[Mailman-Users] AOL rejecting connections from mailman servers for DMARC Munging.

[Ted Hatfield]

On Wed, 24 Aug 2016, Mark Sapiro wrote:

> On 08/23/2016 03:55 PM, Ted Hatfield wrote:
>>
>> Few mails from IP xxx.xxx.xxx.xx were getting rejected from one of
>> filters as Reply-to address is same as the TO address. This is caused as
>> one of our filters triggered these emails as spam. I have added
>> protection for your IP. As a good mailing practice, please use a
>> different email address for your reply-to address.
>
>
> Don't munge Reply-To: ;)
>
>
>> It seems to me that since dmarc munging adds the senders address to the
>> reply-to header, if a user receives a copy of their own postings this is
>> the result.
>
>
> No. Based on AOL's reply above, this has nothing to do with DMARC. If
> you set reply_goes_to_list to This list (note that Poster is the
> /strongly/ recommended setting) both the To: and Reply-To: headers of
> outgoing messages will contain the list address.
>
> However, it seems that this means AOL will not accept mail from any list
> with reply_goes_to_list = This list, and since this is a common,
> although not recommended, configuration, if this is the case, it seems
> there should be much more reports of this issue, and I haven't seen that.
>
>
>> Can anyone else confirm that this has happened to them and if so what
>> else can someone do except to wrap the message from senders that
>> implement dmarc rejection as in dmarc_moderation_action?
>
>
> Even if this is a DMARC issue, Wrap message won't change it because the
> headers in the wrapper will be the same as those in a Munge from message.
>
>
>> Is there a recommended policy regarding this issue?
>
>
> Set reply_goes_to_list to Poster
>
> --

I'm running mailman version 2.1.22.

reply_goes_to_list is set to poster

from_is_list is set to "Munge From".

Documentation describes "Munge From" to be

"This action replaces the poster's address in the From: header with the 
list's posting address and adds the poster's address to the addresses in 
the original Reply-To: header."


This means that messages with a munged From: header should pass dmarc 
checks but the senders address will be added to the reply-to header.  Does 
this not mean that the Reply-To: and the To: address will be the same for 
some users?

Ted Hatfield