[SAC] [OSGeo] #2750: mail aliases fail anti-spoof measures

[Javier Jimenez Shaw]

I was getting also strange emails from gdal and proj mailing lists... and
now I do not get them any more.
My personal email (from may domain) is redirecting the emails to my gmail
account.

The emails sent by lists.osgeo.org have a big yellow banner that says
"Gmail could not verify that it actually came from lists.osgeo.org. Avoid
clicking links, downloading attachments or replying with personal
information."

In the headers I can see

ARC-Authentication-Results: i=1; mx.google.com;
       spf=fail (google.com: domain of
gdal-dev-bounces at lists.osgeo.org does not designate 134.....204 as
permitted sender)

This is happening since March 24th
The thing is that it is only happening with those lists (gdal-dev and
proj).

With sac mailing list it has no problem (apparently). The header is a bit
different

ARC-Authentication-Results: i=1; mx.google.com;
       dkim=pass (test mode) header.i=@osgeo.org header.s=mail
header.b=c0FiFf0V;
       dkim=neutral (body hash did not verify) header.i=@osgeo.org
header.s=mail header.b=AfjBJ1Hn;
       spf=fail (google.com: domain of sac-bounces at lists.osgeo.org
does not designate 134......204 as permitted sender)


What is the difference?

Thanks
.___ ._ ..._ .. . ._.  .___ .. __ . _. . __..  ... .... ._ .__
Entre dos pensamientos racionales
hay infinitos pensamientos irracionales.



On Tue, 26 Apr 2022 at 16:19, OSGeo <trac_osgeo at osgeo.org> wrote:

> #2750: mail aliases fail anti-spoof measures
> ---------------------------+----------------------------------------
>  Reporter:  strk           |       Owner:  sac@…
>      Type:  task           |      Status:  new
>  Priority:  normal         |   Milestone:  Sysadmin Contract 2022-II
> Component:  Systems Admin  |  Resolution:
>  Keywords:                 |
> ---------------------------+----------------------------------------
>
> Comment (by robe):
>
>  Replying to [comment:7 strk]:
>  > Right, all mails to mantra alias come with failing SPF,
>  > like this:
>  >
>  > {{{
>  > Received-SPF: softfail (spool2: transitioning domain of
>  education.gouv.fr does not designate 140.211.15.3 as permitted sender)
>  > }}}
>  >
>  > Evidently OSGeo Postfix will NOT drop these emails, so
>  > we still receive them
>
>  But we should not be all receiving them.  GMail should drop when OSGeo
>  tries to send to me spoofing you?  I thought we have at least one
>  gmail.com account on mantra still.  I know Jay complained and he had a
>  gmail account but I always got his emails to my knowledge and he was
>  getting mantra emails, just being rejected when sending to gmail accounts
>  sometimes.  Anyway I think I have a gmail only account lying around
>  somewhere, I'll test before and after I make some changes.
>
> --
> Ticket URL: <https://trac.osgeo.org/osgeo/ticket/2750#comment:10>
> OSGeo <https://osgeo.org/>
> OSGeo committee and general foundation issue tracker.
> _______________________________________________
> Sac mailing list
> Sac at lists.osgeo.org
> https://lists.osgeo.org/mailman/listinfo/sac
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osgeo.org/pipermail/sac/attachments/20220428/d0ccb1d9/attachment.html>