[SAC] [OSGeo] #2750: mail aliases fail anti-spoof measures

[Jeff McKenna]

I believe the SAC mailing list settings were not yet updated to "Munge 
From" as was requested for all lists (see the long discussion at 
https://trac.osgeo.org/osgeo/ticket/2475 ). I have now also updated the 
SAC mailing list settings to follow that as well.

-jeff



-- 
Jeff McKenna
GatewayGeo: Developers of MS4W, MapServer Consulting and Training
co-founder of FOSS4G
http://gatewaygeo.com/




On 2022-04-28 12:08 p.m., Javier Jimenez Shaw wrote:
> I was getting also strange emails from gdal and proj mailing lists... 
> and now I do not get them any more.
> My personal email (from may domain) is redirecting the emails to my 
> gmail account.
> 
> The emails sent by lists.osgeo.org <http://lists.osgeo.org> have a big 
> yellow banner that says
> "Gmail could not verify that it actually came from lists.osgeo.org 
> <http://lists.osgeo.org>. Avoid clicking links, downloading attachments 
> or replying with personal information."
> 
> In the headers I can see
> 
> ARC-Authentication-Results: i=1;mx.google.com  <http://mx.google.com>;
>         spf=fail (google.com  <http://google.com>: domain ofgdal-dev-bounces at lists.osgeo.org  <mailto:gdal-dev-bounces at lists.osgeo.org>  does not designate 134.....204 as permitted sender)
> 
> This is happening since March 24th
> The thing is that it is only happening with those lists (gdal-dev and 
> proj).
> 
> With sac mailing list it has no problem (apparently). The header is a 
> bit different
> 
> ARC-Authentication-Results: i=1;mx.google.com  <http://mx.google.com>;
>         dkim=pass (test mode) header.i=@osgeo.org  <http://osgeo.org>  header.s=mail header.b=c0FiFf0V;
>         dkim=neutral (body hash did not verify) header.i=@osgeo.org  <http://osgeo.org>  header.s=mail header.b=AfjBJ1Hn;
>         spf=fail (google.com  <http://google.com>: domain ofsac-bounces at lists.osgeo.org  <mailto:sac-bounces at lists.osgeo.org>  does not designate 134......204 as permitted sender)
> 
> 
> What is the difference?
> 
> Thanks
> .___ ._ ..._ .. . ._.  .___ .. __ . _. . __..  ... .... ._ .__
> Entre dos pensamientos racionales
> hay infinitos pensamientos irracionales.
> 
> 
> 
> On Tue, 26 Apr 2022 at 16:19, OSGeo <trac_osgeo at osgeo.org 
> <mailto:trac_osgeo at osgeo.org>> wrote:
> 
>     #2750: mail aliases fail anti-spoof measures
>     ---------------------------+----------------------------------------
>       Reporter:  strk           |       Owner:  sac@…
>           Type:  task           |      Status:  new
>       Priority:  normal         |   Milestone:  Sysadmin Contract 2022-II
>     Component:  Systems Admin  |  Resolution:
>       Keywords:                 |
>     ---------------------------+----------------------------------------
> 
>     Comment (by robe):
> 
>       Replying to [comment:7 strk]:
>       > Right, all mails to mantra alias come with failing SPF,
>       > like this:
>       >
>       > {{{
>       > Received-SPF: softfail (spool2: transitioning domain of
>     education.gouv.fr <http://education.gouv.fr> does not designate
>     140.211.15.3 as permitted sender)
>       > }}}
>       >
>       > Evidently OSGeo Postfix will NOT drop these emails, so
>       > we still receive them
> 
>       But we should not be all receiving them.  GMail should drop when OSGeo
>       tries to send to me spoofing you?  I thought we have at least one
>     gmail.com <http://gmail.com> account on mantra still.  I know Jay
>     complained and he had a
>       gmail account but I always got his emails to my knowledge and he was
>       getting mantra emails, just being rejected when sending to gmail
>     accounts
>       sometimes.  Anyway I think I have a gmail only account lying around
>       somewhere, I'll test before and after I make some changes.
> 
>     -- 
>     Ticket URL: <https://trac.osgeo.org/osgeo/ticket/2750#comment:10
>     <https://trac.osgeo.org/osgeo/ticket/2750#comment:10>>
>     OSGeo <https://osgeo.org/ <https://osgeo.org/>>
>     OSGeo committee and general foundation issue tracker.
>     _______________________________________________
>     Sac mailing list
>     Sac at lists.osgeo.org <mailto:Sac at lists.osgeo.org>
>     https://lists.osgeo.org/mailman/listinfo/sac
>     <https://lists.osgeo.org/mailman/listinfo/sac>
> 
> 
> _______________________________________________
> Sac mailing list
> Sac at lists.osgeo.org
> https://lists.osgeo.org/mailman/listinfo/sac