Slashdot Mirror
Yahoo DMARC Implementation Breaks Most Mailing Lists
pdclarry writes: "On April 8, Yahoo implemented a new DMARC policy that essentially bars any Yahoo user from accessing mailing lists hosted anywhere except on Yahoo and Google. While Yahoo is the initiator, it also affects Comcast, AT&T, Rogers, SBCGlobal, and several other ISPs. Internet Engineering Council expert John R. Levine, a specialist in email infrastructure and spam filtering, said, 'Yahoo breaks every mailing list in the world including the IETF's' on the Internet Engineering Task Force (IETF) list.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a two-year-old proposed standard previously discussed on Slashdot that is intended to curb email abuse, including spoofing and phishing. Unfortunately, as implemented by Yahoo, it claims most mailing list users as collateral damage. Messages posted to mailing lists (including listserv, mailman, majordomo, etc) by Yahoo subscribers are blocked when the list forwards them to other Yahoo (and other participating ISPs) subscribers. List members not using Yahoo or its partners are not affected and will receive posts from Yahoo users. Posts from non-Yahoo users are delivered to Yahoo members. So essentially those suffering the most are Yahoo's (and Comcast's, and AT&T's, etc) own customers. The Hacker News has details about why DMARC has this effect on mailing lists. Their best proposed solution is to ban Yahoo email users from mailing lists and encourage them to switch to other ISPs. Unfortunately, it isn't just Yahoo, although they are getting the most attention."
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a two-year-old proposed standard previously discussed on Slashdot that is intended to curb email abuse, including spoofing and phishing. Unfortunately, as implemented by Yahoo, it claims most mailing list users as collateral damage. Messages posted to mailing lists (including listserv, mailman, majordomo, etc) by Yahoo subscribers are blocked when the list forwards them to other Yahoo (and other participating ISPs) subscribers. List members not using Yahoo or its partners are not affected and will receive posts from Yahoo users. Posts from non-Yahoo users are delivered to Yahoo members. So essentially those suffering the most are Yahoo's (and Comcast's, and AT&T's, etc) own customers. The Hacker News has details about why DMARC has this effect on mailing lists. Their best proposed solution is to ban Yahoo email users from mailing lists and encourage them to switch to other ISPs. Unfortunately, it isn't just Yahoo, although they are getting the most attention."
I mean, other than as a BS mail account.
DMARC and SMTP at Yahoo, mail broken.
Anything that improves security at Yahoo Mail is a good thing.
With the 'new' (sucky) web client -- I've started to move away from Yahoo. Bad news: Not gone yet. Biggest problem: Getting my old email messages out. (Need them for several reasons -- including legal)
Time to move out of Yahoo... (adding another buzz kill!)
Just Yahoo being Yahoo. Nothing new.
Just for convenience, to make the site readable again, and without those popups showing up:
http://www.slashdot.org?nobeta=1
Implementing SPF can also do the same thing, the issue is that mailing lists don't rewrite the from headers so despite having been forwarded through the mailing list server the original sender is still shown in the headers, only the mailing list server isnt really supposed to be sending mail *from* other people's addresses...
So either you allow mail to come from anywhere with any sender address, which lets mailing lists and email forwarding work fine but also makes spoofed spam very easy...
Or you don't, and break the above...
Really legit mailing lists should be rewriting the sender headers to reflect that the mail has been redelivered by the mailing list, the only difficulty this would cause is when users try to reply directly to messages rather than forwarding their replies to the list itself.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
It looks to be blocking relayed email, from a domain that it shouldn't originate from. I would think that is what we would want... mail can't come from one domain and claim to be from another. If this is the case, shouldn't the mailing list actually rewrite that it comes from the domain of originating mailing list? Because it is essentially coming from the mailing list
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Anything that helps isolate Yahoo from currently uninfected sectors is good by me. If I never see that virulent purple abomination again it'll be too soon.
More ammunition for the members of various online communities I participate in for switching to some stupid forum...
Use IMAP.
$subj.
In your quest to 'revitalize' your user-base by throwing out the loyal veterans, you pissed off people who have been members since eGroups and OneList by throwing that purple-abomination Neo web-interface at them... but still they refused to go away, they just relied more heavily on their 90's-style mail clients for access.
This strikes at the heart of that persistence. I do believe you've found a way to get rid of your remaining loyalists. Well done.
One of my clients was using their yahoo email address as the sender for emails that were generated on their site as a result of actions, which included ecommerce receipts, contact receipts, etc. As of yesterday, emails sent to gmail and yahoo accounts started bouncing. I figured out very quickly that the problem was DMARC and a new policy at Yahoo. So, I ended up having to change all receipts to come from an address at my domain. That, of course, created new problems. What a horrible mess for us all to clean up.
Back when the Internet Mail Consortium was a thing, we established best common practices for mailing lists, and most of them were vehemently against mailing list servers rewriting mail headers. Some popular MLM software rewrites standard headers, which breaks DMARC SPF implementations.
The thing to do here is to fix the MLM software to use the correct additional headers, rather than rewriting the headers the DMARC policy feels are important; in addition, this would allow the DMARC policy to "whitelist" based on the attached headers, assuming everything else wasn't a black mark, and avoid the "greylisting" that would happen ordinarily with most SPAM filtering systems in "medium posture" rather than "low posture" (i.e. the ones that have the concept of "suspect email" as a middle ground).
The idea that this "breaks all the IETF mailing lists" is basically alarmist BS - the IETF mailing lists are run on an individual basis, they aren't all hosted on a single machine out there, which is why they have varying degrees of SPAM and signal/noise ratios. So to claim that e.g. Namedroppers (the IETF DNS Working Group) mailing list server is impacted the same way the one Levin is all upset about is, is disingenuous.
