Change to Mail Infrastructure - SPF and DKIM verification will now be enforced

[Martin Graesslin]

On Tuesday, December 8, 2015 9:51:50 AM CET Martin Graesslin wrote:
> On Tuesday, December 8, 2015 8:21:03 PM CET Ben Cooksley wrote:
> > On Tue, Dec 8, 2015 at 2:19 AM, Martin Graesslin <mgraesslin at kde.org> 
wrote:
> > > On Friday, December 4, 2015 11:28:03 AM CET Jan Kundrát wrote:
> > >> On Friday, 4 December 2015 10:56:42 CET, Ben Cooksley wrote:
> > >> > Note that in the long run with DMARC looming you will need to switch
> > >> > to #2 anyway, and keeping your current behaviour will likely lead to
> > >> > mail from people who use Yahoo / AOL / etc ending up in the spam
> > >> > folder with many mailing list members. I'll be starting a discussion
> > >> > regarding taking this step on KDE systems at some point in the near
> > >> > future (switching to DMARC compatible policies).
> > >> > 
> > >> > For more information, please see http://wiki.list.org/DEV/DMARC
> > >> 
> > >> Do I understand your plan correctly? The following projects appear to
> > >> not
> > >> re-sign their ML traffic, and they mangle headers at the same time. If
> > >> I
> > >> understand your plan correctly, this means that I won't be able to use
> > >> my
> > >> @kde.org addresses on mailing lists of these projects, for example:
> > >> 
> > >> - Qt,
> > >> - Debian,
> > >> - Gentoo,
> > >> - OpenStack,
> > >> - anything hosted at SourceForge,
> > >> - and many, many more, essentially anybody who were ignoring DKIM.
> > >> 
> > >> Please, change your plans, this is obviously a huge no-go.
> > > 
> > > this looks like a huge problem. Could this be rolled out in two phases:
> > > one
> > > where a big fat warning is added in some way, so that we can inform our
> > > mailing list masters about the breakage and then a slow enforcement?
> > 
> > You can examine the "Authentication-Results" header from any mail that
> > passes through kde.org mail infrastructure to determine if it is
> > valid.
> 
> Checking the non-KDE mailing lists I'm subscribed to:
> 
> * EWMH mailing list (hosted on GNOME infrastructure):
> 
> Authentication-Results: postbox.kde.org; dkim=fail
> 	reason="verification failed; unprotected key"
> 	header.d=gmail.com header.i=@gmail.com header.b=qL4yX1lm;
> 	dkim-adsp=none (unprotected policy); dkim-atps=neutral
> 
> * wayland: no such header

Correction: Wayland is also affected. I didn't check a gmail mail. So given 
that all freedesktop.org are probably affected.

Sorry Ben, that's just a no, it will be highly disruptive to KDE to turn us 
off from these mailing lists.

Cheers
Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: This is a digitally signed message part.
URL: <http://mail.kde.org/pipermail/kde-core-devel/attachments/20151208/ea8227a2/attachment.sig>