Subject: best practices for dealing with DMARC fallout on IETF lists

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 23 Sep 2014 21:34:41 -0400 (EDT)

Hi all,

We had mailman disable several subscriptions to the kitten list recently,
due to what appears to be DMARC fallout.

Are there best practices for what the WG chairs should do in response, in
terms of notifying those addresses which were dropped, or pestering the
IETF mailman administrators to upgrade to the latest version which does
not break DMARC, or some other action(s)?

Thanks,

Ben

---

From: Eliot Lear <[email-masked]>
Date: Wed, 24 Sep 2014 06:31:32 +0200

Did mailman report this so that you know when they fell off?

Eliot

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 24 Sep 2014 00:36:11 -0400 (EDT)

> Did mailman report this so that you know when they fell off?

Yes; I got a bunch of reports Monday night with the addresses whose
subscriptions were disabled, and what appear to be the original bounce
messages (which I have not spent too much time trying to decipher).

-Ben

---

From: Eliot Lear <[email-masked]>
Date: Wed, 24 Sep 2014 06:50:57 +0200

To answer your question as to whether there are best practices, not that
I am aware.  Here's at least a start at a suggested approach, if it helps.

 1. Reinstate the individuals immediately;
 2. Inform them of the problem, including when they were disabled;
 3. Provide an explanation as to why it happened; and
 4. Point them at the mail archive.

Others?

Also, another tools question: do we know if the disabled subscribers'
other subscriptions were impacted?

Eliot

---

From: Michael Richardson <[email-masked]>
Date: Wed, 24 Sep 2014 09:53:04 -0400

> Others?

Unless I misunderstood, the people who were kicked off were kicked off
because their MTA processed the p=reject, and acted accordingly.  Those
subscribers were not at fault, nor was their MTA.  The problem was with other
subscribers who sent email from a p=reject, and those are the ones that
should be removed.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Derek Atkins <[email-masked]>
Date: Wed, 24 Sep 2014 10:22:23 -0400

> subscribers who sent email from a p=reject, and those are the ones that

Which means everyone with a yahoo.com address, among others.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Yoav Nir <[email-masked]>
Date: Wed, 24 Sep 2014 17:50:59 +0300

> Which means everyone with a yahoo.com address, among others.

Also Paypal.

I use gmail, so those messages are not rejected (at least yet), but they do go in the spam folder.

Can’t we stop the mechanism that kicks out people after we get a few rejections from them?  Or at least make it more forgiving (like requiring a lot of rejections or no non-rejections over a long enough period of time)?

Yoav

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 24 Sep 2014 21:35:18 -0400 (EDT)

On Wed, 24 Sep 2014, Yoav Nir wrote:

>
>
> Can't we stop the mechanism that kicks out people after we get a few
> rejections from them?  Or at least make it more forgiving (like
> requiring a lot of rejections or no non-rejections over a long enough
> period of time)?

My understanding is that mailman 2.1.18 (released early May 2014) includes
features for handling DMARC fallout.

We appear to be running 2.1.15 for the IETF mailman instance, according to
the footer on the admin pages.

-Ben

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 25 Sep 2014 13:46:43 +1200

You can tune the bounce processing from the mailman admin page;
the tab is called "Bounce processing" ;-)

I've just applied these settings to a particular list:

Bounce score threshold 20.0 (user is less likely to be disabled)
Bounce info stale after 1  (bounce history is reset after 1 day)
You are disabled warnings 100 (user is highly unlikely to be auto-deleted)

That will, I hope, diminish the problem. But people who
bounce when they see p=reject should be advised not to do
that (gmail doesn't, but it does quarantine which is already
a problem) and people who publish p=reject should be advised
strongly not to do that, if they wish to join IETF lists with
the present version of mailman.

Unfortunately there's no option to fake the sender if and only
if the sender's domain publishes p=reject. That would be nice.

Regards
   Brian

On 25/09/2014 02:50, Yoav Nir wrote:
> ------------------------------------------------------------------------
> 
> _______________________________________________
> BOFChairs mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/bofchairs

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 24 Sep 2014 23:40:02 -0400 (EDT)

> Bounce info stale after 1  (bounce history is reset after 1 day)

Thanks for pointing this out.  I dropped down the "bounce info stale"
value for kitten, which will in all likelihood prevent future issues for
us.

> You are disabled warnings 100 (user is highly unlikely to be auto-deleted)

This setting (and the related description text) seems to say that mailman
itself will be notifying members that their subscription is disabled.  So,
perhaps it is not necessary for the WG chairs to send additional
notification?  Perhaps it still is, though, as we can include dates and
the link to the archives.

> if the sender's domain publishes p=reject. That would be nice.

I really think that this is a question for the people who maintain the
mailman deployment for the IETF.  Among other things, upgrading the
mailman version could be considered.  Unfortunately, I don't know who that
is -- I was hoping that someone on this list would mention the appropriate
contact as a side effect of this thread, so I didn't have to explicitly go
looking.

-Ben

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 25 Sep 2014 15:59:23 -0400 (EDT)

> contact as a side effect of this thread, so I didn't have to explicitly go

It seems like this is just ietf-action, so I made [www.ietf.org/rt
#69178].

Basically, the status seems to be "they're looking into options", so we
should wait and see.

-Ben

---

From: Derek Atkins <[email-masked]>
Date: Sun, 28 Sep 2014 18:43:53 -0400

Brian,

> if the sender's domain publishes p=reject. That would be nice.

I believe that mailman 2.1.18 (and higher) does have such a feature.

-derek