[Mailman-Users] Massive amounts of bounces after setting munge_from for dmarc compliance

[Andy Cravens]

On Nov 19, 2019, at 9:39 AM, Andy Cravens <acravens at uen.org> wrote:

Mailman 2.1.26.  I modified all our lists that did not have munge_from set for DMARC compliance.  I ran a few tests and was able to send and receive email from my test list.  Now I’m getting reports that large numbers of emails are bouncing and members are being unsubscribed.  I had someone forward a bounce message to me and it says it was rejected because it was suspected as spam.  In this sample email the headers show the original sender has some DKIM headers and I do not have mailman set to remove DKIM headers.  From the docs I found on the mailman wiki it said to not remove the DKIM headers.

This particular list server is on a domain that does not use DKIM but does have an SPF record set to soft fail and the DMARC is set to p=none for monitoring only.    The headers in the sample email shows “dkim=fail (signature did not verify)” so I’m thinking I may need to have mailman strip out the DKIM headers from the original sender.  Before I modified this particular list I created a test list and added some members from one particular organization.  The test list worked fine even though the original DKIM signatures were not removed.

I also found this post where this guy says you need to remove the DKIM headers:  https://blog.dogan.ch/2016/11/24/making-mailman-dmarc-compatible/  

------------------------------------------------------
Mailman-Users mailing list Mailman-Users at python.org
https://mail.python.org/mailman/listinfo/mailman-users
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: https://mail.python.org/mailman/options/mailman-users/acravens%40uen.org





I meant to say our default setting for all lists is to set from_is_list to munge_from.  I also realized that some list managers (who’s domain uses DKIM) have added footers to their mailing list so I’ll have to strip the DKIM headers no matter what.  Finally, in the documentation I have found I see two variations for setting REMOVE_DKIM_HEADERS.

REMOVE_DKIM_HEADERS = 1
REMOVE_DKIM_HEADERS = Yes

Which one is correct?