13 Apr
2014
13 Apr
'14
9:44 p.m.
Hi,
Yahoo! have made a change to their DMARC settings in a way that is
incompatible with how Internet mailing lists tend to operate. As a
result it is likely that members of this list (5 of you) with a
Yahoo! email account will start to cause email delivery issues for
others subscribers.
As this is not something that we can easily fix, and represents a
failure to understand how the Internet works on Yahoo!'s part, I
have had to moderate those 5 members. My best suggestion is for
those affected to change email address if you wish to continue
posting to this and other mailing lists.
Sorry about that.
The technical issue is that Yahoo! now requires that all email with
a Yahoo! email address as its From: address to have originated on
Yahoo!'s network.
Mailing lists relay mail on behalf of users, using their own
envelope sender address in order to catch bounces, but keeping the
original's From: address. As a result they send email that appears
to be from an individual, but originates elsewhere.
Yahoo!'s current DMARC settings cause sites that use DMARC to reject
such emails. Unfortunately this is not just limited to Yahoo!. It
includes Gmail, Hotmail, Comcast and other large email providers. So
if a Yahoo! user sends an email to this list, multiple subscribers
will reject it. This will go to bounce processing and ultimately may
start kicking people off the list.
Some more info:
http://www.ietf.org/mail-archive/web/ietf/current/msg87153.html
http://www.theregister.co.uk/2014/04/08/yahoo_breaks_every_mailing_list_in_…
http://www.computerworld.com/s/article/9247512/Yahoo_email_anti_spoofing_po…
Once you've changed address you can re-subscribe from here:
https://lists.bitfolk.com/mailman/listinfo/users
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
I'd be interested to hear any (even two word)
reviews of their sofas…
Provides seating. — Andy Davidson
16 Apr
16 Apr
11:36 a.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
On Sun, Apr 13, 2014 at 09:44:53PM +0000, Andy Smith wrote:
As this is not something that we can easily fix, and
represents a
failure to understand how the Internet works on Yahoo!'s part, I
have had to moderate those 5 members.
Turns out I was a bit over-enthusiastic about this: the DMARC
setting only currently applies to yahoo.com addresses, not
yahoo.co.uk, or any other yahoo.* domain. Therefore there is
actually only one of you affected, and the rest have been
unmoderated.
You can check that situation with:
$ dig +short txt _dmarc.yahoo.com
"v=DMARC1\; p=reject\; sp=none\; pct=100\; rua=mailto:dmarc-yahoo-rua@yahoo-inc.com,
mailto:dmarc_y_rua@yahoo.com\;"
If it doesn't say "p=reject" then it's okay.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
26 Apr
26 Apr
2:08 p.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
On Sun, Apr 13, 2014 at 09:44:53PM +0000, Andy Smith wrote:
Yahoo! have made a change to their DMARC settings in a
way that is
incompatible with how Internet mailing lists tend to operate. As a
result it is likely that members of this list (5 of you) with a
Yahoo! email account will start to cause email delivery issues for
others subscribers.
As this is not something that we can easily fix, and represents a
failure to understand how the Internet works on Yahoo!'s part, I
have had to moderate those 5 members. My best suggestion is for
those affected to change email address if you wish to continue
posting to this and other mailing lists.
Sorry about that.
I don't expect there are many, if any, AOL users subscribed to this
list, but AOL has followed Yahoo and set its DMARC policy to p=reject:
http://postmaster-blog.aol.com/2014/04/22/aol-mail-updates-dmarc-policy-to-…
AOL, like Yahoo, has been suffering from spam sent from spoofed
addresses (to the addresses' contacts).
The same things has started happening to Gmail addresses as well. I
don't expect Gmail to follow suit and change its DMARC policy - at least
not without some prior announcement - but one never knows and it's good
to keep in mind that this is always a possibility.
Martijn.
12 May
12 May
11:16 p.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
What are people doing in relation to this?
Until now, I have been using postfix to send mail for
client@clientsdomainto their real email address, but this fails for
the reasons given when
people unfortunate enough to use yahoo. com (or, more rarely, AOL) email
them.
I could switch to running a mail server for them, rather than forwarding,
but it involves them changing things. And it will be a pain for me.
I could collaborate with breaking RFCs and change the from: line of the
header (is there an easy way to do that which ensures that there is a
reply-to: line which adds the old from: if necessary?) but I don't really
want to do that.
Or I could say 'tough, no more using client@clientsdomain', but they don't
want that.
Ian
13 May
13 May
8:36 a.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
On Tue, May 13, 2014 at 12:16:02AM +0100, Ian wrote:
What are people doing in relation to this?
Until now, I have been using postfix to send mail for
client@clientsdomainto their real email address, but this fails for
the reasons given when
people unfortunate enough to use yahoo. com (or, more rarely, AOL) email
them.
Am I right in understanding that breaking DKIM isn't an issue here (as
mere forwarding shouldn't break DKIM) but breaking SPF is?
Blocking on/refusing SPF hardfails isn't very common (and probably not a
good idea), but it isn't new. Something like the Sender Rewriting Scheme
might help here:
http://en.wikipedia.org/wiki/Sender_Rewriting_Scheme
Martijn.
