Dave Nathanson via Mailman-Users writes:

 > I'm familiar with Mailman v2 at DreamHost, and now setting up &
 > learning Mailman v3 with Affinity at EMWD.com (EMWD is looking good
 > so far, review coming later).

For reliable answers, any questions about Affinity (and the EMWD
proprietary archive application Empathy) must be directed to EMWD.
They are proprietary, closed source products we have no special access
to.

That said, Mark seems to have missed that we don't have a Munge From
option other than DMARC Mitigation Action, so probably Affinity is
just exposing the same options that Postorius does,  I will present
the same information he did, but organized differently assuming that
is true.

 > I have set up everything I can think of to try for good delivery;
 > SPF, DKIM, DMARC, and a SSL certificate on the server.

You should also configure ARC (RFC 8617).  This is a protocol that
most of the big sites participate in that allow a domain to testify to
the original authentication results of received mail that is sent back
out to the Internet after alteration.  The most common MTA plugin is
openarc.

It is best if SPF, DKIM, and ARC are implemented in your MTA.  ARC is
less common, and can be enabled (with some tiny risk that your MTA
will mess it up somehow) in Mailman 3 itself.  The configuration is
done in mailman.cfg in the [ARC] section.  (See Python's
site-packages/mailman/config/schema.cfg for the ARC variables.  You
can use all the same crypto settings as for DKIM.)

 > My discussion group lists all work best with any reply being sent
 > to the list, not to the poster directly. And it is helpful to
 > somehow indicate who wrote the message.

Mailman 3 puts the original display name in From's display name if
available.  IIRC if it's a "naked" address, it uses that.  That
*should* be sufficient, except a lot of MUA's prefer to show the MUA's
*contact list* display name corresponding to the From *address*.
Nothing we can do about that.  Also, the original From will appear in
CC when From is munged for DMARC, but Reply-To is not.

 > The Munging options I see are: 
 >   No Munging
 >   Reply goes to list
 >   Explicit Reply-To header set
 >   Explicit Reply-To header set, no CC added.

It looks like this is just exposing the core Mailman 3 Reply-To
Munging option via Affinity.  It has nothing to do with From munging.

 > And there are some similar DMARC Mitigations.

These are the ones that do From munging.  If they also just expose the
corresponding Mailman 3 core option, you should see:

- No munging
- Replace From: with list address
- Wrap message          # Probably won't work for your users.
- Reject                # Don't use.  These two are just a GTFO from
- Discard               # the Mailman developers to Yahoo and AOL.

There should also be a "DMARC Mitigate Unconditionally" option, and a
"DMARC Addresses" option.

 > Anyway, are we still doing Munging with MailMan v3 with Affinity?
 > >> What is the v3 best setting for handling the From address?

We recommend:

- Reply-To munging:                   No Munging
- DMARC Mitigation Action:            Munge From
- DMARC Mitigate Unconditionally:     No
- DMARC Addresses:                    ^.*@gmail\.com$

"Mitigate Unconditionally: Yes" is appropriate only if users are
vociferously complaining that people at strict DMARC domains get
munged but others don't, or you're seeing lots of bounces for posters
at random small domains that appear to be "stealth DMARC" sites.

"DMARC Addresses" should contain at least "^.*@gmail\.com" to handle
"stealth DMARC" at large sites.  That is, when sites tell the world
*not* to reject mail from them that fails domain authentication, then
reject it themselves.  Gmail is known to do this, it's the only major
that does as far as I know.

If you want to strongly encourage replies to the list, you have to
accept some compromises because MUAs handle the default reply behavior
poorly and inconsistently across MUAs.  We prioritize ease of reply:
When you have Reply-To munging enabled, we put the author's name there
(instead of CC) on the assumption that the list has naive users who
expect "Reply" to do the right thing.  On the other hand they would be
confused if they had to use "Reply All" to fetch the author's address
from CC to reply personally (and probably would broadcast the reply to
a bunch of addresses not intended).  We don't do both because
historically some MUAs would put both in the addressee list in case of
"Reply All", and some MTAs would proceed to send multiple copies.

Steve


-- 
GNU Mailman consultant (installation, migration, customization)
Sirius Open Source    https://www.siriusopensource.com/
Software systems consulting in Europe, North America, and Japan
------------------------------------------------------
Mailman-Users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/mailman-users.python.org/
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: https://www.mail-archive.com/[email protected]/
    https://mail.python.org/archives/list/[email protected]/
Member address: [email protected]

Reply via email to