Dear Google Mail Team

Re:Dear Google Mail Team by mike_hearn on Saturday July 18, 2015 @08:46AM (#9907410)

You only have to rewrite headers if your mailing list is actually modifying the mails i.e. doing a MITM attack on the mail flow. Some mailing list admins feel very strongly about footers, subject line tags etc and then claim they "must" rewrite the From header, but I am not sure it's technically required.

[ Parent | on HN ]

Re:Dear Google Mail Team by massaman_yams on Saturday July 18, 2015 @02:13PM (#9908344)

Discussion groups retransmit messages, which is enough to fail authentication in a lot of cases.

Here's an example: you have an address @google.com, which has a DMARC policy of 'quarantine'. You send a message from this address to a discussion group, which in the process, resends your message from a non-google server, thus failing DMARC.

Google's DMARC policy says that if an ISP receives a message from a @google.com From address and the message fails DMARC, that ISP should place the message in the spam folder.

So it boils down to: does a list operator change the From address in distribution group mail to use a list address they own in order to pass DMARC, or do you deal with the filtering consequences of failing DMARC for many domains?

[ Parent | on HN ]

Re:Dear Google Mail Team by mike_hearn on Sunday July 19, 2015 @01:41PM (#9912019)

The whole point of DKIM is that messages can be relayed without breaking authentication, because it uses digital signatures instead of sending IP. So I think it wouldn't break

[ Parent | on HN ]

Re:Dear Google Mail Team by massaman_yams on Wednesday July 22, 2015 @01:46PM (#9931130)

... IF the body is not modified, and the header signature matches, AND headers retain DMARC alignment... the reality is that retransmittal (as opposed to just relaying) almost always does one or more of these.

Here's an example from a Google email engineer's recent post to the Mailop list, which is running Mailman software.

Authentication-Results: mx.google.com; spf=neutral (google.com: 2001:41c8:51:83:feff:ff:fe00:a0b is neither permitted nor denied by best guess record for domain of [email protected]) [email protected]; dkim=neutral (body hash did not verify) [email protected]; dmarc=fail (p=REJECT dis=NONE) header.from=google.com

[ Parent | on HN ]

Re:Dear Google Mail Team by mike_hearn on Friday July 24, 2015 @10:59AM (#9942422)

That message says the body was modified. The solution is simple: don't do that. Your original message said DKIM breaks if you simply relay mail, but it isn't correct.

[ Parent | on HN ]