Re: DMARC: perspectives from a listadmin of large open-source lists

[Doug Barton <[e-mail]>]

On 04/07/2014 10:06 PM, Sabahattin Gucukoglu wrote:
> On 8 Apr 2014, at 05:21, John R Levine <[e-mail]> wrote:
>> Mailing list apps can't "implement DMARC" other than by getting rid of every feature that makes lists more functional than simple forwarders. Given that we haven't done so for any of the previous FUSSPs that didn't contemplate mailing lists, because those features are useful to our users, it seems unlikely we'll do so now.
>
> Well,  Mailman 2.1.16 has the FROM_IS_LIST feature that "Fixes" the problem by putting the list address in the From: field.  That seems to work, except that you lose information (the sender's address) if the list wants to operate a policy of "Reply goes to list".  You can then assure that DKIM signatures are valid and set up SPF, etc.  This also has the effect of letting you operate through the various cloud email platforms that try to validate sender addresses.

I haven't seen this suggestion anywhere yet, although I don't follow 
DMARC development, but here goes ...

Building on the FROM_IS_LIST idea, rather than having the From be 
rewritten to simply "[e-mail]" why not establish a convention 
(dare I say "standard?") to encode the real from address and list to the 
left of the @ sign? The rub with DMARC/SPF/DKIM is the domain itself, 
not the whole address.

Something like [e-mail] would 
work. I'm sure others could come up with better suggestions. In this way 
the identity of the sender is preserved, and the sending domain of the 
message satisfies the anti-spam tools. MUAs could then be adapted to 
decode the addresses in this form and show a "real" fake From field.

Given that tools like DMARC more or less work for everything but mailing 
lists (I'm being generous here in the interests of re-framing the 
discussion into solutions instead of griping), and given that mailing 
lists constitute a tiny percentage of overall e-mail traffic, I think 
that the solutions to this problem are going to lie with the mailing 
list software vendors. I think the above would work, but I'm not an 
expert in this area so feel free to tell me why I'm wrong.

Doug