No offense, but I find this attitude is rife in America these days:
"Oh,yeah. Yahoo are not as bad. Well. They are the same as Google and MS etc. at this this and this. They're all the same really"
They're not the same. I use Yahoo. It's that slightly worse aspect that makes me use them. Fine lines. Hushmail is the best to use I think but like you say they're all burner addresses really. But what's your reliable and dependable address? Your own domain? Not all of us have that luxury.
Also, I almost always find this attitude whenever the EU does something positive - they're really no better than the US at that.
The thing to do here is to fix the MLM software to use the correct additional headers, rather than rewriting the headers the DMARC policy feels are important; in addition, this would allow the DMARC policy to "whitelist" based on the attached headers, assuming everything else wasn't a black mark, and avoid the "greylisting" that would happen ordinarily with most SPAM filtering systems in "medium posture" rather than "low posture" (i.e. the ones that have the concept of "suspect email" as a middle ground).
I think you will find that most MLM software uses correct additional headers. At least listserv and mailman (for the lists that I manage) do. We've been playing nicely with ISPs for years on our lists, we create no spam (once we fixed the bounceback spam problem 3 years ago) and generally are among the more well-behaved email users around. The problem is that Yahoo's implementation of DMARC is not using the additional headers. All it looks at is From.
No commercial entity interested in getting paid for service they provide would ever intentionally act in such an arrogantly unacceptable manner yet freebie services making money off ads and selling your data to the highest bidder have demonstrated they have little reservation when it comes to doing whatever they want without regard for their users. Close a service when you feel bored, change something you know will cause mass breakage.. never a way to contact a human or work a sales rep. Putting up with this shit is not free or in any way worth while.
I used to have one Yahoo email account that I used regularly but that I gradually gave up on over the last twenty-plus years. It was trouble with Yahoo's overly aggressive email filters made me shift to a combination of my own domain for personal mail and a gmail account for commercial email. Now the Yahoo mail account gets used for things only slightly more important than those I use mailinator for, and I am seriously considering abandoning it entirely.
But what is worse is that lately I have noticed that mail from my own domain (hosted on its own ip) to my wife's Yahoo mail address gets trapped in their system for days and is eventually, even though we typically exchange a half dozen or so emails a day; are in each others' address books, etc. I've checked my mail server logs and the mail headers thoroughly--the problem is on Yahoo's end.
My conclusions from this: Yahoo's mail-spam engineers are completely incompetent, and the change at the top hasn't fixed what is driving users away from the Yahoo. But more importantly email is seriously broken--and we engineers need to work on an alternative encrypted and authenticated version of mail to replace email as we know it.
n/t
Yet another Yahoo SNAFU. The seem very intent on killing their own company.
I think you will find that most MLM software uses correct additional headers. At least listserv and mailman (for the lists that I manage) do. We've been playing nicely with ISPs for years on our lists, we create no spam (once we fixed the bounceback spam problem 3 years ago) and generally are among the more well-behaved email users around. The problem is that Yahoo's implementation of DMARC is not using the additional headers. All it looks at is From.
Not a problem, if you leave the "From:" line the hell alone, and only add new headers, per RFC 5322, and RFC 2919, etc.. It can look at the From line all it wants, and as far as it's concerned, as long as the rest of the headers are unadulterated, your list server is an intermediate relay server in the SMTP routing path.
..leads me to have sympathy for Yahoo. Over a decade ago, I was partly in charge of maintaining the mailing lists at the IETF Secretariat - so I remember what volume of email they were working with in 2001, and I would never want to manage a mailing list that big again (certainly not in 2014). In hind-sight it wasn't so bad then, I recall about 47,800 messages in 4 days @ roughly 85% spam for the whole IETF mailing list, but that was in 2001. We had to implement anti-spam filters for lists of people with very strong opinions regarding censorship, and rightly so - but present yourself with the thought of handling filters for the "Anti-Spam Research Group" mailing list. ..bweheheh .. heh ..pwfff. useless. Spam quickly discovered it could spam more easily through the anti-spam email list. ..so many penis pills.
.".
..but it's been 10 years, and so far email hasn't totally collapsed. Time will tell.
I believe it just isn't possible to fix the spam problem in email as it currently exists. All is not lost, because auxiliary communications (phonecalls, texting, Twitter, Dropbox, Facebook, Skype, etc) are better suited for specific types of communication and are self-partitioning. Email is often just as boring and disappointing as physical mail - mostly advertising junk. Because it is based on physical mail, we can't really complain - it's doing exactly what we designed it to do.
The digital world treats bots and brains the same. Captcha was useful for a little while, but seems to be meaningless these days. These days, if I have a form that's getting spammed I use interactive JavaScript operations (mostly option selections) to create the html form and omit a submit-typed button. That way it takes a real person looking at the page to figure out where the "send" action is.
Fundamentally, the problem with the current SMTP infrastructure is that it is based on Recipient-liability without any real Sender-liability. It is the recipient's responsibility to have some gargantuan "put junk here" box instead of a reasonably-small tray for other's to say: "I have something for you, encrypted with this secret key, find it on my server here __
That would handle the storage penalty (the message is waiting in their outbox or application, sent to your inbox only when you choose to accept it). If the message is SO important, and you're REALLY who you say you are, then I can get back to you when I want to read/download your message - making the sender easier to authenticate. And both parties would know when the message has been received, or if the message has been read before the intended recipient chose to accept it.
I just received a private communication from the moderator of a Google Group. He says that mail from Yahoo members is being blocked by Comcast and Yahoo. Now that it's Google's ox being gored perhaps something will be done about it.
seriously drop all mail incoming and outgoing to/from yahoo groups. Put them out of business instantly.