Hi Adam,
On Sun, May 28, 2023 at 05:53:11PM +0100, Adam Spiers via BitFolk Users wrote:
But we're experiencing issues with SPF failures
causing bounces and
eventual unsubscribes, which I'm not even sure mailman 3.x handles any
better than 2.x.
It's worth looking in to this as SPF normally isn't a problem for
mailing lists, neither in Mailman 2.x nor 3.x or most other
implementations.
The reason why it's not a problem is that SPF works on the envelope
sender, not the From: address, and all versions of Mailman normally
replace the envelope sender with themselves (which may or may not
include VERP encoding to catch individual bounces).
For example, your post (for me) has the envelope sender
<users-bounces+andy=bitfolk.com(a)mailman.bitfolk.com> so when my
infrastructure does an SPF check it will be against the SPF record
at
mailman.bitfolk.com. In the case of this mailing list we've ALSO
replaced the From: address with the list's address but even if we
hadn't, the SPF check is still against the envelope sender so at no
point will it check the SPF of
gmail.com.
Us changing the From: address was a defence against DKIM, which you
may be confusing with SPF here. DKIM does work on the From: address.
If you keep the poster's From: address and the poster has included a
DKIM signature, AND your Mailman has modified the mail in any way,
the DKIM signature will be invalidated. Most users of mailing lists
appreciate the posts being modified, perhaps to include an
explanatory footer, and/or a prefix on the subject line. That
changes the content which in turn breaks the DKIM signature.
The RFC for DKIM says that invalid signatures should be treated like
no signature at all, i.e. should not be penalised, but plenty of
receiving sites do penalise a failing DKIM signature.
Both Mailman 2 and Mailman 3 have options to replace the From:
address with the list's address. Despairing at how remote sites
treat DKIM, that's what we did, and it's what a lot of other mailing
lists I know of have done too. It makes it harder to see the
original real email address, but it prevents DKIM failures and means
you can also DKIM sign the mails yourself.
I didn't find the DKIM thing to be the main reason to move away from
Mailman 2. The main reason was that MM2 is a Python 2-only app that
is now EOL upstream and is therefore not shipped by any Linux
distribution that has also stopped shipping Python 2, which is most
of them.
It's a shame because MM3 is a behemoth. I feel it's overly complex.
A straight port of MM2 to Python 3 would have been much more
welcome. Failing that I wish I could have just put email mailing
lists into the dumpster of time.
https://www.mailmanhost.com/
https://www.mailmanlists.net/
There's also
https://mailman3.com/ which can host in the EU, but I'm not
sure if they offer migration.
Does anyone have any experience with any of these, or have recommendations
of good alternatives to mailman (preferably with options to migrate
existing mailman lists)?
I don't have any experience with those, but they all seem okay.
I would not expect your issues with getting email in to Gmail and
Yahoo! to go away. Replacing your From: address with that of the
list might help you a bit.
Personally I'd be tempted to switch to Discourse, which has an email
participation mode if desired, and has SaaS options if you didn't
want to self-host. It's what I'd have replaced BitFolk's mailing
lists with if there weren't so much pushback from people who are
wedded to the 20th century mailing list experience.
(Not to be confused with Discord, which is a closed source chat
application that does have some announcement features.)
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting