openSUSE admin

pjessen wrote:

I keep receiving massive amounts of mails from opensuse lists into my
spam folder.

Unable to reproduce :-)

IOW, I don't see any massive amounts of mail from opensuse lists being marked as spam. I might have a rule that whitelists based on SPF though.

That DMARC is failing totally is not a surprise given the fact that
opensuse mailinglists change the envelope from and does modifications to
the body somehow.

Hmm, the envelope from has to change when we resend from mailman, and the envelope is also not included in the DKIM signature (@ suse.com).

That is what makes SPF unaligned and has nothing to do with DKIM.

Two, I am pretty certain we keep the mail body pristine, it was one of the things we changed very early on, stop adding list instructions to the mail.

So someone breaks it for sure.
According to the header mx2.infra.opensuse.org still sees it valid:
X-Spam-Checker-Version: SpamAssassin 3.4.5 (2021-03-20) on
mx2.infra.opensuse.org
X-Spam-Level:
X-Spam-Status: No, score=-1.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
DKIM_VALID_AU,NICE_REPLY_A,RCVD_IN_MSPIKE_H2,T_SCC_BODY_TEXT_LINE
autolearn=disabled version=3.4.5
but my rspamd and dkimverify say it's failing verification.

But all that being said:
Any comment about ARC?

pjessen wrote:

That is what makes SPF unaligned and has nothing to do with DKIM.

I don't understand why there should why be an SPF issue. Mails sent from mailman3 have a something@lists.o.o envelope, mails are relayed via anna and elsa, and the SPF for lists.o.o corresponds.

Please lookup what DMARC does and what "alignment" means. SPF does not fail in itself. The DMARC SPF alignment check fails.

So someone breaks it for sure.
According to the header mx2.infra.opensuse.org still sees it valid:

Then it is happening after the mail has left our systems, but that leaves only your own ds9.rosenauer.org ?

How come? mx2.infra.opensuse.org is what receives the mail. Afterwards it still goes through mailman. anna does not add any verification headers.

wrosenauer wrote:

So someone breaks it for sure.
According to the header mx2.infra.opensuse.org still sees it valid:

Then it is happening after the mail has left our systems, but that leaves only your own ds9.rosenauer.org ?

How come? mx2.infra.opensuse.org is what receives the mail. Afterwards it still goes through mailman. anna does not add any verification headers.

Ah, I thought you were talking about the tail end of the process, i.e. delivery to opensuse members.
For list mail, this is the process :

sender -> mx[12].opensuse.org -> lists.opensuse.org (mm3) -> anna/elsa -> recipient , optionally sometimes -> mx[12].opensuse.org -> recipient

mx12 and anna/elsa are definitely only relays and do not touch the body. mailman3 re-distributes, but also should not be touching the body.

Please lookup what DMARC does and what "alignment" means. SPF does not fail in itself. The DMARC SPF alignment check fails.

Okay, so it's about the non-mandatory From: header and the envelope from. Well, if that is an issue, it has surely always been an issue.

Mails redistributed by mailman will always have :

Envelope (Return-Path) = listname-bounces@lists.o.o and From: <whatever@some.domain>.

I wonder if the suse.com DMARC policy was recently changed?

Before I go away on summer hols, let me add one or two short remarks -

a) because I don't experience the issue described myself, and because no one else has reported any similar issue, I am reluctant to point to our setup and say we have a problem we need to fix.
b) I'm guessing your rspamd setup is a bit more strict than most, which is perhaps why you are seeing this issue.
c) Seeing as only list mails are affected, maybe a simple whitelisting of lists.opensuse.org would suffice ?

Having said all that, if anyone fancies working on $SUBJ, I have no issue with that.

pjessen wrote:

a) because I don't experience the issue described myself, and because no one else has reported any similar issue, I am reluctant to point to our setup and say we have a problem we need to fix.
b) I'm guessing your rspamd setup is a bit more strict than most, which is perhaps why you are seeing this issue.

If you are using rspamd than I'm happy to check why you are not facing issues.
The main thing which has an impact on the spam classification is that I have the following actions defined for DMARC failure:
quarantine = "add_header";
reject = "add_header";

Incorporating DMARC into a spamfilter policy is certainly not too strict.

c) Seeing as only list mails are affected, maybe a simple whitelisting of lists.opensuse.org would suffice ?

Sure only list mails are affected since they are modifying the mail sufficiently to break DMARC.
Possibly. But everything you said on a) I could repeat here for myself.

Please note that I'm asking if ARC could be implemented. This in itself is a very useful and recommended extension and not at all just for me.