Mailman 3 November 2021 - Mailman-Users

Re: Charter occasionally bouncing mail
by Michael Reeder -- Hygeia MS Nov. 30, 2021

Nov. 30, 2021

Regarding Microsoft-hosted email -- they also frequently block ALL lists on the basis that the email was not specifically addressed to the recipient. I wrote a tutorial for my users about how to add my list addresses to the safe senders list (known elsewhere as a white list). It is found here: https://www.clinicians-exchange.org/fix-hotmail-and-outlook-to-allow-safe-m… At the time I was mainly thinking its a Hotmail problem -- but it's any email address on any domain hosted at Microsoft. They also seem to do this for any email forwarded from another address -- very annoying when lots of email is being auto-forwarded. Does not seem fixable by any setting that either the email account holder or the email company administrator can adjust. Michael Reeder Hygeia Counseling Services michael(a)hygeiacounseling.com (Now auto-forwarded to an address hosted at Microsoft so I have to safe list every blessed new sender!) ------ Original message------ *From: *Jon Baron *Date: *Mon, Nov 29, 2021 6:57 AM *To: *Jayson Smith; *Cc: *mailman-users(a)python.org; *Subject:*[Mailman-Users] Re: Charter occasionally bouncing mail I have had a lot of experience with these things. Here are some observations. I have a list of 4000+ subscribers around the world. I have SPF and DKIM but not DMARC. (I never say much point in DMARC, and it does not seem necessary.) Right now every single one of the 4000+ subscribers accepts the mail, most of the time. Occasionally I get msssages (from Europe) saying that the mail has been blocked because it is a "high probability of spam" or "looks like spam". This drives me crazy. These spam-blocking systems are unregulated. They are like snake oil. They should not be blocking mail without telling the recipients, and this is what happens. A few times, Microsoft has started blocking mail to ALL addresses with domains of outlook, hotmail, msn, or live. Sometimes this was the result of what you are talking about. I was told to sign up for various things, including "sender support": https://sendersupport.olc.protection.outlook.com/snds/ You can get data on what proportion of your mail counts as spam (if you have enough mail, as we do). When they block mail, you can complain: https://support.microsoft.com/supportrequestform/8ad563e3-288e-2a61-8122-3b… (the one that works for me) or just https://support.microsoft.com/supportrequestform/ If you complain, you will get an automatic reply saying that your problem does not qualify for mitigation and that they are almost always correct. Then you have to respond to that. After a few rounds of this, you will get a response from what seems to be a human being, who will tell you that they are taking your problem very seriously, yada yada. The last time this happened, they were completely blocking all make for over a week, because my IPV4 address (the one they use) was part of a range of addresses from which spam was being sent. Of course, I have only one ipv4 address (from a cloud server, Linode). The problem seems fixed for now, but I am warning new subscribers not to use Microsoft-controlled addresses. Of course they won't tell you HOW they decide that something is spam, as this information would just make it easier for spammers. (But I don't see what is so bad about spam. You just delete it; it helps if possible spam goes to a spefific folder, but any system I've seen makes many mistakes both ways, except spamassassin, which rarely makes a false positive. The real problem is phishing, and there have been no randomized control trials to see whether any system can immunize people against that. I doubt that these spam detectors do it effectively.) Some references: https://answers.microsoft.com/en-us/outlook_com/forum/all/hotmailoutlook-bl… https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/… And there are several things like this: https://mxtoolbox.com/blacklists.aspx But the