[sudo-discuss] Re: test, and also DMARC

On Sat, Jan 29, 2022 at 12:59:42PM -0800, Andrew R Gross wrote: There's a very deep rabbit hole to go down when you start discussing all the various interlinking components of modern email. I'll give the short version, since this is probably veering pretty far off-topic for the sudo-discuss@ list. DMARC is a primarily a method of authenticating a given message to ensure that it was actually sent by who it purports to be from. One of the ways it does this is by allowing the owner of a domain name to specify that emails from that domain must be signed in a specific way (typically DKIM signatures). It can also require that mail from that domain comes from an authorized server (via SPF rules). This is all well and good until a mailing list gets involved. If the list server were to take a message and just forward it as-is, the message would no longer align with the SPF record since the list server is operating under a different domain. The list server also can't pretend to be the original sender's domain since that would cause the SPF check to outright fail. Additionally, mailing lists will usually modify the message, for example by adding list headers, unsubscribe links, or adding the list address as the reply-to. This will break some DKIM signatures, and most end users have no way of affecting how their mail server signs outgoing mails. Breaking either SPF or DKIM can cause DMARC to fail and thus make any list recipient's mail server that is set to enforce DMARC restrictions reject the mail. These rejections go back to the list server, which may unsubscribe the unlucky recipient through no fault of their own (since their mail server is correctly rejecting a DMARC failure as the original sender requested). Thus the solution is to decouple the mailing list message from the original domain. This is done by editing the From: header to use the list address. Thus, recipients of the list message will check the DMARC restrictions of the list server, which should always pass for valid list messages (mailing list domains typically use a DMARC policy of "none"). This message modification strategy has its own downsides, but that's a discussion better suited for the mailop@ mailing list. --Sean