LISTSERV Tech Tip: Why do my lists sometimes generate spoofing complaints and what should I do about them?

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><script type="text/javascript" src="/_static/js/bundle-playback.js?v=HxkREWBo" charset="utf-8"></script> <script type="text/javascript" src="/_static/js/wombat.js?v=txqj7nKC" charset="utf-8"></script> <script>window.RufflePlayer=window.RufflePlayer||{};window.RufflePlayer.config={"autoplay":"on","unmuteOverlay":"hidden"};</script> <script type="text/javascript" src="/_static/js/ruffle/ruffle.js"></script> <script type="text/javascript"> __wm.init("http://web.archive.org/web"); __wm.wombat("https://www.lsoft.com/news/techtipLSV-issue2-2022.asp","20230423000021","http://web.archive.org/","web","/_static/", "1682208021"); </script> <link rel="stylesheet" type="text/css" href="/_static/css/banner-styles.css?v=S1zqJCYt" /> <link rel="stylesheet" type="text/css" href="/_static/css/iconochive.css?v=3PDvdIFv" />  <link href="http://web.archive.org/web/20230423000021cs_/https://fonts.googleapis.com/css?family=Montserrat" rel="stylesheet"> <meta name="viewport" content="width=device-width, initial-scale=1.0"/> <meta http-equiv="X-UA-Compatible" content="IE=edge"/> <title>LISTSERV Tech Tip: Why do my lists sometimes generate spoofing complaints and what should I do about them?</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <style type="text/css"> html { width: 100% !important; height: 100% !important; } body, #bodytable { width: 100% !important; height: 100% !important; margin: 0; padding: 0; } body, table, td, p, a, li, blockquote { -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; } table, td { border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; } img { -ms-interpolation-mode: bicubic; } img, a img { border: 0; outline: none; text-decoration: none; } .ReadMsgBody { width: 100%; } .ExternalClass { width: 100%; } .ExternalClass, .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td, .ExternalClass div { line-height: 100%; } @media only screen and (max-width: 680px) { .container { width: 100% !important; } .cell { width: 100% !important; display: block !important; } } </style> <style type="text/css"> p.head { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 20px; color: #333333; font-style: normal; font-weight: bold; text-align: left } p.subhead { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 18px; color: #333333; font-style: italic; font-weight: normal; text-align: left } p.sectionhead { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 18px; color: #333333; font-style: normal; font-weight: bold; text-align: left } p.question { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 18px; color: #333333; font-style: normal; font-weight: bold; text-align: left } p.byline { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 15px; color: #666666; font-style: normal; font-weight: normal; text-align: left } p.body { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 15px; color: #333333; font-style: normal; font-weight: normal; text-align: left } p.body a { color: #3366CC; text-decoration: underline; } li.body { font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 15px; color: #333333; font-style: normal; font-weight: normal; text-align: left; margin-bottom: 20px; } li.body a { color: #3366CC; text-decoration: underline; } img.image-bio { margin: 15px 20px 15px 5px; padding: 0px; float: left } img.image-left { margin: 10px 20px 10px 0px; padding: 0px; float: left; } img.image-right { margin: 0px 10px 10px 20px; padding: 0px; float: right; } img.image-center { margin: 5px 5px 15px 5px; padding: 0px; margin-left: auto; margin-right: auto; } div.tweet { float: right; } hr { height: 1px; color: #EAEAEA; border-style: solid; border-color: #EAEAEA; border-width: 1px 0px 0px 0px; } tt { font-size: 15px; } table.code { width: 100%; max-width: 660px; overflow: auto; background-color: #FAFAFA; border: 1px solid #EAEAEA; } td.code { padding: 10px; } .width-100 { width: 100%; } .cell-left { text-align: left; } .cell-right { text-align: right; } @media only screen and (max-width: 680px) { img.image-left { width: 100%; float: none; margin-left: auto; margin-right: auto; } img.image-right { display: none; } img.image-center { width: 100%; } } @media only screen and (max-width: 550px) { .cell-left { display: block; text-align: left; } .cell-right { display: block; text-align: left; } } </style> </head> <body bgcolor="#FFFFFF" style="background-color: #FFFFFF"> <style type="text/css"> @media only screen and (max-width: 680px) { .container { width: 100% !important; } .cell { width: 100% !important; display: block !important; } } </style> <table border="0" cellpadding="0" cellspacing="0" height="100%" id="bodytable" style="width: 100%; height: 100%; margin: 0px; padding: 0px; min-width: 320px" width="100%"> <tr> <td align="center" bgcolor="#FFFFFF" style="background-color: #FFFFFF; vertical-align: top" valign="top"> <div><br/></div> <table border="0" cellpadding="0" cellspacing="0" class="container" style="border: 1px solid #EAEAEA; width: 680px" width="680"> <tr> <td> <table border="0" cellpadding="0" cellspacing="0" style="width: 100% !important" width="100%"> <tr> <td bgcolor="#FFFFFF" style="background-color: #FFFFFF; padding: 0px"><div><a href="issue2-2022.asp"><img alt="LISTSERV at