After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 796602 - mailman, DKIM-Signature: r=y nd RFC 6651
mailman, DKIM-Signature: r=y nd RFC 6651
Status: RESOLVED FIXED
Product: sysadmin
Classification: Infrastructure
Component: Mailman
unspecified
Other All
: Normal normal
: ---
Assigned To: GNOME Sysadmins
GNOME Sysadmins
Depends on:
Blocks:
 
 
Reported: 2018-06-16 16:18 UTC by Дилян Палаузов
Modified: 2018-06-19 10:52 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Дилян Палаузов 2018-06-16 16:18:52 UTC
This email https://mail.gnome.org/archives/gtk-list/2018-June/msg00010.html  contains the header

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=aegee.org; s=k4096;
        t=1529047876; i=dkim+MSA-tls@aegee.org; r=y;
        bh=LSwu01GbKpQBGU5sZBpHMKytHBsYGlUq2+VKJnnHrSE=;
        h=Subject:From:To:Date;
        b=Z7nXt5dC...

The message was signed before mailman added terminating
_______________________________________________
gtk-list mailing list
gtk-list@gnome.org
https://mail.gnome.org/mailman/listinfo/gtk-list

so the signature is invalid.

Due to RFC6651, r=y in DKIM-Signature, and the value of DNS TXT _report._domainkey.aegee.org, after sending the email I two reports about failed DKIM-Signatures were generated.

Please either:
- remove r=y from DKIM-Signature on email arriving mailman/gnome, 
- remove all DKIM-Signatures, if they are going to be invalidated by mailman,
- instruct mailman not to modify the distributed messages (hence remove the bottom banner), or
- change the domain at From:
  * put @..gnome.org as from, move the original From: as Sender, or
  * put @..gnome.org as from, move the From address in the display-part
  * substitute the sender with some random  address in @...gmail.com , and ensure that all emails to that address are forwarded to the original sender (Listserv does so).

There is enough material on the topic about mailing lists, I think there is even a RFC describing the possible approaches.  The current configuration is no-go, as it leads to generating false positive feedback-reports.
Comment 1 Andrea Veri 2018-06-19 10:46:05 UTC
Thanks for your report, this should be fixed. I made sure the same policy we apply for quarantine and reject also gets applied to p=none to avoid generating reports.
Comment 2 Дилян Палаузов 2018-06-19 10:47:49 UTC
What is the policy for quarantine and reject?
Comment 3 Andrea Veri 2018-06-19 10:52:10 UTC
It's set to be "Munge from" [1].

[1] https://wiki.list.org/DEV/DMARC