On 9/8/26 2:35 PM, Bill Cole wrote:
On 2026-09-08 at 13:58:39 UTC-0400 (Tue, 8 Sep 2026 13:58:39 -0400)
Matt Corallo <[email protected]>
is rumored to have said:
Apologies, I've attached a sample.
OK, so this isn't so much tricking SA as it is an apparently real Apple Developer using the
TestFlight system to invite random(?) targets.
Yea, phishing of some form, not that I'd install that app to find out.
Is 'e22dde6c-9a31-60ae-64d0-5e2ff84a6b79' a specifically real local address, does it match some
general pattern that you accept, or is mattcorallo.com a "catch-all" that accepts any local address?
Are all the messages to the same UUID-like localpart or do they vary?
Seemingly random UUID-like localparts. They get accepted but should bounce to a spam box no one
looks at...except for the DEF_*_WL tags that make it actually get seen.
I'm only asking because it points at one possible *practical* solution for you: make your catch-all
more discerning.
Yea, I just disabled the DEF_*_WL for matching To headers. Easy enough, I just figured you might
want to... v
As a fix of the SA-side issue, I'm revising the default welcomelist entries for Apple. The only real
excuse they could have is if you have in fact subscribed to TestFlight invites in a general way, but
as they've never offered that to me in decades of being a paid-up Mac developer, I assume that you
did not do so.
I am, technically, but that email doesn't exist in any form anywhere on the web. No apple account
(on that domain at all!), nor registered for anything, ever.
Also, the mail lacks any way for you to tell the mail handler (Apple) to stop and
that's generally unacceptable. If I were a lawyer I might even argue that this is in violation of US
law (CAN-SPAM) because it only lets you unsub from the one developer's mail. Even if you had
specifically subscribed that address to TestFlight invites generally, the lack of an unsub *from
TestFlight mail generally* is enough for me to kill the whitelisting.
FWIW there is a "report a problem" link, though it requires signing in to an (unrelated) apple
account to do so, which I believe still fails CAN-SPAM.
Matt
On 9/8/26 1:39 PM, Bill Cole wrote:
On 2026-09-08 at 13:32:33 UTC-0400 (Tue, 8 Sep 2026 13:32:33 -0400)
Matt Corallo <[email protected]>
is rumored to have said:
It seems people are now spamming testflight invites at random and bypassing SA due to the combo
of the DKIM_WL and SPF_WL for mail from [email protected].
It would help if we could see concrete examples. There are multiple def_welcomelist_auth entries
relevant to Apple in the default rules and it would help to know precisely how they are using
"[email protected]" in a way that seems properly authenticated to SA.
