[Mailman-Users] non-subscribers getting through--email address in "Real Name"

[Mark Sapiro]

On 07/19/2018 02:11 PM, John Levine wrote:
> In article <c5d1335d-0762-8a85-3257-239d5e2e46d6 at spamtrap.tnetconsulting.net> you write:
>> Yes.  Just about everything can be spoofed to some degree.  It really 
>> depends on what information the owner of the purported sending domain 
>> publishes and what filtering / consumption of said information the 
>> receiving server exercises.
> 
> Well, you know, this is what DMARC is intended to address.


Actually, DMARC is intended to address spoofing of domains and needs to
be configured by the domain owner publishing a DMARC policy.

DMARC checks won't help prevent posts that spoof a member address unless
every list member's domain publishes a DMARC policy of quarantine or
reject, and even then it only checks the From: domain and not the domain
of other addresses Mailman might use to determine list membership.

Further, a post with spoofed local part sent by someone in the same
domain might pass DMARC if sent via the domain's servers.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan