Slashdot Mirror
Yahoo DMARC Implementation Breaks Most Mailing Lists
pdclarry writes: "On April 8, Yahoo implemented a new DMARC policy that essentially bars any Yahoo user from accessing mailing lists hosted anywhere except on Yahoo and Google. While Yahoo is the initiator, it also affects Comcast, AT&T, Rogers, SBCGlobal, and several other ISPs. Internet Engineering Council expert John R. Levine, a specialist in email infrastructure and spam filtering, said, 'Yahoo breaks every mailing list in the world including the IETF's' on the Internet Engineering Task Force (IETF) list.
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a two-year-old proposed standard previously discussed on Slashdot that is intended to curb email abuse, including spoofing and phishing. Unfortunately, as implemented by Yahoo, it claims most mailing list users as collateral damage. Messages posted to mailing lists (including listserv, mailman, majordomo, etc) by Yahoo subscribers are blocked when the list forwards them to other Yahoo (and other participating ISPs) subscribers. List members not using Yahoo or its partners are not affected and will receive posts from Yahoo users. Posts from non-Yahoo users are delivered to Yahoo members. So essentially those suffering the most are Yahoo's (and Comcast's, and AT&T's, etc) own customers. The Hacker News has details about why DMARC has this effect on mailing lists. Their best proposed solution is to ban Yahoo email users from mailing lists and encourage them to switch to other ISPs. Unfortunately, it isn't just Yahoo, although they are getting the most attention."
DMARC (Domain-based Message Authentication, Reporting & Conformance) is a two-year-old proposed standard previously discussed on Slashdot that is intended to curb email abuse, including spoofing and phishing. Unfortunately, as implemented by Yahoo, it claims most mailing list users as collateral damage. Messages posted to mailing lists (including listserv, mailman, majordomo, etc) by Yahoo subscribers are blocked when the list forwards them to other Yahoo (and other participating ISPs) subscribers. List members not using Yahoo or its partners are not affected and will receive posts from Yahoo users. Posts from non-Yahoo users are delivered to Yahoo members. So essentially those suffering the most are Yahoo's (and Comcast's, and AT&T's, etc) own customers. The Hacker News has details about why DMARC has this effect on mailing lists. Their best proposed solution is to ban Yahoo email users from mailing lists and encourage them to switch to other ISPs. Unfortunately, it isn't just Yahoo, although they are getting the most attention."
DMARC and SMTP at Yahoo, mail broken.
With the 'new' (sucky) web client -- I've started to move away from Yahoo. Bad news: Not gone yet. Biggest problem: Getting my old email messages out. (Need them for several reasons -- including legal)
Time to move out of Yahoo... (adding another buzz kill!)
Implementing SPF can also do the same thing, the issue is that mailing lists don't rewrite the from headers so despite having been forwarded through the mailing list server the original sender is still shown in the headers, only the mailing list server isnt really supposed to be sending mail *from* other people's addresses...
So either you allow mail to come from anywhere with any sender address, which lets mailing lists and email forwarding work fine but also makes spoofed spam very easy...
Or you don't, and break the above...
Really legit mailing lists should be rewriting the sender headers to reflect that the mail has been redelivered by the mailing list, the only difficulty this would cause is when users try to reply directly to messages rather than forwarding their replies to the list itself.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
It looks to be blocking relayed email, from a domain that it shouldn't originate from. I would think that is what we would want... mail can't come from one domain and claim to be from another. If this is the case, shouldn't the mailing list actually rewrite that it comes from the domain of originating mailing list? Because it is essentially coming from the mailing list
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
What the fuck? Since when is Yahoo an ISP?
A lot of people use Yahoo's shitty webmail but only because they are too brain dead to use a real email client sending/receiving email via their ISP's servers.
Although I have to admit, i do like the idea of banning anyone who uses Yahoo mail.
I really hate how everything forces you to use text messages. I do not want text messaging and refuse to add it to my contract. If someone has something important to talk to me about, well, they already have my phone number.
Microsoft does the same for Hotmail/Live/Outlook. They claim suspicious use of your account was detected, and that to return access to you, you must change password, with a supplied phone number for secondary account control.
Bullshit. I had this happen across 5 MS hosted mail accounts in the same week - each were purpose-specific accounts to legitimately isolate commercial activity.
Google? The bastards try to wheedle your mobile number out of you at every PW change or update. They practically hide the UI to bypass this request.
Needles to say, all three are used only as "burner" addresses, now.
"Flyin' in just a sweet place,
Never been known to fail..."
Anything that helps isolate Yahoo from currently uninfected sectors is good by me. If I never see that virulent purple abomination again it'll be too soon.