list called UCEPROTECT3 (I think) is now, happily, widely ignored, because it is based on spam coming from a large range of ipv6 addresses on a cloud server. Spamhause does something like this too, but you can fix it by getting a "proper" ipv6 address that specifies the range ("/64" at the end). Some geneneral On 11/29/21 00:51, Jayson Smith wrote: > Hi again, > > Good point about DMARC. Does anyone know if Charter suddenly started > caring about some DMARC policies on or around this past Friday? I > have my list set to munge the From: lines of messages from senders > E.G. AOL, Yahoo, etc. that publish a DMARC rejection policy. > > On a slightly different topic, I've heard from a few Outlook users > that list messages are consistently ending up in their junkmail > folders. Could this be because Microsoft doesn't like the fact that > my list is causing DMARC to fail, but not actually complaining to me > about it? I could solve this problem by having the list munge the > From: line for all messages, but sometimes that causes problems with > replying. In particular, several years ago when my lists were set up > to do that, Thunderbird users were having problems sometimes replying > to the sender of a message rather than the entire list. > > Jayson > > On 11/28/2021 11:45 PM, Mark Sapiro wrote: > >On 11/28/21 7:58 PM, Jayson Smith wrote: > >>Hi, > >> > >> > >>One of my Mailman lists has a single member at Charter which has > >>occasionally bounced mail over the last few days. When this > >>happens, the reason given, when I look it up on their help page, > >>indicates the message I sent goes against the security policies > >>of my domain, and I should contact my domain administrator (that > >>would be me). I have SPF and DKIM set up, and a quick check at > >>dkimvalidator.com <http://dkimvalidator.com> verifies they're both working. I assume this is > >>one of these annoying situations where Charter is seeing what's > >>clearly a transient DNS problem and treating it like a permanent > >>failure? Also I assume there's nothing I can do about this? Is > >>the problem likely to be at Charter's end or at my domain's > >>nameservers' end? > > > > > >Only guessing, but this sounds like DMARC. Does your list apply > >DMARC mitigations? > > > >If it is DMARC, the issue is the message sent to the charter > >subscriber is From:poster@posters.domain.posters.do <http://posters.do>main publishes > >a DMARC policy of (probably) reject. Yahoo.com <http://Yahoo.com> is one such common > >domain. Your list modifies the message by content filtering, > >subject prefixing, adding msg_footer or some other transformation > >that breaks the posters.do <http://posters.do>main DKIM signature. Your SPF and DKIM > >signatures pass, but they are not 'aligned' with posters.do <http://posters.do>main, so > >they don't count for DMARC. > > > >See https://wiki.list.org/DEV/DMARC > > > > > > ------------------------------------------------------ > Mailman-Users mailing list --mailman-users(a)python.org > To unsubscribe send an email tomailman-users-leave(a)python.org > https://mail.python.org/mailman3/lists/mailman-users.python.org/ > Mailman FAQ: http://wiki.list.org/x/AgA3 > Security Policy: http://wiki.list.org/x/QIA9 > Searchable Archives: https://www.mail-archive.com/mailman-users@python.org/ > https://mail.python.org/archives/list/mailman-users@python.org/ -- Jonathan Baron, Professor of Psychology, University of Pennsylvania Home page:https://www.sas.upenn.edu/~baron Founding Editor: Judgment and Decision Making (http://journal.sjdm.org) ------------------------------------------------------ Mailman-Users mailing list --mailman-users(a)python.org To unsubscribe send an email tomailman-users-leave(a)python.org https://mail.python.org/mailman3/lists/mailman-users.python.org/ Mailman FAQ:http://wiki.list.org/x/AgA3 Security Policy:http://wiki.list.org/x/QIA9 Searchable Archives: https://www.mail-archive.com/mailman-users@python.org/ https://mail.python.org/archives/list/mailman-users@python.org/

