[Techtalk] Munging and Wrapping Testing Summary

Terry tech at futurecourse.com
Wed Aug 5 18:18:15 UTC 2015


I'd like to thank everyone who participated in our rather unscientific
study and responded to all the "This is test #542" messages.  I'd also
like to thank our friends over at systers.org for sharing their experiences.

We looked at two things:

1. Affect on user experience/MUA/Webmail behavior when
replying/displaying/viewing mail from a list with the "Munge From" and
"Wrap Message" DMARC compliance options in Mailman compared to the usual
way our lists have worked (From: header is poster's address).

2. Tested delivery to DMARC compliant servers.

Volunteer addresses included these domains:

1.  Yahoo.com - DMARC policy "reject", DMARC compliant servers
2.  Gmail.com - DMARC policy "none", DMARC compliant servers
3.  A couple of domains with no DMARC policy and no DMARC compliant servers.
4.  Compuserve.com[1] - No DMARC TXT record but DMARC compliant servers.
 This is a special case.

Here's a summary of what we've found out so far.  We'll post all the
gory details to the web site soon.

- Technically, Mailman worked flawlessly no matter which option was
chosen. :) Hooray for Mailman!

- Rewriting (munging) the From: header offers the least change in user
experience (replying, viewing and display), with some minor settings
changes for Mutt.

- Wrapping the poster's message as a message/rfc822 sub-part in a MIME
format outer message changed the user experience the most, depending in
part on the MUA.  All headers were included in any reply, not a good
thing since that then exposes the poster's email address in the archives
for public lists.  It also broke threading for some MUAs.  Some found
the messages annoying to read.

- Delivery worked as expected with both methods - no bouncing by DMARC
compliant mailservers[1].

Conclusion - Munging good (as far as it can be).  Wrapping bad.

So the only question that remains is whether we apply it to all messages
or selectively.  Mailman recommends applying it selectively.  If we
apply it to all messages, we break some RFCs all of the time but are
DMARC compliant all of the time.  If we apply it selectively, we break
some RFCs occasionally but are still DMARC compliant all of the time for
servers that are DMARC compliant.

We'll leave the test list in place for the next couple of days in case
anyone wants to test other MUAs.

Well done everyone!

-- 
Terry

[1] We discovered that AOL, which owns Compuserve, violates RFC7489.
RFC7489 states that "The domain in the RFC5322.From field is extracted
as the domain to be evaluated by DMARC." Mailman follows RFC7489 and
does not rewrite or wrap messages from a compuserve.com address because
compuserve.com has no DMARC TXT record. AOL then rejects mail from
compuserve.com. If AOL were in strict compliance with the RFC it would
not reject that mail since there is no DMARC TXT record in the
compuserve.com DNS records. Compuserve was bought by AOL and apparently
uses its own method to reject mail from compuserve.com addresses.

I finally found a place to report this to AOL so it's been reported.
Whether they take action or even respond remains to be seen.



More information about the Techtalk mailing list