Results of testing posts to yahoogroups from AOL
I finally got around to testing this. I posted three times to my test Yahoo group from 'Mark Sapiro <my_aol_address@aol.com>'. One post with the group set to send replies to the group and one post with the group set to send replies to the sender and one post with the group set to send replies to the sender and the group.
In all cases, the posts were sent with
From: "Mark Sapiro my_aol_address@aol.com [my_yahoo_groupname]" <my_yahoo_groupname@yahoogroups.com>
In the first case (replies to group), there was
Reply-To: <my_yahoo_groupname@yahoogroups.com>
in the post from the group. This seems correct, and my actual address was in the display name portion of From:
In the second case, there was no Reply-To: in the message meaning a simple 'reply' was addressed to the From: address which I suppose is fairly easy to edit to go to me, but without editing, 'reply' goes to the group which is wrong.
In the third (reply to both) case there is a
Reply-To: my_yahoo_groupname@yahoogroups.com,Mark Sapiro <my_aol_address@aol.com>
which is correct.
So the bottom line is Yahoo groups does From: header munging when necessary because of DMARC policies on the From: domain and they manage Reply-To: well in two cases out of three.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Hope I'm not going too off-topic here (Yahoo Groups, AOL reject domains, postfix hack). Firstly thanks to Mark and everyone who's been thinking around the DMARC p=reject problem, developing workarounds, talking to IETF and also Yahoo and AOL to try to keep email working reliably.
On 09/05/14 22:50, Mark Sapiro wrote:
I finally got around to testing this.
Note that the situation changed the day before you did the test. There is an announcement dated 8 May here: <http://yahoogroups.tumblr.com/post/85163779041/dmarc-related-changes-in-yaho...> "Following the recent changes in Yahoo DMARC policy to protect users from email spam, we’ve made changes to how Yahoo Groups sends mails to members’ inboxes. ... With these changes we are addressing deliverability issues due to DMARC adoption by mail service providers."
Previously it seems aol.com addresses were causing problems for Yahoo groups, for example <https://answers.yahoo.com/question/index?qid=20140506105019AADVtNA>. Also BTW AOL has published p=reject on two other domains: $ dig +short txt _dmarc.aim.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:d@rua.agari.com\; ruf=mailto:d@ruf.agari.com\;" $ dig +short txt _dmarc.cs.com "v=DMARC1\; p=reject\; pct=100\; rua=mailto:d@rua.agari.com\; ruf=mailto:d@ruf.agari.com\;"
So far I only know of yahoo.com, aol.com, aim.com and cs.com that have become unusable with standard lists.
I posted three times to my test Yahoo group from 'Mark Sapiro <my_aol_address@aol.com>'. One post with the group set to send replies to the group and one post with the group set to send replies to the sender and one post with the group set to send replies to the sender and the group.
In all cases, the posts were sent with
From: "Mark Sapiro my_aol_address@aol.com [my_yahoo_groupname]" <my_yahoo_groupname@yahoogroups.com>
Also note that this new rewriting by Yahoo groups applies to all From addresses, not just AOL.com. In itself, I've reservations about using the group posting address. What if (for example) Reply-To is not honoured... (see below). Plus adding the address to the real name is confusing.
Our listserv is stuck with Debian stable (2.1.15), so I implemented From rewriting in Postfix. (In case any Postfix postmaster is interested, a simple way is creating a cleanup daemon which does header_checks using a REPLACE rule on the From: line, then applying -o cleanup_service_name to the smtpd daemon that receives email back from Mailman.)
Anyway, rather than the list address masquerading as the sender's real name, I thought it best to raise awareness that there's a problem with the yahoo.com/aol.com address in the From line, so make it very clear at the start of the real name, and change the address to an auto-responder with a description of the problem.
/^From: (.+)\@(aol|cs|aim|yahoo)\.com($|>.*| .*)/ REPLACE From: (broken-address) $1@$2-is-broken.[a domain under my control]$3
Mailman adds a Reply-To, so other than the RFCs, IMHO it's not that important what the actual address in the From line is, although it should preserve the original. So far I've not had complaints from list owners about the real name rewriting with prefixing the literal "[broken-address]", but maybe it should be shorter and less ugly. It still needs to be prominent, as most users might otherwise not get the fact that the From address is not the address of the sender and they shouldn't add it to their address book. Like Dave Nathanson, I don't like "via".
In the first case (replies to group), there was
Reply-To: <my_yahoo_groupname@yahoogroups.com>
in the post from the group. This seems correct, and my actual address was in the display name portion of From:
In the second case, there was no Reply-To: in the message meaning a simple 'reply' was addressed to the From: address which I suppose is fairly easy to edit to go to me, but without editing, 'reply' goes to the group which is wrong.
This is clearly a bug, as it doesn't follow the announcement 'When replying to a Group message, Group “Reply-To” settings of the Group will continue to be honored on the Reply compose screen on the web and in your email service.'
Has caused a Yahoo list owners to complain starting 16 hours ago <https://answers.yahoo.com/dir/index?sid=396546285>. Among other things, it increases list traffic, presents privacy problems, and can get a list address automatically added to a users' address book under the wrong name. Doesn't really inspire confidence in Yahoo, I'm afraid.