[conspiracy theory]
It's probably an easy way to connect email with phone numbers to help email message to phone message matching algorithms at the NSA.
[/conspiracy theory]
What the #%^+? Since when is Yahoo an ISP?
Several ISPs outsource their customer email service to Yahoo. If you're with one of those, and especially if you use your ISP provided email address, then moving would fix it (or just move to gmail/outlook.com/whatever, you're mail is in the cloud now anyway, since your ISP moved it there)
More ammunition for the members of various online communities I participate in for switching to some stupid forum...
That's a useful side benefit. They correlate for commercial purposes. Selling out to Fed TLA is one such commercial purpose.
"Flyin' in just a sweet place,
Never been known to fail..."
So far --- most solutions require yahoo+ (I don't want to pay yahoo to leave yahoo!)
Found a way to connect to gmail, but that has issue (gmail doesn't sort right)
Might need to break down and pay to get my data.
In your quest to 'revitalize' your user-base by throwing out the loyal veterans, you pissed off people who have been members since eGroups and OneList by throwing that purple-abomination Neo web-interface at them... but still they refused to go away, they just relied more heavily on their 90's-style mail clients for access.
This strikes at the heart of that persistence. I do believe you've found a way to get rid of your remaining loyalists. Well done.
I don't know if they still do, but AT&T DSL customers used Yahoo mail as recently as last year.
-- Sent from a computer.
Well, this improves security at Yahoo mail by making people stop using Yahoo mail.
That works, I guess...
Back when the Internet Mail Consortium was a thing, we established best common practices for mailing lists, and most of them were vehemently against mailing list servers rewriting mail headers. Some popular MLM software rewrites standard headers, which breaks DMARC SPF implementations.
The thing to do here is to fix the MLM software to use the correct additional headers, rather than rewriting the headers the DMARC policy feels are important; in addition, this would allow the DMARC policy to "whitelist" based on the attached headers, assuming everything else wasn't a black mark, and avoid the "greylisting" that would happen ordinarily with most SPAM filtering systems in "medium posture" rather than "low posture" (i.e. the ones that have the concept of "suspect email" as a middle ground).
The idea that this "breaks all the IETF mailing lists" is basically alarmist BS - the IETF mailing lists are run on an individual basis, they aren't all hosted on a single machine out there, which is why they have varying degrees of SPAM and signal/noise ratios. So to claim that e.g. Namedroppers (the IETF DNS Working Group) mailing list server is impacted the same way the one Levin is all upset about is, is disingenuous.
On the other hand, I would be almost 100% happy if I didn't have the voice part of my smartphone.
The thing to do here is to fix the MLM software to use the correct additional headers, rather than rewriting the headers the DMARC policy feels are important; in addition, this would allow the DMARC policy to "whitelist" based on the attached headers, assuming everything else wasn't a black mark, and avoid the "greylisting" that would happen ordinarily with most SPAM filtering systems in "medium posture" rather than "low posture" (i.e. the ones that have the concept of "suspect email" as a middle ground).
I think you will find that most MLM software uses correct additional headers. At least listserv and mailman (for the lists that I manage) do. We've been playing nicely with ISPs for years on our lists, we create no spam (once we fixed the bounceback spam problem 3 years ago) and generally are among the more well-behaved email users around. The problem is that Yahoo's implementation of DMARC is not using the additional headers. All it looks at is From.
n/t
Right, for example Microsoft would never push unpopular changes on users of their expensive operating system.
This is just yahoo being yahoo, always hard at work finding new ways to shoot themselves in the foot.
This space intentionally left blank
Yet another Yahoo SNAFU. The seem very intent on killing their own company.
I think you will find that most MLM software uses correct additional headers. At least listserv and mailman (for the lists that I manage) do. We've been playing nicely with ISPs for years on our lists, we create no spam (once we fixed the bounceback spam problem 3 years ago) and generally are among the more well-behaved email users around. The problem is that Yahoo's implementation of DMARC is not using the additional headers. All it looks at is From.
Not a problem, if you leave the "From:" line the hell alone, and only add new headers, per RFC 5322, and RFC 2919, etc.. It can look at the From line all it wants, and as far as it's concerned, as long as the rest of the headers are unadulterated, your list server is an intermediate relay server in the SMTP routing path.
