I wrote:
> "Rudolph T. Maceyko" <rm55@pobox.com> writes:
>> The basic changes since Yahoo implemented their p=reject DMARC policy
>> last year (and others followed) were:
>> * make NO CHANGES to the body of the message--no headers, footers, etc.
>> * make NO CHANGES to the subject header of the message--no more
>> "[Highland Park]"
>> * when mail comes to the list from a domain that uses a p=reject DMARC
>> policy, CHANGE THE FROM HEADER so that it comes from the list.
After further off-list discussion with Rudy, I'm not entirely convinced
by his reasoning for dropping Subject-munging and footer-addition; it
seems like that might be at least in part a limitation of his
mailman-based infrastructure.
The clearly critical thing, though, is that when forwarding a message from
a person at a DMARC-using domain, we would have to replace the From: line
with something @postgresql.org. This is what gets it out from under the
original domain's DMARC policy.
The other stuff Rudy did, including adding the list's own DKIM-Signatures
and publishing DMARC and SPF policy for the list domain, is not
technically necessary (yet) but it makes the list traffic less likely to
get tagged as spam by antispam heuristics. And, as he noted, there are
feedback loops that mean once some traffic gets tagged as spam it becomes
more likely that future traffic will be.
If Rudy's right that Gmail is likely to start using p=reject DMARC policy,
we are going to have to do something about this before that; we have too
many people on gmail. I'm not exactly in love with replacing From:
headers but there may be little alternative. We could do something likeFrom: Persons Real Name
<nobody@postgresql.org>Reply-To:...
so that at least the person's name would still be readable in MUA
displays.
We'd have to figure out whether we want the Reply-To: to be the original
author or the list; as I recall, neither of those are fully satisfactory.
regards, tom lane