2 2

Charter occasionally bouncing mail
by Jayson Smith Nov. 30, 2021

Nov. 30, 2021

Hi, One of my Mailman lists has a single member at Charter which has occasionally bounced mail over the last few days. When this happens, the reason given, when I look it up on their help page, indicates the message I sent goes against the security policies of my domain, and I should contact my domain administrator (that would be me). I have SPF and DKIM set up, and a quick check at dkimvalidator.com verifies they're both working. I assume this is one of these annoying situations where Charter is seeing what's clearly a transient DNS problem and treating it like a permanent failure? Also I assume there's nothing I can do about this? Is the problem likely to be at Charter's end or at my domain's nameservers' end? Thanks, Jayson

5 7

Sorting list names
by Scott High Nov. 16, 2021

Nov. 16, 2021

Hi, new user, forgive me if old issue, but I've searched FAQ and wiki and can't find answer. Running Mailman 2.1.12, on the Virtualmin Mailman Mailing Lists UI, I'm simply trying to sort the list names alphabetically. Is this possible? I can't for the life of me find it if it is a UI option. Does it need to be sorted at the file system level or database level for the UI to reflect it, maybe? Thanks for any help!

3 2

web interface error after 2.1.36 update
by ddewey＠cyberthugs.com Nov. 16, 2021

Nov. 16, 2021

Hello... just ran into an issue after what I thought was a successful routine update to mailman 2.1.36 (from .29? iirc) on Friday. Everything seemed fine after the update (following the config/make/make install) and I hadn't had occasion to log into the admin interface until today when I hit this (apparent) bug. Mail is being received and delivered just fine. The subscriber interface appears working. Simply trying to log into the Admindb user interface... entered my password and receive "Bug in Mailman version 2.1.36 We're sorry, we hit a bug!" Don't see any obvious permissions errors, nor does check_perms return anything. Below is the log output from Mailman error log. Nothing interesting in the httpd log. Thanks for any pointers! Nov 15 15:30:58 2021 admin(30830): @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ admin(30830): [----- Mailman Version: 2.1.36 -----] admin(30830): [----- Traceback ------] admin(30830): Traceback (most recent call last): admin(30830): File "/usr/local/mailman/scripts/driver", line 117, in run_main admin(30830): main() admin(30830): File "/usr/local/mailman/Mailman/Cgi/admindb.py", line 342, in main admin(30830): print doc.Format() admin(30830): File "/usr/local/mailman/Mailman/htmlformat.py", line 352, in Format admin(30830): output.append(Container.Format(self, indent)) admin(30830): File "/usr/local/mailman/Mailman/htmlformat.py", line 267, in Format admin(30830): output.append(HTMLFormatObject(item, indent)) admin(30830): File "/usr/local/mailman/Mailman/htmlformat.py", line 53, in HTMLFormatObject admin(30830): return item.Format(indent) admin(30830): File "/usr/local/mailman/Mailman/htmlformat.py", line 445, in Format admin(30830): % csrf_token(self.mlist, self.contexts, self.user) admin(30830): File "/usr/local/mailman/Mailman/CSRFcheck.py", line 53, in csrf_token admin(30830): mac = sha_new(secret + issued).hexdigest() admin(30830): TypeError: unsupported operand type(s) for +: 'NoneType' and 'str' admin(30830): [----- Python Information -----] admin(30830): sys.version = 2.7.5 (default, Aug 13 2020, 02:51:10) [GCC 4.8.5 20150623 (Red Hat 4.8.5-39)] admin(30830): sys.executable = /usr/bin/python admin(30830): sys.prefix = /usr admin(30830): sys.exec_prefix = /usr admin(30830): sys.path = ['/usr/local/mailman/pythonlib', '/usr/local/mailman', '/usr/local/mailman/scripts', '/usr/lib64/python27.zip', '/usr/lib64/python2.7', '/usr/lib64/python2.7/plat-linux2', '/usr/lib64/python2.7/lib-tk', '/usr/lib64/python2.7/lib-old', '/usr/lib64/python2.7/lib-dynload', '/usr/lib/python2.7/site-packages', '/usr/lib/python2.7/dist-packages', '/usr/lib64/python2.7/site-packages', '/usr/lib64/python2.7/site-packages/gtk-2.0', '/usr/lib64/python2.7/site-packages', '/usr/lib/python2.7/site-packages', '/usr/lib/site-python'] admin(30830): sys.platform = linux2 admin(30830): [----- Environment Variables -----] admin(30830): CONTENT_LENGTH: 41 admin(30830): CONTENT_TYPE: application/x-www-form-urlencoded admin(30830): SERVER_NAME: list.listdomain.com admin(30830): REMOTE_ADDR: 67.253.227.163 admin(30830): PYTHONPATH: /usr/local/mailman admin(30830): REMOTE_PORT: 3777 admin(30830): REQUEST_SCHEME: http admin(30830): SCRIPT_NAME: /mailman/admindb admin(30830): REQUEST_METHOD: POST admin(30830): HTTP_HOST: list.list_domain.com admin(30830): PATH_INFO: /list_name admin(30830): SERVER_PORT: 80 admin(30830): SERVER_PROTOCOL: HTTP/1.1 admin(30830): QUERY_STRING: admin(30830): REQUEST_URI: /mailman/admindb/list_name admin(30830): HTTP_COOKIE: admin(30830): DOCUMENT_ROOT: /var/www/html/list.list_domain.com

