On 2022-06-19 at 12:22 -0700, Dave Crocker wrote: > On 6/18/2022 3:40 PM, Noel Butler via mailop wrote: > > > I was a very early (even in testing) user of SPF, It's rather commical > > reading these FUD sayers about SPF and mailing lists, it has never been > > a problem with mailing lists, not using mailman nor its more common > > predecessor majordomo, and I've never noticed anything wrong with qmail > > users ezmlm. > > This establishes the context of SPF and mailing lists. Hence my > question. > > Also, the above text makes the incorrect assertion that this isn't a > problem when a message passes through a mailing list. However, SPF > breaks even with basic MTA relaying, nevermind mailing lists -- unless > the MTA is registered in the SPF record. The delivery/re-post behavior > of mailing lists not only breaks SPF but almost always also breaks DKIM. > (This latter point is what motivated ARC.)
Mailing lists must use their own envelope from when injecting list messages to the subscribers. They could be a general one, per list, per subscriber or even per recipient and email, but they must do so in order to process bounces and disable delivery / unsubscribe users. I don't think you should consider a mailing list a system without this feature. Additionally, if it was to use the original envelope when sending to each subscriber, the author of the message would receive all delivery errors (no such account, mailbox full…) encountered by every subscriber, which they are not the ones to solve (unless they are the mailing list admins as well). Plus, they would learn about other subscribers (those with delivery errors) in what could be considered a small information leak (depending on the list). Thus, mailing lists already did fine with SPF and I don't think they required any change. Do note that SPF only cares about the envelope, it doesn't require the RFC821 envelope to be aligned with the RFC822 headers inside DATA. Passing DMARC is a different problem. Regards _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
