Re: Bounce action notifications - NANOG mailing list changes yahoo.com users

[Steve Atkins <steve () blighty com>]

On Oct 10, 2014, at 9:21 AM, Royce Williams <royce () techsolvency com> wrote:

> On Fri, Oct 10, 2014 at 7:31 AM, Steve Atkins <steve () blighty com> wrote:
> > If your domain publishes p=reject it should not have any users
> > that participate in mailing lists.
>
> Like many, I was pretty unhappy (and busy) with the unilateral changes
> made by Yahoo and AOL.  But this understandable stance may change.
> Neither of these domains is known for being heavily saturated with
> geeks.  If Gmail started using p=reject, that might shake the tree a
> little more.
>
> But other than providing more warning, what would have been a better
> way to start eliminating forged senders?  Everything I've read
> indicates that both Yahoo and AOL did this with eyes wide open.
>
> Assuming that eliminating forged senders is the end goal, maybe
> forcing the issue was the only way to move forward?  What other theory
> about their motivation makes sense?

I'm fairly sure that their motivation wasn't anything like that clearly
thought through - but their motivation doesn't really matter.

Mailing list operators are stuck in the middle, and they have three
reasonable choices. One is to rework their mail systems to selectively
(or unselectively) replace the From: field. That's a lot of work, and
makes the mailing list less usable for all users.

(There's discussion in the DMARC IETF groups about redefining
5322 so as to put what is currently in the Sender: field into the
From: field and creating a new field, that wouldn't be visible to
the user, to contain what is currently in the From: field).

Another is to be very, very careful about not breaking DKIM
signatures on list mail. That's difficult because the
things you have to do or not do change depending on how the
submitted mail is signed (and Yahoo in particular have made
some signing choices that make it particularly hard).

The third option is to reject submissions from domains that publish
p=reject (or, probably, p=quarantine), pushing the customer support
costs onto those who are publishing p=reject records for users
that participate in mailing lists.

Cheers,
  Steve