[Mailman-Developers] Adding DMARC support for Mailman 3

[Murray S. Kucherawy]

On Mon, Jul 8, 2013 at 12:26 AM, Franck Martin <franck at peachymango.org>wrote:

> 1) may not be necessary, if mailman recognizes the bounce message as in
> section
> http://tools.ietf.org/html/draft-kucherawy-dmarc-base-00#section-15.8
> eg "550 5.7.1 Email rejected per DMARC policy for example.com"
> and does not increase the unsubscribe/bounce counter for the receiving
> email address. I suppose MM3 bounce processing is better than with MM2, so
> this may be already addressed.
> Some people have requested this feature, so it is fair to include it,
> rather than them having to tweak the associated MTA (which some do not have
> control).
>

I don't think the idea of telling people to include or go look for a
particular substring in the SMTP reply text will ultimately work in a
standards document, which relegates this logic to the realm of heuristics.
We've already seen resistance to that effect on the IETF lists.  We'd be
better off trying to register some enhanced status codes and asking the
community to begin using those.


>
> 3) This draft has been on the table for a while, as Murray points, one
> large mailbox provider uses it in a proprietary way, but similar to what is
> in Murray's draft. So there is experience, and as far as I know they still
> do not think it is a bad idea. Nevertheless, I think mailman should not do
> the email authentication part, but be able to recognize "true"
> authentication-result headers coming from the MTA mailman uses and be able
> to rewrite them as an OAR. This keep the logic simple, and should be
> enabled if the MTA can control Authentication-Results headers and remove
> spoofed ones. Personally I think 3) is more complicated than 2) to put in
> place correctly as it requires tight configuration between MM3 and the MTA.
>

Well, one (or two) parties have experience with OAR.  It would be nice if
this was broader, but that there is not after all this time is something I
take to mean it's not a pain point others are feeling.  It might work great
for MM3, to be sure, but they'd effectively be the broad-scale pioneers
here.

-MSK