2:53 p.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
Hello,
On Tue, May 13, 2014 at 08:36:01AM +0000, Martijn Grooten wrote:
On Tue, May 13, 2014 at 12:16:02AM +0100, Ian wrote:
Mailman typically breaks DKIM signatures when it alters the subject
and adds its own footers.
Since both DKIM and SPF fails, the DMARC reject policy is enforced.
Here are your options today, with Mailman:
http://wiki.list.org/pages/viewpage.action?pageId=17891458
I will probably continue to go with (4) until 2.1.18 hits Debian
stable or backports, in which case I'll go for (1): allow From
address munging for senders who have DMARC reject policy.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
What are people doing in relation to this?
Until now, I have been using postfix to send mail for
client@clientsdomainto their real email address, but this fails for
the reasons given when
people unfortunate enough to use yahoo. com (or, more rarely, AOL) email
them.
Am I right in understanding that breaking DKIM isn't an issue here (as
mere forwarding shouldn't break DKIM) but breaking SPF is?
3:28 p.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
On Tue, May 13, 2014 at 02:53:08PM +0000, Andy Smith wrote:
Mailman typically breaks DKIM signatures when it
alters the subject
and adds its own footers.
Sure, it does. I responded to the situation that Ian described, where
his MTA merely forwards emails to his users' actual email addresses.
That shouldn't break DKIM.
Apologies for the confusion.
Martijn.
4:48 p.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
Hello,
On Tue, May 13, 2014 at 03:28:43PM +0000, Martijn Grooten wrote:
On Tue, May 13, 2014 at 02:53:08PM +0000, Andy Smith
wrote:
No, you're right, it's me that was confused. I thought he was
talking about mailing lists.
Yes, a simple forwarder — as long as it's doing SRS — should be
okay. I think. :)
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
Mailman typically breaks DKIM signatures when it
alters the subject
and adds its own footers.
Sure, it does. I responded to the situation that Ian described, where
his MTA merely forwards emails to his users' actual email addresses.
That shouldn't break DKIM.
Apologies for the confusion.
15 May
15 May
6:44 p.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
Andy Smith said:
No, you're right, it's me that was confused. I
thought he was
talking about mailing lists.
No, although when a mailing list is resurrected, it is going to be an
issue with that. I do like the new dmarc_moderaction_action for mailman,
which only kicks in for domains that are telling the world to reject or
quarantine mail not validly signed as being from them.
Yes, a simple forwarder — as long as it's doing
SRS — should be
okay. I think. :)
Sometimes yes, sometimes no.
I have noticed some problems, but on looking more closely there are not
as many as I thought and they seem to be the sender's fault.
So on the 13th, I have a message in the logs from Gmail rejecting an
email from evil Facebook:
/var/log/mail.log:May 13 00:35:18 localhost postfix/smtp[27315]:
7363081163: to=<**account**(a)gmail.com>om>,
orig_to=<facebook(a)**domain**.com>om>,
relay=gmail-smtp-in.l.google.com[173.194.78.26]:25, delay=1.3,
delays=0.82/0.01/0.06/0.41, dsn=5.7.1, status=bounced (host
gmail-smtp-in.l.google.com[173.194.78.26] said: 550-5.7.1
Unauthenticated email from facebookmail.com is not accepted due to
550-5.7.1 domain's DMARC policy. Please contact administrator of
facebookmail.c 550-5.7.1 om domain if this was a legitimate mail. Please
visit 550-5.7.1 http://support.google.com/mail/answer/2451690 to learn
about DMARC 550 5.7.1 initiative. c8si3184511wix.26 - gsmtp (in reply to
end of DATA command))
.. but all the other messages from them this month appear to have got
through ok.
The one that did get blocked appears to be legit: it has arrived in a
local mailbox as well as being forwarded to Gmail and looks totally
normal apart from the fact that it doesn't have any authentication in
the header. It does look like a new evil Facebook server (it got
greylisted) so is Facebook being incompetent as well as evil?
There are other bounces from Gmail in the logs over yahoo.com mail, on
8th May, 5th May, 23rd April, 19th April (twice) and 17th April.
Looking at them, the 8th May is actually spam via someone else; 5th May
and 23rd April a Yahoogroups email that needed approving by the mod; and
the other April emails were also Yahoogroups from yahoo.com users.
For other people's email, there are rather more, but they do look like
spam.
It's somewhat annoying that there doesn't seem to be an easy way to get
Postfix to do what the new Mailman does - look at the published policies
and act accordingly. Or is there?
Ian
10:07 a.m.
New subject: Yahoo! breaks every mailing list in the world (including this one)
On 26 April 2014 15:08, Martijn Grooten <martijn(a)lapsedordinary.net> wrote:
The same things has started happening to Gmail
addresses as well. I
don't expect Gmail to follow suit and change its DMARC policy - at least
not without some prior announcement - but one never knows and it's good
to keep in mind that this is always a possibility.
I've been looking in the headers of e-mails from this list (I host my
domain with Google Apps for Business) and it appears to me that Google
are only doing DKIM and SPF checks on the envelope From: address (i.e.
lists.bitfolk.com) and not the contributor's address.
I've added a DMARC DNS record for my domain (with p=none, of course)
and will see what sort of report I get for my own e-mails to this
list.
Mike
3633
days inactive
3665
days old
9 comments
4 participants
participants (4)
-
Andy Smith -
Ian -
Martijn Grooten -
Mike Zanker