Tracker reviews look like spam

Gmail dumps patch review email in my junk box. The problem seems to be the spoofed From: header. Received: from psf.upfronthosting.co.za ([2a01:4f8:131:2480::3]) by mx.google.com with ESMTP id m1si26039166wjy.52.2015.05.12.00.20.38 for <tjreedy@udel.edu>; Tue, 12 May 2015 00:20:38 -0700 (PDT) Received-SPF: softfail (google.com: domain of transitioning storchaka@gmail.com does not designate 2a01:4f8:131:2480::3 as permitted sender) client-ip=2a01:4f8:131:2480::3; Tracker reviews are the only false positives in my junk list. Otherwise, I might stop reviewing. Verizon does not even deliver mail that fails its junk test, so I would not be surprised if there are people who simply do not get emailed reviews. Tracker posts are sent from Person Name <report@bugs.python.org> Perhaps reviews could come 'from' Person Name <review@bugs.python.org> Even direct tracker posts just get a neutral score. Received-SPF: neutral (google.com: 2a01:4f8:131:2480::3 is neither permitted nor denied by best guess record for domain of roundup-admin@psf.upfronthosting.co.za) client-ip=2a01:4f8:131:2480::3; SPF is Sender Policy Framework https://en.wikipedia.org/wiki/Sender_Policy_Framework Checkins mail, for instance, gets an SPF 'pass' because python.org designates mail.python.org as a permitted sender. -- Terry Jan Reedy

SPF only covers the envelope sender, so it should be possible to set that to something that validates with SPF, keep the RFC822 From: header as it is, and maybe(?) include a separate Sender: header matching the envelope address. David On Tue, May 12, 2015 at 06:08:30PM -0400, Terry Reedy wrote:

On 12May2015 22:15, David Wilson <dw+python-dev@hmmz.org> wrote:
Indeed. That sounds sane to me too. Google's complaint is SPF specific, so hopefully that is the criterion for the spam rating. It looks like bugs.python.org does not have an SPF record at all - neither SPF not TXT. (You really want both, same format, to support older DNS clients). I'm not sure you need a Sender: (though it wouldn't hurt), given that the From: is already a "system" like address ("<report@") and not a forged From: eg "Terry Reedy <tjreedy@udel.edu>" as a mailing list would do. Cheers, Cameron Simpson <cs@zip.com.au>

There's an issue about this at http://psf.upfronthosting.co.za/roundup/meta/issue562 I believe the problem is not that of the SPF, but the fact that mail gets sent using IPv6 from an address that has neither a name mapping to it nor a reverse pointer from IP address to name in DNS. See the second-first comment where R. David Murray states that "Mail is consistently sent from report@bugs.python.org, always from the same IP address, 46.4.197.70. 46.4.197.70 resolves to bugs.python.org.", which clearly is false. On 13 May 2015 at 08:20, Chris Angelico <rosuav@gmail.com> wrote:
-- Antti Haapala antti.haapala@iki.fi http://antti.haapala.name/ +358503693535

On Tue, May 12, 2015 at 3:09 PM Terry Reedy <tjreedy@udel.edu> wrote:
FWIW while the email signing issue might be interesting to fix... I really wish code reviews weren't emailed separately, I'd like to see them simply appended to the related issue as a block comment on the issue. Then all email notification would be handled by the bug tracker itself (which happens to already work). It keeps related conversation in a single place which will continue to persist even if we switch review tools in the future. I *believe* you can get this to happen today in a review if you add the report@bugs.python.org email address to the code review as the issueXXXXX in the subject line will make the tracker turn it into a bug comment. If so, having that be the default cc for all reviews created would be a great feature (and modify it not to send mail to anyone else). My 2 cents. (literally; as I'm only suggesting, not implementing) -gps

On Tue, 09 Jun 2015 21:41:23 -0000, "Gregory P. Smith" <greg@krypto.org> wrote:
I haven't double checked, but I think the issue number has to be in square brackets to be recognized. Presumably that's a change that could be made. What is lacking is someone willing to climb the relatively steep learning curve needed to submit patches for that part of the system, and some one of us with the keys to the tracker with time to apply the patch. Given the former I think we can manage the latter. I believe Ezio did try to make rietveld update the tracker, and ran into a problem whose nature I don't know...but I don't think he spent a whole lot of time trying to debug the problem, whatever it was. I imagine he'll chime in :) --David

SPF only covers the envelope sender, so it should be possible to set that to something that validates with SPF, keep the RFC822 From: header as it is, and maybe(?) include a separate Sender: header matching the envelope address. David On Tue, May 12, 2015 at 06:08:30PM -0400, Terry Reedy wrote:

On 12May2015 22:15, David Wilson <dw+python-dev@hmmz.org> wrote:
Indeed. That sounds sane to me too. Google's complaint is SPF specific, so hopefully that is the criterion for the spam rating. It looks like bugs.python.org does not have an SPF record at all - neither SPF not TXT. (You really want both, same format, to support older DNS clients). I'm not sure you need a Sender: (though it wouldn't hurt), given that the From: is already a "system" like address ("<report@") and not a forged From: eg "Terry Reedy <tjreedy@udel.edu>" as a mailing list would do. Cheers, Cameron Simpson <cs@zip.com.au>

There's an issue about this at http://psf.upfronthosting.co.za/roundup/meta/issue562 I believe the problem is not that of the SPF, but the fact that mail gets sent using IPv6 from an address that has neither a name mapping to it nor a reverse pointer from IP address to name in DNS. See the second-first comment where R. David Murray states that "Mail is consistently sent from report@bugs.python.org, always from the same IP address, 46.4.197.70. 46.4.197.70 resolves to bugs.python.org.", which clearly is false. On 13 May 2015 at 08:20, Chris Angelico <rosuav@gmail.com> wrote:
-- Antti Haapala antti.haapala@iki.fi http://antti.haapala.name/ +358503693535

On Tue, May 12, 2015 at 3:09 PM Terry Reedy <tjreedy@udel.edu> wrote:
FWIW while the email signing issue might be interesting to fix... I really wish code reviews weren't emailed separately, I'd like to see them simply appended to the related issue as a block comment on the issue. Then all email notification would be handled by the bug tracker itself (which happens to already work). It keeps related conversation in a single place which will continue to persist even if we switch review tools in the future. I *believe* you can get this to happen today in a review if you add the report@bugs.python.org email address to the code review as the issueXXXXX in the subject line will make the tracker turn it into a bug comment. If so, having that be the default cc for all reviews created would be a great feature (and modify it not to send mail to anyone else). My 2 cents. (literally; as I'm only suggesting, not implementing) -gps

On Tue, 09 Jun 2015 21:41:23 -0000, "Gregory P. Smith" <greg@krypto.org> wrote:
I haven't double checked, but I think the issue number has to be in square brackets to be recognized. Presumably that's a change that could be made. What is lacking is someone willing to climb the relatively steep learning curve needed to submit patches for that part of the system, and some one of us with the keys to the tracker with time to apply the patch. Given the former I think we can manage the latter. I believe Ezio did try to make rietveld update the tracker, and ran into a problem whose nature I don't know...but I don't think he spent a whole lot of time trying to debug the problem, whatever it was. I imagine he'll chime in :) --David
participants (7)
-
Antti Haapala
-
Cameron Simpson
-
Chris Angelico
-
David Wilson
-
Gregory P. Smith
-
R. David Murray
-
Terry Reedy