On 6/30/21 3:37 PM, Thomas Gramstad wrote:

A subscriber to one of my lists who posts from gmail has been made aware that some list subscribers do not get his postings because of DKIM setup at gmail. See attached error message.

I understand that he can't do anything about the DKIM setup at gmail.

Can I as list admin do something in the list setup (Mailman 2.29)?

Also, how many subscribers are likely affected by his (or any gmail user's) DKIM setup? That is, are most list subscribers receiving his messages anyway, or is this problem preventing e-mail from him going to most list subscribers?

It isn't gmail, it is the recipient MTAs

However, removing the incoming DKIM signatures which Mailman's transformations break as Jon Baron suggest may help.

Also, the message

Dette kan muligens skyldes at SPF record ikke er helt riktig:

v=spf1 redirect=_spf.google.com

SPF Alignment Domain not found in SPF

says the problem is SPF. SPF will always fail on mail forwarded through a list or other forwarding mechanism. You can only avoid this by setting General Options -> from_is_list other than No.

Also you should DKIM sign your outgoing mail and publish your own SPF.

-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

Grant Taylor via Mailman-Users writes:

Thus, recipients see that messages aren't coming from where the sender says they should be and that the cryptographic signature is broken. Hence the receiving server is naturally treating the message from the mailing list as highly suspicious.

"Naturally" if you don't read RFCs, of course. There are *many* common practices where mail comes from somewhere other than what From says. This is not limited to lists.

Normal folk of good will who hate spam (now, *that* is natural!) will use code by developers who read the RFCs and know that a broken signature has very little information compared to no signature at all, and therefore SHOULD NOT (emphasis in the RFC) treat broken signatures differently from absent ones. Nowadays, you have to be *trying* to break the Internet to treat broken signatures as significant.

To avoid this suspicion:

1. Send with your own SMTP envelope address (VERP).

I believe you can change the Return-Path using the list-bounces address setting, but VERP doesn't affect the domain. VERP adds a cookie to the Return-Path which allows identifying the individual recipients whose copies caused bounces. As far as I know, the SMTP MAIL FROM "envelope" address is set by Mailman from the list bounces address. I doubt there's a way to set it to the origin domain in Mailman.

2. Use full personalization.

For many recipient domains, this won't help, because they'll identify a mass-mailing by the Message-ID and/or content. However, it may help with some, either because they give spam points because it's not personally addressed, or because they assess that personalization is costly, so spammers won't do it. (Both are bad ideas, but the average user would break the Internet to avoid one spam per day, so there are a lot of domains who do such things ....)

3. Remove incoming DKIM signatures.

Removing signatures you expect the list to break (by changing existing headers or the body) is normally harmless. However, if you have any lists that make no changes at all to the existing header or body of the message, but only add new fields to the header, you must not do this for those lists. You'll break all the AOL and Yahoo! users, and possibly unsubscribe half the list.

Also, there are paranoid sites that try to reconstruct the original mail by removing standard header tags and footers and attempting validation. This will break them. (If that applies to your recipients, they'll most likely let you know when you start removing the incoming signatures, so it's not a significant consideration.)

4. Add your own outgoing DKIM signature.

This is always a good idea.

I'd suggest updating your config sooner than later.

When everything is an existential threat, nothing is an existential threat. But yeah, if there are delayable tasks, especially related to mailing list admin, these checks and actions should be prioritized:

1. outgoing mail is DKIM signed,
2. with the right key,
3. whose public key is in the right place in DNS, and
4. if the lists are coming from a subdomain with a domain-wide key that the DNS record states that subdomains are covered, and
5. fixing/adding any of the above that need it, and
6. checking that the outgoing MTA's IP/domain is not on any blacklists and remonstrating with the owners if so, and
7. adding/configuring/checking a spamcheck on mail incoming to Mailman, and
8. if necessary exempting Mailman from any outgoing spamchecks (this doesn't help your mail get through, but the CPU will cheer). Subscribers will appreciate it.

With lower priority, site admins whose lists are mission-critical may want to sign up for various bulk mail certification programs (called various things) at the Internet-scale providers like GMail, Microsoft, and Yahoo!.[1] Those require substantial effort, though. There are other ideas in the FAQ.

Steve

Footnotes: [1] Unfortunately Yahoo! and AOL are now run by Verizon, which seems to want to break the Internet, or at least Internet mail, so I suspect their programs are losing usefulness rapidly.