I think I see what you are saying. If I have it right, you admin a domain that publishes DMARC p=none to get reports to assess the effect of going to a stronger DMARC policy, but you see reports due to Mailman list mail because Mailman does not apply DMARC mitigations to mail From: domains that publish DMARC p=none. So you would like Mailman to apply disruptive message transformations to mail From: your domain that would be transformed if you applied a stronger DMARC policy.

My opinion is DMARC and mailing lists do not play well together. DMARC was originally intended to be used by domains such as those of financial institutions where mail From: those domains would only be for business purposes and not posted by individuals to mailing lists. It was mis-used by Yahoo and later AOL in a misguided attempt to make upo for prior security lapses, but was never intended to be used by domains that provided email service to users for personal use.

While I don't understand what your domain is or what it is used for, I suggest that if individuals are allowed/encouraged to send personal mail From: your domain to email lists, that DMARC p=quarantine or p=reject policies are inappropriate.

** Changed in: mailman Importance: Undecided => Wishlist

** Changed in: mailman Status: New => Won't Fix

If I understand correctly, what you are saying is that by publishing DMARC p=none you receive reports of Mailman list mail that fails DMARC and some of these reports MIGHT be spurious because if your DMARC policy were quarantine or reject the lists MIGHT apply Mailman's DMARC mitigations.

I will consider addressing this, but not in the way you suggest. I will consider adding another list setting dmarc_none_moderation_action - Shall the above dmarc_moderation_action if Munge From or Wrap Message apply to messages From: domains with DMARC p=none as well as p=reject and p=quarantine? with the more detailed help explaining that a Yes setting only makes sense if dmarc_quarantine_moderation_action is also Yes and also explaining that the intend is to suppress the reports to the domain owner of failures that wouldn't be failures if the domain owner's policy were quarantine or reject.

I will not do this unconditionally because I believe it should be up to the individual list owner to decide whether she wants Munge From or Wrap Message applied to messages that should be accepted without these transformations.

** Changed in: mailman Status: Won't Fix => Triaged

** Changed in: mailman Status: Triaged => Fix Committed

** Changed in: mailman Milestone: None => 2.1.21

** Changed in: mailman Assignee: (unassigned) => Mark Sapiro (msapiro)

I believe the OP can get exactly the effect he wants by specifying a DMARC policy record including "p=quarantine; pct=0". Mailman doesn't (and arguably shouldn't) check the value of pct, let alone roll dice, on p=quarantine or p=reject, so this policy will cause Mailman to mitigate (if mitigation is available in that version of Mailman and requested by the list admin). On the other hand, pct=0 means no conforming recipient implementation will actually quarantine any messages. (Yes, pct=0 is explicitly permitted by the RFC.) The vast majority of mail is covered by conforming implementations according to DMARC.org testing (but I don't know that this corner case was tested -- someone with a test domain can do that easily enough, and if someone does, please report whether it worked and which providers were tested to mailman- users@python.org).

Jakob writes "Mailman is intentionally disregarding the RFC and causing its default behavior to cause problems for postmasters whose users are permitted to participate in mailing lists ..."

I assume the RFC you are referring to is RFC 7960. I have read this RFC and I do not draw the same conclusion. In particular, section 2, paragraph 2 says

Note that domains that assert a "p=none" policy and email messages that pass standard DMARC validation do not have any interoperability issues.

which implies to me that it is not necessary to apply any mitigations to messages From: domains publishing p=none.

Clearly you believe otherwise. Please identify specific RFC sections and language that support your opinion.

The mitigations of modifying the From: header or wrapping the message have negative consequences for users of at least some MUAs, so list owners have incentives to apply them to as few messages as possible. We are currently working on the mitigation strategy for Mailman 3 and have decided at this point to not have controls over which policies trigger mitigation, but when mitigating based on policy to apply mitigation for p=reject and p=quarantine, and not p=none. If we are convinced that RFCs say we SHOULD or MUST apply munge/wrap mitigations to messages from p=none domains, we will do that, so please tell us why you think they do.

B.2.1 are just part of the examples, but even there it says: "Receivers should not alter how they treat these messages because of this DMARC policy record ("p=none")". This reinforces that no mitigations should be applied to p=none.

You are getting this all backwards.

While I agree that DMARC interacts badly with mailing lists in general, writing mailing list software in ways that make this worse is not going to help anybody.

DMARC as it exists today has a p=none feature which serves no other known purpose than allowing postmasters to detect which, if any, problems will occur for their particular domain, should they publish a stricter policy.

This detection mission is completely frustrated if mailing lists that are configured to *not* cause problems if DMARC is set to an active policy continue cause false alarms in the p=none test mode.

I firmly believe that the wording about not taking different action for "p=none" is directed only at recipients that would otherwise reject or penalize mail based on the DMARC policy, not at mail forwarders deciding if the e-mail should be handled in a DMARC-compatible way, e.g. by enabling workarounds.