Change to Mail Infrastructure - SPF and DKIM verification will now be enforced

[Rolf Eike Beer]

Am Freitag, 4. Dezember 2015, 16:14:10 schrieb Nicolás Alvarez:
> 2015-12-04 16:07 GMT-03:00 Rolf Eike Beer <kde at opensource.sf-tec.de>:
> > Ben Cooksley wrote:
> >> It is an extreme pity these mailing list providers have demonstrated
> >> such an extreme disregard for standards which aim to eliminate
> >> forgeries and ensure people cannot be digitally misrepresented. This
> >> is why we had to change Bugzilla a while back to send as
> >> bugzilla_noreply at kde.org instead of the acting user's email address -
> >> because Yahoo's enforcement policy meant GMail always placed mail from
> >> Yahoo users in the spam folder.
> > 
> > Huh? Of course you _must_ send with a @kde.org address. My SPF policy
> > forbids you to send mail for my domain. And now you want to enforce SPF,
> > but don't properly handle it yourself?
> 
> How would that work with mailing lists? I would receive your message
> with From: pointing at the mailing list address instead of your own?

There are 2 "From" addresses. One is the one in the message body, i.e. what 
your mail program shows as "From:". This must not be altered.

The other one is the one used between the mail servers. This can change during 
mail delivery. The last version you can see in the "Return-Path" header of 
your mail. Looking at any mail delivered to you through this list shows:

Return-Path: <kde-core-devel-bounces at kde.org>

This address should be set to a list-specific one by every mailinglist. SPF is 
only one part of the problem, the other one is that a delivery failure from 
the mailing list will end up at the original poster, not the mailing list bot.

Greetings,

Eike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part.
URL: <http://mail.kde.org/pipermail/kde-core-devel/attachments/20151204/703a56cd/attachment.sig>