On Fri November 11 2022 08:14:12 Slávek Banko wrote:
in connection with the fact that problems with
delivery posts to Gmail have
recently increased, we set up on the mail server signing with DKIM. This
is now used if the message is created on the server (for example, for
confirm subscription to ML) or for mails, where the sender's address is
replaced (or example, due to non-useful SPF) - see emails with sender in
form: "<user> via tde-users" <users(a)trinitydesktop.org>rg>.
Now the question arises: Do we want to force the replacing the sender's
address for all cases so that all outgoing posts can be signed using our
DKIM key? What is your opinion?
I had this problem with GMail (and Yahoo and others) on some lists I run.
I found SPF+DMARC was sufficient to get list posts to GMail. SPF+DMARC
fixed all problems except one - Yahoo users couldn't see posts from other
Yahoo users. However IIRC there were only two Yahoo users and they both
switched to GMail.
I believe it is sufficient that SPF matches on the SENDER domain and
doesn't need to match the FROM domain. For example this post will
probably end up with something like the following headers:
Return-Path: <users-bounces(a)trinitydesktop.org>
From: Mike Bird <mgb-trinity(a)yosemite.net>
We were testing DKIM but it was complicated with mailing lists so when
SPF+DMARC 99% solved the problem we decided not to deploy DKIM (yet).
I would suggest that you announce SPF and DMARC for
trinitydesktop.org.
You can copy/adapt our TXT records as a starting point if you wish.
You might also want to do a Google Site Verification. I no longer
remember the details but I believe it was useful when we were working
on our own mailing list problems:
https://support.google.com/webmasters/answer/9008080?hl=en
One other thing we tried was setting up a new mail server with no bad
history. That did not work. It is much harder to get the big players
to accept mail from a new server than it used to be.
--Mike