Work" src="/web/20230423000021im_/https://www.lsoft.com/news/lw/header2019.jpg" style="display: block; height: auto; width: 100%" width="678"/></a></div></td> </tr> </table> <table border="0" cellpadding="0" cellspacing="0" style="width: 100%" width="100%"> <tr> <td bgcolor="#FFFFFF" style="background-color: #FFFFFF"> <table border="0" cellpadding="0" cellspacing="0" style="width: 100% !important" width="100%"> <tr> <td class="cell" style="width: 100%" width="100%"> <table border="0" cellpadding="0" cellspacing="0" style="width: 100% !important" width="100%"> <tr> <td style="padding: 10px 15px 10px 15px"> <table border="0" cellpadding="0" cellspacing="0"> <tr><td style="background-color: #0F40D8; padding: 8px 10px 8px 10px"><div style="font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 15px; color: #FFFFFF; font-style: normal; font-weight: normal; text-align: left"><b>LISTSERV</b> Tech Tip</div></td></tr> </table> <p class="question">Q: Why do my lists sometimes generate spoofing complaints and what should I do about them?</p> <p class="question"></p> <p class="byline">By Jacob Haller<br/>Senior Support Engineer, L-Soft</p> <p class="body">List owners might sometimes see these types of entries about spoofing in their daily error monitoring reports or hear from mail administrators complaining that LISTSERV is spoofing their domain.</p> <tt>550 Rejected by header based Anti-Spoofing policy</tt> <p class="body">Typically, what "spoofing" means in this context is that LISTSERV is distributing mail from a user, with the user's original "From" address intact. LISTSERV does indeed do this, and, in fact, is normally required to do this by email standards (specifically section 3.6.2 of RFC 5322, which specifies that the "From" address must belong to "the author(s) of the message, that is, the mailbox(es) of the person(s) or system(s) responsible for the writing of the message").</p> <p class="body">While it's questionable how appropriate a negative term like "spoofing" is for what LISTSERV does in this situation, you may still get questions about it. Here is some information that can help you investigate and handle these sorts of situations.</p> <p class="sectionhead">DMARC Problems</p> <p class="body">There is a widely supported type of policy that domains can publish called DMARC. This allows the owners of domains to say which mail servers are allowed to send mail from their domains. In this case, "from" specifically refers to the address found in the "From:" header of messages and not to the return path or any other headers.</p> <p class="body">It also says what should happen if mail is received from other mail servers. The three types of DMARC policies are "p=none", meaning that no adverse action should be taken; "p=reject", meaning that the message should be rejected; and "p=quarantine", which means that the message should be treated as suspicious.</p> <p class="body">This means that if LISTSERV distributes a message from an email address whose domain has a "p=reject" or "p=quarantine" DMARC policy, and keeps the original "From:" header intact, then many of the list subscribers' mail servers will probably reject the message, resulting in errors complaining of spoofing and/or DMARC violations. If this happens often enough, you could start seeing subscribers being removed due to the repeated bounces.</p> <p class="body">To avoid this, LISTSERV rewrites the "From:" address of messages coming from domains with a "p=reject" or "p=quarantine" DMARC policy.</p> <p class="body">Additional information about this feature can be found in <a href="http://web.archive.org/web/20230423000021/https://www.lsoft.com/manuals/17.0/advancedtopics/133HowdoesLISTSERVcomplywithDMAR.html" target="_blank">Section 13.3 - How does LISTSERV comply with DMARC</a> in the LISTSERV Advanced Topics Manual.</p> <p class="body">However, in rare cases, a situation could arise where a domain has a DMARC "p=reject" or "p=quarantine" record, but LISTSERV isn't able to find the record for some reason, and therefore doesn't know it should rewrite the address.</p> <p class="body">To see if that's the problem with a particular bouncing message, look at the address of the message's original sender, and check its DMARC policy using an online tool like this one:<br/><a href="http://web.archive.org/web/20230423000021/https://mxtoolbox.com/t/test/networktoolsdevt?command=dmarc" target="_blank">https://mxtoolbox.com/t/test/networktoolsdevt?command=dmarc</a></p> <p class="body">If the domain has a policy, it will typically contain one of "p=none", "p=reject" or "p=quarantine".</p> <p class="body">If it does find a DMARC record, then you can check whether LISTSERV is able to find the same record using the "debug query txt" command described in <br/><a href="http://web.archive.org/web/20230423000021/https://www.lsoft.com/manuals/17.0/advancedtopics/134DebuggingDMARCerrorsinLISTSER.html" target="_blank">Section 13.4 - Debugging DMARC errors in LISTSERV</a> of the Advanced Topics Manual.</p> <p class="body">If it doesn't find the record or reports an incorrect version of it, then contact L-Soft support with the results of your investigation and we will advise on how to proceed.</p> <p class="body">If LISTSERV is seeing the correct DMARC record, then the problem should not be DMARC-related.