3 ms·

This isn't a change. SPF has always broken forwarders that don't touch the envelope from address, and that is right and proper. You can still forward mail, but

This isn't a change. SPF has always broken forwarders that don't touch the envelope from address, and that is right and proper. You can still forward mail, but your forwarder must rewrite the return path.

hedgehog 3y ago
It's is a change in mail service behavior, and arguably either a broken policy or broken spec (not sure and don't really care since the effect is the same). "In April 2024, Google will start rejecting a percentage of non-compliant email traffic and gradually increase the rejection rate. For example, if 75% of a sender’s traffic meets our requirements, Google will start rejecting a percentage of the remaining 25% of traffic that isn’t compliant." https://dmarcian.com/yahoo-and-google-dmarc-required/ https://dmarcian.com/yahoo-and-google-dmarc-required/
- Avamander 3y ago
  It's really not a change or any of those. Mail services have behaved this way in some form or way for a while, these specs have worked like this from the start and the policy is only a logical conclusion of it all. Untrusted forwarders (also sometimes known as open relays) have been heavily frowned upon for a really long time. SPF has never worked for forwarders that don't do rewriting. Those letters have always been negatively looked upon, unauthenticated mail is a remnant of times long gone. Google's policies about authentication are the bare minimum you should be doing anyways if you care even a little bit about your customers or recipients in general.
hannob 3y ago
This is something I'm still trying to find someone who understands it in detail and can explain it to me. Because as you say, you break SPF if you don't touch the envelope from. There's SRS to fix this. But if you do that, you break DMARC alignment. So... something is always broken? It appears to me there's no way to make mail forwarding that works with full SPF/DKIM/DMARC setups.

hedgehog 3y ago

It's is a change in mail service behavior, and arguably either a broken policy or broken spec (not sure and don't really care since the effect is the same). "In April 2024, Google will start rejecting a percentage of non-compliant email traffic and gradually increase the rejection rate. For example, if 75% of a sender’s traffic meets our requirements, Google will start rejecting a percentage of the remaining 25% of traffic that isn’t compliant." https://dmarcian.com/yahoo-and-google-dmarc-required/ https://dmarcian.com/yahoo-and-google-dmarc-required/

Avamander 3y ago
It's really not a change or any of those. Mail services have behaved this way in some form or way for a while, these specs have worked like this from the start and the policy is only a logical conclusion of it all. Untrusted forwarders (also sometimes known as open relays) have been heavily frowned upon for a really long time. SPF has never worked for forwarders that don't do rewriting. Those letters have always been negatively looked upon, unauthenticated mail is a remnant of times long gone. Google's policies about authentication are the bare minimum you should be doing anyways if you care even a little bit about your customers or recipients in general.

hannob 3y ago

This is something I'm still trying to find someone who understands it in detail and can explain it to me. Because as you say, you break SPF if you don't touch the envelope from. There's SRS to fix this. But if you do that, you break DMARC alignment. So... something is always broken? It appears to me there's no way to make mail forwarding that works with full SPF/DKIM/DMARC setups.