..leads me to have sympathy for Yahoo. Over a decade ago, I was partly in charge of maintaining the mailing lists at the IETF Secretariat - so I remember what volume of email they were working with in 2001, and I would never want to manage a mailing list that big again (certainly not in 2014). In hind-sight it wasn't so bad then, I recall about 47,800 messages in 4 days @ roughly 85% spam for the whole IETF mailing list, but that was in 2001. We had to implement anti-spam filters for lists of people with very strong opinions regarding censorship, and rightly so - but present yourself with the thought of handling filters for the "Anti-Spam Research Group" mailing list. ..bweheheh .. heh ..pwfff. useless. Spam quickly discovered it could spam more easily through the anti-spam email list. ..so many penis pills.
.".
..but it's been 10 years, and so far email hasn't totally collapsed. Time will tell.
I believe it just isn't possible to fix the spam problem in email as it currently exists. All is not lost, because auxiliary communications (phonecalls, texting, Twitter, Dropbox, Facebook, Skype, etc) are better suited for specific types of communication and are self-partitioning. Email is often just as boring and disappointing as physical mail - mostly advertising junk. Because it is based on physical mail, we can't really complain - it's doing exactly what we designed it to do.
The digital world treats bots and brains the same. Captcha was useful for a little while, but seems to be meaningless these days. These days, if I have a form that's getting spammed I use interactive JavaScript operations (mostly option selections) to create the html form and omit a submit-typed button. That way it takes a real person looking at the page to figure out where the "send" action is.
Fundamentally, the problem with the current SMTP infrastructure is that it is based on Recipient-liability without any real Sender-liability. It is the recipient's responsibility to have some gargantuan "put junk here" box instead of a reasonably-small tray for other's to say: "I have something for you, encrypted with this secret key, find it on my server here __
That would handle the storage penalty (the message is waiting in their outbox or application, sent to your inbox only when you choose to accept it). If the message is SO important, and you're REALLY who you say you are, then I can get back to you when I want to read/download your message - making the sender easier to authenticate. And both parties would know when the message has been received, or if the message has been read before the intended recipient chose to accept it.
I just received a private communication from the moderator of a Google Group. He says that mail from Yahoo members is being blocked by Comcast and Yahoo. Now that it's Google's ox being gored perhaps something will be done about it.
seriously drop all mail incoming and outgoing to/from yahoo groups. Put them out of business instantly.
Hotmail. Worse than Yahoo!. That takes effort.
"Flyin' in just a sweet place,
Never been known to fail..."
But what's your reliable and dependable address?
The truth is, there's no way I want to have just one address. Here's what I use:
1) A very personal address that very few people have, but for close friends and family. I wouldn't even tell you what service I use, let alone accidentally give it out in a public place. I'm super protective of it, it's one that does do notifications on my iPhone, etc., and remarkably is still spam free. To be honest, I even have some family members that don't use it. I told them I was changing my email address and gave them a different one, since they can't stop sending joke chain emails with 200 people in the CC list.
2) A somewhat personal address that I give out to business contacts that aren't work-related (I use my corporate email account for those obviously). Pretty much spam free. It's the one that largely gets the Linkedin invites, the Plaxo spam, etc, but largely hasn't been sold off to spammers.
3) An address I use for websites that I reasonably trust. Amazon. Slashdot. Things that you sign up for once, and then have to opt out of whatever stupid newsletters you get by default. Rarely gets spam.
4) An address I use for websites I reasonably don't trust. Something where I want some content on a site but don't want them to have a way to contact me. Not loaded on a phone or computer, if I need to look for an account activation email, I hit web mail, wade through the incessant spam, find what I need, log back out.
5) Work email. Not much I can do about that. Loaded on my work computer, and on my work provided phone. Gets too much email. Very little spam though, since I use address #3 or #4 when signing up for web sites, even if they are work related.
That said, while it was a little work setting up, it's very easy to manage. Email #1 is checked constantly. #2 and #5 regularly. #3 occasionally, and most stuff is automatically filtered away (Amazon order receipts into a folder, etc). #4 is very popular with viagra sites and porno sites, since it's the address captured by sites that turn around and sell your email.
Amazon isn't likely to sell your email, they'd rather have you all to yourself.
There's other things you can do. If you use Apple products, they make it very easy to hook your phone number and every email address you own (iCloud or otherwise) to iMessage. But you don't have to. If you have multiple addresses, make sure just the private ones are hooked up to iMessage. For SMS, I have my cell published sparingly, most people get my Google Voice number, and those texts are reviewed less frequently.
But, email is broken. For sure. That's a lot of work just because I don't want to buy sugar pills labeled as Viagra from unknown sources and am comfortable in my manhood enough to not need to try to change anything geometrically.
Wow! whoever is moderating needs a sense of humor overhall. This is considered trolling?
The text and data are kinda a necessity.