</p> <p class="sectionhead">Mail Policy Problems</p> <p class="body">In some cases, mail administrators for a domain will institute a policy that they will only accept mail from their own domain if it comes from their own mail servers. Then, whenever someone from that domain posts a message to a mailing list, any subscribers from that domain won't get the message, and instead you'll see the message bouncing for those subscribers.</p> <p class="body">Since LISTSERV is not doing anything wrong here – it is following all applicable standards, as well as common practice – this is best addressed by the domain's administrators. Some ways this can be handled, include:</p> <ul> <li class="body">The domain's mail administrators could change their mail servers' policies so that they accept these types of messages instead of bouncing them.</li> <li class="body">The administrators of the affected domain could change their DMARC record to "p=reject", at which point LISTSERV would start rewriting mail from them, as described above and in <a href="http://web.archive.org/web/20230423000021/https://www.lsoft.com/manuals/17.0/advancedtopics/133HowdoesLISTSERVcomplywithDMAR.html" target="_blank">Section 13.3 - How does LISTSERV comply with DMARC</a> of the Advanced Topics Manual.</li> <li class="body">Subscribers from the affected domain may wish to subscribe using an email address at a domain that doesn't experience this problem.</li> </ul> <br/> <p class="sectionhead">Next Steps</p> <style type="text/css"> .width-100 { width: 100%; } td.circle-left { width: 210px; height: 200px; background-image: url("/web/20230423000021im_/https://www.lsoft.com/images/icon_support.png"); background-repeat: no-repeat; background-position: center; cursor: pointer; } td.circle-middle { width: 210px; height: 200px; background-image: url("/web/20230423000021im_/https://www.lsoft.com/images/icon_sales.png"); background-repeat: no-repeat; background-position: center; cursor: pointer; } td.circle-right { width: 210px; height: 200px; background-image: url("/web/20230423000021im_/https://www.lsoft.com/images/icon_information.png"); background-repeat: no-repeat; background-position: center; cursor: pointer; } div.trigger { font-family: 'Montserrat', sans-serif; color: #FFFFFF; font-size: 18px; font-weight: bold; text-align: center; width: 210px; height: 200px; margin-left: auto; margin-right: auto; } div.spacing { width: 180px; margin-left: auto; margin-right: auto; padding-top: 80px; } div.trigger a { color: #FFFFFF; text-decoration: none; } @media (max-width: 767px) { td.circle-left { width: 100% !important; display: block !important; height: 200px; } td.circle-middle { width: 100% !important; display: block !important; height: 200px; } td.circle-right { width: 100% !important; display: block !important; height: 200px; } } </style> <script type="text/javascript"> function goTo(dot) { if (dot == 1) { window.open('/products/listserv.asp','_blank') } if (dot == 2) { window.open('/resources/techtip.asp?filter=listserv','_blank') } if (dot == 3) { window.open('/contact/econtact.asp?id=sales','_blank') } } </script> <table class="width-100"> <tr> <td class="circle-left" onclick="goTo(1)"><div class="trigger"><div class="spacing"><a href="/web/20230423000021/https://www.lsoft.com/products/listserv.asp" target="_blank">Learn More About LISTSERV</a></div></div></td> <td class="circle-middle" onclick="goTo(2)"><div class="trigger"><div class="spacing"><a href="/web/20230423000021/https://www.lsoft.com/resources/techtip.asp?filter=listserv" target="_blank">See More LISTSERV Tech Tips</a></div></div></td> <td class="circle-right" onclick="goTo(3)"><div class="trigger"><div class="spacing"><a href="/web/20230423000021/https://www.lsoft.com/contact/econtact.asp?id=sales" target="_blank">Contact Sales and Customer Service</a></div></div></td> </tr> </table> <br/> </td> </tr> </table> </td> </tr> </table> </td> </tr> <table border="0" cellpadding="0" cellspacing="0" style="width: 100% !important" width="100%"> <tr> <td bgcolor="#FAA705" style="background-color: #FAA705; padding: 10px 15px 10px 15px"><div style="font-family: 'Montserrat', 'Segoe UI', sans-serif; font-size: 15px; color: #FFFFFF; font-weight: normal; font-style: normal; text-align: right">© L-Soft 2022. All Rights Reserved.</div></td> </tr> </table> </td> </tr> </table> <table border="0" cellpadding="0" cellspacing="0" class="container" style="width: 680px" width="680"> <tr> <td> <div><br/></div>  <div class="addthis_toolbox addthis_default_style addthis_32x32_style" style="float:right"> <a class="addthis_button_facebook"></a> <a class="addthis_button_twitter"></a> <a class="addthis_button_google_plusone_share"></a> <a class="addthis_button_linkedin"></a> <a class="addthis_button_favorites"></a> <a class="addthis_button_compact"></a><a class="addthis_counter addthis_bubble_style"></a> </div> <script type="text/javascript" src="//web.archive.org/web/20230423000021js_/https://s7.addthis.com/js/300/addthis_widget.js#pubid=lsoft"></script>  <script async src="http://web.archive.org/web/20230423000021js_/https://www.googletagmanager.com/gtag/js?id=UA-3167554-2"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'UA-3167554-2'); </script> </td> </tr> </table> </td> </tr> </table> </body> </html>

CINXE.COM

LISTSERV Tech Tip: Why do my lists sometimes generate spoofing complaints and what should I do about them?