[Mailman-Users] Assistance with altering reply-to behaviours and DMARC

[Will Yardley]

On Fri, Aug 28, 2015 at 01:37:18PM +0900, Stephen J. Turnbull wrote:
> Mark writes:
>  > First, apologies if this has been discussed before.  I run a number
>  > of mailman lists on a Centos 6 platform and mailman 2.1.12-25. This
>  > version was updated in July as follows:
>  > https://rhn.redhat.com/errata/RHSA-2015-1417.html and included
>  > fixes for a number of DMARC issues.  Including "... With this
>  > update, domains with a "reject" DMARC policy are recognized
>  > correctly.."
> 
> Stock Mailman 2.1.12 doesn't do any DMARC detection.  This is quite
> bizarre that they would backport such a feature rather than update to
> 2.1.18-1 or later.  Mailman 2.1 is hardly an unstable package.

That's the way most "stable" Linux distributions do it. I think it has a
lot to do with keeping the complex web of interdependencies in check,
but probably also has to do with keeping features predictable. Even with
security issues, generally, they go to quite a bit of work to backport
things, rather than change versions.

Not sure about 6, but the specific way they backported the changes for
the DMARC patch on EL5 had to do partially with dependencies... either
the fact that the normal version didn't depend on dnspython and this one
did, or the version of dnspython required wasn't available in EL5 (looks
like they actually ended up vendoring dnspython inside the Mailman
package).

Folks who want more up to date versions tend to either jump major
releases more often, use third party repos, rebuild RPMs from upstream,
or just build from source. We use the vendor provided Mailman package,
and for the most part, it works for us, though in cases like this, it is
problematic.

w