4 ms·
This is a terrible article that's almost completely wrong as it doesn't even mention the distinction between envelope (SMTP) from and header (RFC822) from. The
by zAy0LfpBZLC8mAC 10y ago
This is a terrible article that's almost completely wrong as it doesn't even mention the distinction between envelope (SMTP) from and header (RFC822) from.
The envelope from is what is transmitted in SMTP commands and specifies where bounces due to delivery delays or failures are supposed to be sent, the header from is what is displayed to the recipient as the sender, but is completely ignored by SMTP.
SPF only deals with the envelope from, DKIM only deals with the header from (and other parts of the email headers/content).
Really, there is nothing there that necessarily prevents mailing lists from working just fine:
A mailing list can (and should) replace the envelope from with its own address, so that bounces from subscribers aren't sent to the author of the message, but to the mailing list software, which then can do bounce management, such as automatically unsubscribing addresses that consistently bounce because they don't exist anymore. As the mailing list software should use its own domain for the bounce addresses, the mailing list operator can set up SPF to authorize the mailing list server as an outbound server for that domain just fine, and that has no effect whatsoever on the header from that's shown to the recipient, and that replies would go to by default.
As for DKIM, you simply should not modify the message, and it will deliver just fine, whether through a mailing list or directly. Modifying the message mostly really shouldn't be necessary. Reply-to mangling is a bad idea anyhow, and the mailing list should be recognized by the client software either because it's in the destination headers, or by using mailing-list headers added by the mailing list software, instead of mangling the body or the subject.
- callahad 10y agoI found this article from the Fastmail folks to be rather enlightening, and being Fastmail, you know it's meticulously correct: https://blog.fastmail.com/2016/12/24/spf-dkim-dmarc/ https://blog.fastmail.com/2016/12/24/spf-dkim-dmarc/
- phicoh 10y agoActually, DMARC refines SPF to also apply to the header from. If you have only an SPF record on your domain then the old rule applies (only envelop from). If you also have the _dmarc.<domain> then SPF also applies to header from.
- gcp 10y agoModifying the message mostly really shouldn't be necessary. unsubscribe
- Hello71 10y agoList-Unsubscribe you mean
- temprature 10y ago> As the mailing list software should use its own domain for the bounce addresses, the mailing list operator can set up SPF to authorize the mailing list server as an outbound server for that domain just fine This will make SPF pass but it has no effect on the DMARC result. For DMARC to use the SPF result, the envelope FROM needs to be aligned with the header From. Pretty much every mailing list already does what you've described but it doesn't help with DMARC. > As for DKIM, you simply should not modify the message Many mailing lists modify every message to add a footer with unsubscribe information. Others only modify some messages when necessary such as to convert HTML messages to plain-text, to strip attachments, to wrap lines to 72 characters etc.
- CodeWriter23 10y agoYes, modify the message and submit to the SMTP server, which calculates the DKIM signature.
- temprature 10y agoI don't understand what you mean. If you're saying the mailing list SMTP server could sign the message with their own DKIM key, that doesn't work because the DKIM result only gets used if the signing domain is aligned with the domain in the From header.
- CodeWriter23 10y agoOoops, I probably should have quoted you > Many mailing lists modify every message to add a footer with unsubscribe information. That will not affect DKIM. The DKIM signing occurs after the listserv creates the email message and hands it off to the SMTP server.
- temprature 10y ago> That will not affect DKIM. It will affect DKIM and it does. > The DKIM signing occurs after the listserv creates the email message and hands it off to the SMTP server. The DKIM signing occurs before the listserv even receives the message. It's done by the sender's SMTP server before it gets relayed. The listserv receives the signed message and adds a footer which breaks the signature.