3 ms·

So what should Yahoo do? Change settings to say "Actually, anyone in the world can send emails from @yahoo.com now."? (Honest question.)

by billpg 13y ago

mike-cardwell 13y ago
Yes. If they want their users to be able to use mailing lists.
- billpg 13y ago
  Is that the trade-off? Either we neuter SPF et al or we break mailing lists? I vote for SPF et al.
  - mike-cardwell 13y ago
    Yes, that is the tradeoff. SPF doesn't really come into it. Mailing lists use their own sender envelope. The problem is, when a mailing list makes changes to an email which breaks the DKIM signature. But the sender uses DMARC to say that DKIM must pass. Another fix would be for all mailing lists to be updated to not make any changes to messages which might break DKIM. E.g by adding [listname] to the subject line, or messing with other headers, or adding signatures to the body.
    - avz 13y ago
      The tradeoff isn't that bad: it's possible to make mailing lists work with DMARC, see for example their suggestions in the FAQ: http://dmarc.org/faq.html#s_3 http://dmarc.org/faq.html#s_3. It can be argued that the required changes are very burdensome and not mailing-list-friendly. The mail body modifications seem to me like something mailing lists could drop taking advantage of the list-* headers instead. The harder usability issue arises from the fact that DMARC imposes a different way of setting the from header potentially breaking all those filters we've set up. DMARC claim both issues can be solved using "Original Authentication Results" header but since it requires the receiving MTA to trust the mailing list the administrative overhead here just doesn't scale and will likely end up being pushed onto the list admins. Also, SPF does come into it since DMARC requires "alignment" between the from domains in the envelope and the header (see again the FAQ answer above).
      - mike-cardwell 13y ago
        My point about SPF not coming into it, was made because SPF will fail in a forwarding/list setup. DKIM can work in this setup, so that's what we want to make work, but which all mailing list software seems to break.
  - speleding 13y ago
    SPF is not the problem here, SPF determines what mail server can send yahoo mail. The issue here is DMARC which determines (amongst other things) what to do when someone puts yahoo.com in the "From:" field. Yahoo has set it up so that mail gets rejected in that case, even if you add the proper "Resent-From" header to be something non-yahoo.

So what should Yahoo do? Change settings to say "Actually, anyone in the world can send emails from @yahoo.com now."? (Honest question.)

by billpg 13y ago

So what should Yahoo do? Change settings to say "Actually, anyone in the world can send emails from @yahoo.com now."? (Honest question.)

mike-cardwell 13y ago

Yes. If they want their users to be able to use mailing lists.

billpg 13y ago
Is that the trade-off? Either we neuter SPF et al or we break mailing lists? I vote for SPF et al.
- mike-cardwell 13y ago
  Yes, that is the tradeoff. SPF doesn't really come into it. Mailing lists use their own sender envelope. The problem is, when a mailing list makes changes to an email which breaks the DKIM signature. But the sender uses DMARC to say that DKIM must pass. Another fix would be for all mailing lists to be updated to not make any changes to messages which might break DKIM. E.g by adding [listname] to the subject line, or messing with other headers, or adding signatures to the body.
  - avz 13y ago
    The tradeoff isn't that bad: it's possible to make mailing lists work with DMARC, see for example their suggestions in the FAQ: http://dmarc.org/faq.html#s_3 http://dmarc.org/faq.html#s_3. It can be argued that the required changes are very burdensome and not mailing-list-friendly. The mail body modifications seem to me like something mailing lists could drop taking advantage of the list-* headers instead. The harder usability issue arises from the fact that DMARC imposes a different way of setting the from header potentially breaking all those filters we've set up. DMARC claim both issues can be solved using "Original Authentication Results" header but since it requires the receiving MTA to trust the mailing list the administrative overhead here just doesn't scale and will likely end up being pushed onto the list admins. Also, SPF does come into it since DMARC requires "alignment" between the from domains in the envelope and the header (see again the FAQ answer above).
    - mike-cardwell 13y ago
      My point about SPF not coming into it, was made because SPF will fail in a forwarding/list setup. DKIM can work in this setup, so that's what we want to make work, but which all mailing list software seems to break.
- speleding 13y ago
  SPF is not the problem here, SPF determines what mail server can send yahoo mail. The issue here is DMARC which determines (amongst other things) what to do when someone puts yahoo.com in the "From:" field. Yahoo has set it up so that mail gets rejected in that case, even if you add the proper "Resent-From" header to be something non-yahoo.