[OpenIndiana-discuss] "Discussion list for OpenIndiana"

[Discussion list for OpenIndiana]

In regard to: Re: [OpenIndiana-discuss] "Discussion list for OpenIndiana",...:

> sender at yahoo.com posts to the list.  The mailing list package forwards
> the post to all the subscribers. Everyone on the list EXCEPT the
> subscribers using yahoo.com will see the post.  yahoo.com will reject
> the message as a forgery, so no one using yahoo.com will see the
> message.  It's not clear to me if user at yahoo.com will be unsubscribed
> because of the bounces or just sender at yahoo.com.  It seems likely that a
> malicious person could unsubscribe all yahoo users from a list by
> creating a yahoo account and posting to the list a bunch of times.

The part you missed is that other domains that honor DMARC, which includes
at least Google and AOL, will *also* reject mail from sender at yahoo.  This
bounce comes back to the list bounce address or list owner, and if the
mailing list software is configured so that N bounces = dropped from the
list, then the recipient at google.com will *also* be dropped.

Basically, any user *receiving* email at a domain that honors DMARC will
generate a bounce whenever a yahoo or AOL user (or any domain with
p=reject for DMARC) sends mail to the list.  That's why several of the
recommendations from experts have been to not allow yahoo & AOL users
to *post* to the list.  They can receive just fine; it's the "poison"
nature of their posts, because of the p=reject, that causes problems
for *all* DMARC-enabled recipients.

Tim

> --------------------------------------------
> On Thu, 5/15/14, Discussion list for OpenIndiana <openindiana-discuss at openindiana.org> wrote:
>
> Subject: Re: [OpenIndiana-discuss] "Discussion list for OpenIndiana"
> To: openindiana-discuss at openindiana.org
> Date: Thursday, May 15, 2014, 1:56 PM
>
> Sorry, but you misread: I
> am asking about other *mailing lists*.
>
> They, the *mailing lists*, are receiving email
> from @Yahoo users.
>
> How?
>
> On 15/05/2014 19:17, Discussion list for
> OpenIndiana wrote:
> > user at yahoo.com
> doesn't get any posts from other yahoo users.  After
> a
> > certain number of bounced emails, 
> sender at yahoo.com
> gets
> > automatically removed from the
> mailing list.
>
> _______________________________________________
> openindiana-discuss mailing list
> openindiana-discuss at openindiana.org
> http://openindiana.org/mailman/listinfo/openindiana-discuss
>
>
> _______________________________________________
> openindiana-discuss mailing list
> openindiana-discuss at openindiana.org
> http://openindiana.org/mailman/listinfo/openindiana-discuss
>

-- 
Tim Mooney                                             Tim.Mooney at ndsu.edu
Enterprise Computing & Infrastructure                  701-231-1076 (Voice)
Room 242-J6, Quentin Burdick Building                  701-231-8541 (Fax)
North Dakota State University, Fargo, ND 58105-5164