On 2018-09-13 at 10:45 +0100, Clare via Mailman-Users wrote: > For the time being I've set this address to be moderated. I'm not always > able to deal with moderation queue promptly so is there something I can do > to catch these messages before they get through?
Are you checking SPF? Ideally, a) the domain of your member publishes a SPF policy. b) this policy is a FAIL one (ie. -all) c) your members don't send emails violating their SPF policy (eg. because it is malformed) d) your mail server is checking SPF and rejecting spoofed emails Then spoofed emails would be rejected before being delivered to mailman. You may find that (b) is missing, that the domain is using a weaker SPF policy, like SOFTFAIL, and at the same time you may not want to reject anything with "just" a softfail. In this case, depending on how it is logged (eg. authentication-results header), you can probably set a mailman rule to filter the softfails for that domain at this mailman list. OTOH if they fail points (a) or (c) I feel it's ok to held their messages for moderation until they (their provider) provides a proper SPF policy allowing to tell legit and spoofed messages apart. Best regards ------------------------------------------------------ Mailman-Users mailing list Mailman-Users@python.org https://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: https://mail.python.org/mailman/options/mailman-users/archive%40jab.org
