senders.

--
James H. H. Lampert
Touchtone Corporation

[toc] | [next] | [standalone]

#235959 — Re: Slightly off-topic: anybody know of a way to keep one's Debian User List posts from failing DMARC?

James H. H. Lampert wrote: 
> Please excuse the off-topic post, but I'm hoping this has come up with
> others here:
> 
> I've been tasked with implementing DMARC on our domain. And I'm told that
> the Debian List Server doesn't rewrite "From" headers for DMARC-enabled
> senders, and neither does it do anything else to handle DMARC-enabled
> senders.

DMARC is one of many factors your mail servers need to consider
when deciding whether to accept, bounce or silently drop a piece
of mail.

It is perfectly reasonable to set DMARC as a strong but not
overwhelming factor, and then to write allow lists based on,
for example:

List-Id: <debian-user.lists.debian.org>

which is a pretty good representation that this is Debian mail.

So good, in fact, that RFC2919
https://tools.ietf.org/html/rfc2919

suggests it.

-dsr-

[toc] | [prev] | [next] | [standalone]

#235960 — Re: Slightly off-topic: anybody know of a way to keep one's Debian User List posts from failing DMARC?

James H. H. Lampert wrote:

> Please excuse the off-topic post, but I'm hoping this has come up with
> others here:
> 
> I've been tasked with implementing DMARC on our domain. And I'm told
> that the Debian List Server doesn't rewrite "From" headers for
> DMARC-enabled senders, and neither does it do anything else to handle
> DMARC-enabled senders.

Couple of years ago, when I was working with a Telco they implemented DMARC
and were thinking it will be soon very strict, but it turned out many
implemented different policies and as Dan Ritter said, it is one important
factor.
Back then (2016) I asked the Telco people (as part of the BA) how many
responses (mails with statistics) they would expect from the peers - they
said they would expect that the major players would do DMARC - respectively
we setup a DB based on this assumption ... well the moment we turned the
collection on - the DB exploded because it was tausends of domains already
implementing DMARK with SPF and sending back the statistics.

[toc] | [prev] | [next] | [standalone]

#235962 — Re: Slightly off-topic: anybody know of a way to keep one's Debian User List posts from failing DMARC?

Hello,

On Wed, Jun 09, 2021 at 09:58:13AM -0700, James H. H. Lampert wrote:
> I'm told that the Debian List Server doesn't rewrite "From"
> headers for DMARC-enabled senders, and neither does it do anything
> else to handle DMARC-enabled senders.

Correct, so the SPF test will always fail as the list pretends to be
your domain when it sends out mail from you. But the DKIM test can
still pass, because the Debian list software does not alter the body
of your mail or any of the headers you are likely to sign with DKIM.

And indeed, your email that I am replying to was a DKIM pass and
thus would be a DMARC pass as only one of the two is needed.

Many mailing lists modify the body, e.g. to prepend tags to the
subject and/or to append a footer with list information. These
mailing lists can never pass DKIM because the mail content is
signed. Their only option if they care about a DMARC pass is to
rewrite the sender address so that their mail comes from their own
domain, then they can make SPF and DKIM pass and alter the content
as they like.

You will see many DMARC failures from such mailing lists.

Cheers,
Andy

-- 
https://bitfolk.com/ -- No-nonsense VPS hosting

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web