2 1

Messages from non-members
by Christian Buser Nov. 16, 2021

Nov. 16, 2021

Mailman 2.1.35 on cPanel version 98.0.12 The list is set to only accept messages from subscribers Action to take for postings from non-members for which no explicit action is defined (Details for generic_nonmember_action) is set to "Hold" I receive a notification when someone tries to post using a non-subscriber address. The non-member receives this message (message #1): Your mail to 'Infoline' with the subject Test non-member Is being held until the list moderator can review it for approval. The reason it is being held: Post by non-member to a members-only list Either the message will get posted to the list, or you will receive notification of the moderator's decision. If you would like to cancel this posting, please visit the following URL: http://xxxxx.ch/mailman/confirm/infoline_mus.ch/d1c110e1babc8c9b34cd40a17c0… I (as the owner of the mailing list receive the notification (message #2) stating: As list administrator, your authorization is requested for the following mailing list posting: List: Infoline(a)xxxxx.ch From: macchristian(a)xxxxx.ch Subject: Test non-member Reason: Post by non-member to a members-only list At your convenience, visit: http://mus.ch/mailman/admindb/infoline_mus.ch to approve or deny the request. One attachment to the notification is a message (message #3) with the subject "confirm d1c110e1babc8c9b34cd40a17c0ab8e0770e8617" which tells me: If you reply to this message, keeping the Subject: header intact, Mailman will discard the held message. Do this if the message is spam. If you reply to this message and include an Approved: header with the list password in it, the message will be approved for posting to the list. The Approved: header can also appear in the first line of the body of the reply. Okay, I reply to the message. In earlier times, I got a response that the message was sent into the Nirvana - or that the user had deleted it himself using the link he received in message #1 However something seems to be broken now. - The held message is no longer deleted when I reply to the "confirmation". - I no longer receive a notification that the message was no longer on hold. - The message remains in hold, even after the "confirmation" was replied to. Yes, I can manually "reject" or "discard" the message. My provider says he has no knowledge about how Mailman on cPanel works, and I should ask in Mailman-related forums / lists... Any idea how it can be fixed? Thank you, Christian

2 1

Usubscribe not recognized (was: Messages from non-members)
by Christian Buser Nov. 16, 2021

Nov. 16, 2021

Hi Adi There are several possibilities for this: 1) You use a mail forwarding from address A to address B and try to unsubscribe for address B instead of address A 2) Your mail server has several domains which are in fact the same - like gmail.com / googlemail.com, or me.com/mac.com, etc. 3) Your are subscribed for myname(a)mail.domain.com and want to unsubscribe from myname(a)domain.com and possibly more. And: if you reply to one of the messages in this list, the reply goes to the author of the message (me, in your case) and not to the list - unless you use the special command (e.g. in Thunderbird) "Reply to List...". I think this message also only went to me, not to the list... You may want to analyze the mail headers of a list message to find out what happened. Look for these header lines: X-Apparently-To: Received: (look whether the desination address changed there between one header and the next) - received lines are read from bottom to top for chroniological order. Christian Adi S schrieb am 16.11.21 um 14:37: > And I am not a member but still receiving these messages > I’ve unsubscribed already but still getting message. > When I try to login to the subscription management, it says there is ’no user found with that email' >

1 0

Mailman 2.1 security release
by Mark Sapiro Nov. 13, 2021

Nov. 13, 2021

I am pleased to announce the release of Mailman 2.1.36. This is a security release. It fixes https://bugs.launchpad.net/mailman/+bug/1949401 CVE-2021-43331 and https://bugs.launchpad.net/mailman/+bug/1949403 CVE-2021-43332. The former of these could allow an XSS attack against the user options page and the latter could allow a list moderator to discover the list admin password via a brute force attack against the admindb page CSRF token. For those who just want a patch for the security issues, patches are atteched. As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1 branch from the GNU Mailman project. There has been some discussion as to what this means. It means there will be no more releases from the GNU Mailman project containing any new features. There may be future patch releases to address the following: i18n updates. security issues. bugs affecting operation for which no satisfactory workaround exists. Mailman 2.1.36 is the sixth such patch release. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ Mailman 2.1.36 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 2

messages being labeled as spam in the subject line?
by Adam Morris Nov. 7, 2021

Nov. 7, 2021

I have seen on some mailman lists where messages sent to a list when received by others have the word spam in the subject. Is this a mailman setting that can be changed or is it a setting either with the mailman hosting provider? Thanks in advance. -- Adam Morris Mobile: 0414 431105 Email, iMessage & FaceTime adam(a)damorris.com

4 3

customized From handling?
by Rich Morin Nov. 7, 2021

Nov. 7, 2021

I'm a member of the "Linux for blind general discussion" list (blinux-list(a)redhat.com), which uses Mailman. Some time ago, the list was having problems with folks spamming members, using addresses harvested from the "From" lines of messages. So, the list admins opted to change the "From" line to simply say: > Linux for blind general discussion <blinux-list(a)redhat.com> Although this solved the immediate problem, it also resulted in some confusion, because all postings are now anonymous by default. Is there a configuration option that would (say) result in a From line that only reveals the poster's name, but not their email address? -r

5 12

Mailman 2.1 security release
by Mark Sapiro Nov. 7, 2021

Nov. 7, 2021

Two new security issues have been reported in Mailman 2.1. These have been given the IDs CVE-2021-43331 and CVE-2021-43332. I plan to release 2.1.36 with full details this Friday, November 12. At that time the vulnerabilities will be made public and patches will also be made available. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0