In the third (reply to both) case there is a
Reply-To: my_yahoo_groupname@yahoogroups.com,Mark Sapiro <my_aol_address@aol.com>
which is correct.
So the bottom line is Yahoo groups does From: header munging when necessary because of DMARC policies on the From: domain and they manage Reply-To: well in two cases out of three.
2 out of 3 is quite bad if it's *your* Yahoo list that's supposed to be set to Reply-To sender. Another weird thing I've seen is occasional email From @aol.com that wasn't DKIM signed, which breaks forwarding because it doesn't pass SPF either. Meanwhile, I don't see DMARC having an impact on phishing, at least not one that phishers can't easily adapt to.
DMARC.org links to http://blog.threadable.com/how-threadable-solved-the-dmarc-problem which says "Was this the right thing for Yahoo to do? Not a chance. A restricted DMARC policy makes sense for domains on which phishing is a serious risk, and *who are not also email service providers*. Because lists tend to unsubscribe addresses that generate bounces, Yahoo is not only breaking email for their own customers, but for everyone else."
I'm still hoping Yahoo and AOL aren't waiting to save face to reverse their policy. I do wonder if some major list provider or owner might sue them for causing them to lose lots of list subscribers.
All best wishes
CK
Cedric Knight wrote:
On 09/05/14 22:50, Mark Sapiro wrote:
I finally got around to testing this.
Note that the situation changed the day before you did the test. There is an announcement dated 8 May here: <http://yahoogroups.tumblr.com/post/85163779041/dmarc-related- changes-in-yahoo-groups> "Following the recent changes in Yahoo DMARC policy to protect users from email spam, we've made changes to how Yahoo Groups sends mails to members' inboxes. ... With these changes we are addressing deliverability issues due to DMARC adoption by mail service providers."
I can confirm that there's been a change. On a yahoo group I'm a member of, Outlook used to say the group messages were from the list address on behalf of the sender's address. Now they just say they're from the list address, although the original sender is listed in the message list. This happened between 9/5/14 and 12/5/14.
I haven't tried to check what headers they've used to confuse Outlook like this.
This group has always been configured so that Reply and Reply All go to the list address, but it was possible to construct a private reply manually by copying the sender's address from the top of the quoted headers. You can't do that anymore in Outlook without delving into the original message's headers.
Peter Shute
Peter Shute wrote:
I can confirm that there's been a change. On a yahoo group I'm a member of, Outlook used to say the group messages were from the list address on behalf of the sender's address. Now they just say they're from the list address, although the original sender is listed in the message list. This happened between 9/5/14 and 12/5/14.
I haven't tried to check what headers they've used to confuse Outlook like this.
This group has always been configured so that Reply and Reply All go to the list address, but it was possible to construct a private reply manually by copying the sender's address from the top of the quoted headers. You can't do that anymore in Outlook without delving into the original message's headers.
I should also note that in the footer of each message there is a mailto: link that sets up a reply to the original sender. I've never noticed it before, although it's always been there, and I assume this can't be broken by any changes they've done to the headers.
The link doesn't set up the quoted text, just a blank body, so even this isn't a satisfactory workaround.
Peter Shute
On 12 May 2014, at 2:18 pm, "Peter Shute" <pshute@nuw.org.au> wrote:
Peter Shute wrote:
I can confirm that there's been a change. On a yahoo group I'm a member of, Outlook used to say the group messages were from the list address on behalf of the sender's address. Now they just say they're from the list address, although the original sender is listed in the message list. This happened between 9/5/14 and 12/5/14.
I haven't tried to check what headers they've used to confuse Outlook like this.
This group has always been configured so that Reply and Reply All go to the list address, but it was possible to construct a private reply manually by copying the sender's address from the top of the quoted headers. You can't do that anymore in Outlook without delving into the original message's headers.
I should also note that in the footer of each message there is a mailto: link that sets up a reply to the original sender. I've never noticed it before, although it's always been there, and I assume this can't be broken by any changes they've done to the headers.
The link doesn't set up the quoted text, just a blank body, so even this isn't a satisfactory workaround.
And on my iPad I can't even tell who has sent the emails. The native email app doesn't display their address anywhere. If they've used any techniques that will become available to my mailman list with 2.1.18-1 then this is a good tryout. Don't like it.
Peter Shute
On 05/11/2014 09:18 PM, Peter Shute wrote:
I should also note that in the footer of each message there is a mailto: link that sets up a reply to the original sender. I've never noticed it before, although it's always been there, and I assume this can't be broken by any changes they've done to the headers.
Presumably, this link is something the list admin has set in the list's msg_footer and maybe digest_footer.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On 05/11/2014 09:09 PM, Peter Shute wrote:
I haven't tried to check what headers they've used to confuse Outlook like this.
See the FAQ at <http://wiki.list.org/x/RoA9>.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (4)
-
Cedric Knight -
Mark Sapiro -
Peter Shute -
Stephen J. Turnbull