Re: Mailing list SPF Failure

[William Herrin <bill () herrin us>]

On Thu, May 16, 2024 at 12:03 PM John Levine <johnl () iecc com> wrote:
> It appears that Michael Thomas <mike () mtcc com> said:
> > Since probably 99% of the mail from NANOG is through this list, it
> > hardly matters since SPF will always fail.
>
> Sorry, but no. A mailing list puts its own envelope return address on
> the message so with a reasonable SPF record, SPF will normally
> succeed.

Exactly. SPF acts on the -envelope- sender. That means the one
presented in the SMTP From:<> command. For mail from nanog, that's:
nanog-bounces+address () nanog org, regardless of what the sender's
header From address is.

The message content (including the message headers) is theoretically
not used for SPF validation. In practice, some SPF validators don't
have direct access to the SMTP session so they rely on the SMTP
session placing the envelope sender in the Return-path header.

Regards,
Bill Herrin



-- 
William Herrin
bill () herrin us
https://bill.herrin.us/