[Tools-discuss] Fwd: [rt5.ietf.org #6435] Unable to get mail back from alias expansion - expand-mediaman-chairs

Harald Alvestrand writes:
> Who's in charge of the interaction between mailer and -chairs aliases?

I am part of team running iki.fi forwarding service in finland. We
have bit less than 30000 members using permanent forwarding service,
which provides permanent address (for example my kivinen@iki.fi) and
forwards that to the address where members want to read their emails.
This allows changing universities, companies etc without loosing touch
with your friends. So this kind of issues are quite well known to us.

The biggist problem is the SPF which should never have been approved
by IETF, and especially with the -all policy which some consultant
companies suggest you should use.

http://www.spfconsideredharmful.org/

To solve these issues we offer few services which makes this workable
for most of our users:

1) We use ARC to sign incoming messages before they are forwarded, and
   this allows end systems to verify the ARC headers, and whitelist
   our servers. I think that some of those modern mailbox service
   providers are actually already doing that, i.e., they allow users
   an ablity to configure the whitelist of trusted ARC senders.

2) We offer read-only web mail box for our members (opt-in), which
   stores copies for all emails sent to his address for last 7 days.
   This allows users for quick way of finding the mail even when it
   was filtered by his email provider. This mail box is read only, and
   automatically deletes all emails after 7 days, and does not allow
   any way of sending emails out etc.

3) We also offer outgoing SMTP service which allows DKIM signing
   emails our members send out with @iki.fi address. Some email
   services do allow SPF failures if there is proper DKIM headers.

And of course we help our members to convince their work email
adminstrators to properly configure their SPF records, and this quite
often works for companies which actually have adminstrators, as
companies usually care whether their emails go through or not. This is
quite different to free email services where the user is product sold
to the advertisers and those services do not care whether email is
reliable or not, they usually do not even have any support you could
contact and complain...

Anyways as DKIM and ARC do work with forwarded emails so I think we
should eat our own dogfood and make sure that:

1) All emails forwarded using draft/xxx-chair etc aliases (i.e., the
   ones which do not change smtp envelope address) should have ARC
   headers generated by ietf.org mail server.

2) All emails which do change smtp envelope address (i.e. mailing
   lists) should have DKIM headers added (and I think they already do
   that).

So I think we should configure ARC to be used for all those email
aliases which do not change envelope address.

Changing those aliases to be "mailing lists" would break other things,
so that is not a good solution.

> -------- Forwarded Message --------
> Subject: 	[rt5.ietf.org #6435] Unable to get mail back from alias 
> expansion - expand-mediaman-chairs
> Date: 	Wed, 18 May 2022 19:56:44 -0400
> From: 	Glen Barney via RT <support@ietf.org>
> Reply-To: 	support@ietf.org
> To: 	harald@alvestrand.no
> 
> 
> 
> Hi Harald -
> 
> You are correct in every respect.  You can, if you wish, make that 
> change to your SPF settings, but that will of course only solve it for 
> messages you send.
> 
> The aliases are generated by the Datatracker and the processing methods 
> are managed by it as well.   As such, this is not something that I, as 
> the operator, can fix, unfortunately.  If I may, I'd recommend engaging 
> with the Tools Team on the tools-discuss list about this.  That will at 
> least let them know that you're being impacted.  I would guess that as 
> more people report these problems to them, they will be able to 
> prioritize the design of a solution for that problem.
> 
> I'm very sorry that I can't do more here!
> 
> Glen
> --
> Glen Barney
> IT Director
> AMS (IETF Secretariat)
> 
> 
> On Wed May 18 04:55:21 2022, harald@alvestrand.no wrote:
> > It seems that the alias "expand-mediaman-chairs" is expanded at SMTP
> > level rather than at RFC 822 level, meaning that it gets a problem
> > with SPF.
> > 
> > Do I need to tell my SPF config that 50.223.129.194 is authorized to
> > send in my name, or can this be changed to a SPF-friendly method?
> > 
> > Harald
> > 
> > 
> > -------- Forwarded Message --------
> > Subject: Undelivered Mail Returned to Sender
> > Date: Mon, 16 May 2022 22:30:09 -0700 (PDT)
> > From: Mail Delivery System <MAILER-DAEMON@ietfa.amsl.com>
> > To: harald@alvestrand.no
> > 
> > This is the mail system at host ietfa.amsl.com.
> > 
> > I'm sorry to have to inform you that your message could not
> > be delivered to one or more recipients. It's attached below.
> > 
> > For further assistance, please send mail to postmaster.
> > 
> > If you do so, please include this problem report. You can
> > delete your own text from the attached returned message.
> > 
> > The mail system
> > 
> > <harald@alvestrand.no> (expanded from
> >       <expand-mediaman-chairs@virtual.ietf.org>): host
> >        smtp.alvestrand.no[65.21.189.24] said: 550 5.7.23
> > <harald@alvestrand.no>:
> >       Recipient address rejected: Message rejected due to: SPF fail -
> > not
> >       authorized. Please see
> > 
> > http://www.openspf.net/Why?s=mfrom;id=harald@alvestrand.no;ip=50.223.129.194;r=<UNKNOWN>
> >       (in reply to RCPT TO command)
> 
> ___________________________________________________________
> Tools-discuss mailing list - Tools-discuss@ietf.org
> This list is for discussion, not for action requests or bug reports.
> * Report datatracker and mailarchive bugs to: datatracker-project@ietf.org
> * Report tools.ietf.org bugs to: webmaster@tools.ietf.org
> * Report all other bugs or issues to: ietf-action@ietf.org
> List info (including how to Unsubscribe): https://www.ietf.org/mailman/listinfo/tools-discuss

-- 
kivinen@iki.fi