Dave Nathanson via Mailman-Users writes: > I'm familiar with Mailman v2 at DreamHost, and now setting up & > learning Mailman v3 with Affinity at EMWD.com (EMWD is looking good > so far, review coming later).
For reliable answers, any questions about Affinity (and the EMWD proprietary archive application Empathy) must be directed to EMWD. They are proprietary, closed source products we have no special access to. That said, Mark seems to have missed that we don't have a Munge From option other than DMARC Mitigation Action, so probably Affinity is just exposing the same options that Postorius does, I will present the same information he did, but organized differently assuming that is true. > I have set up everything I can think of to try for good delivery; > SPF, DKIM, DMARC, and a SSL certificate on the server. You should also configure ARC (RFC 8617). This is a protocol that most of the big sites participate in that allow a domain to testify to the original authentication results of received mail that is sent back out to the Internet after alteration. The most common MTA plugin is openarc. It is best if SPF, DKIM, and ARC are implemented in your MTA. ARC is less common, and can be enabled (with some tiny risk that your MTA will mess it up somehow) in Mailman 3 itself. The configuration is done in mailman.cfg in the [ARC] section. (See Python's site-packages/mailman/config/schema.cfg for the ARC variables. You can use all the same crypto settings as for DKIM.) > My discussion group lists all work best with any reply being sent > to the list, not to the poster directly. And it is helpful to > somehow indicate who wrote the message. Mailman 3 puts the original display name in From's display name if available. IIRC if it's a "naked" address, it uses that. That *should* be sufficient, except a lot of MUA's prefer to show the MUA's *contact list* display name corresponding to the From *address*. Nothing we can do about that. Also, the original From will appear in CC when From is munged for DMARC, but Reply-To is not. > The Munging options I see are: > No Munging > Reply goes to list > Explicit Reply-To header set > Explicit Reply-To header set, no CC added. It looks like this is just exposing the core Mailman 3 Reply-To Munging option via Affinity. It has nothing to do with From munging. > And there are some similar DMARC Mitigations. These are the ones that do From munging. If they also just expose the corresponding Mailman 3 core option, you should see: - No munging - Replace From: with list address - Wrap message # Probably won't work for your users. - Reject # Don't use. These two are just a GTFO from - Discard # the Mailman developers to Yahoo and AOL. There should also be a "DMARC Mitigate Unconditionally" option, and a "DMARC Addresses" option. > Anyway, are we still doing Munging with MailMan v3 with Affinity? > >> What is the v3 best setting for handling the From address? We recommend: - Reply-To munging: No Munging - DMARC Mitigation Action: Munge From - DMARC Mitigate Unconditionally: No - DMARC Addresses: ^.*@gmail\.com$ "Mitigate Unconditionally: Yes" is appropriate only if users are vociferously complaining that people at strict DMARC domains get munged but others don't, or you're seeing lots of bounces for posters at random small domains that appear to be "stealth DMARC" sites. "DMARC Addresses" should contain at least "^.*@gmail\.com" to handle "stealth DMARC" at large sites. That is, when sites tell the world *not* to reject mail from them that fails domain authentication, then reject it themselves. Gmail is known to do this, it's the only major that does as far as I know. If you want to strongly encourage replies to the list, you have to accept some compromises because MUAs handle the default reply behavior poorly and inconsistently across MUAs. We prioritize ease of reply: When you have Reply-To munging enabled, we put the author's name there (instead of CC) on the assumption that the list has naive users who expect "Reply" to do the right thing. On the other hand they would be confused if they had to use "Reply All" to fetch the author's address from CC to reply personally (and probably would broadcast the reply to a bunch of addresses not intended). We don't do both because historically some MUAs would put both in the addressee list in case of "Reply All", and some MTAs would proceed to send multiple copies. Steve -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan ------------------------------------------------------ Mailman-Users mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3/lists/mailman-users.python.org/ Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: https://www.mail-archive.com/[email protected]/ https://mail.python.org/archives/list/[email protected]/ Member address: [email protected]
