Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122461
Content-Type: multipart/alternative;
 boundary="------------vI5FEwsNEifUCKELIk96W9zN"
Message-ID: <10e775ea-4d0b-4a1b-a895-a6ae95136fec@phpgangsta.de>
Date: Thu, 22 Feb 2024 15:44:13 +0100
Precedence: bulk
MIME-Version: 1.0
Subject: Re: External Message: Re: [PHP-DEV] What's up with emails?
To: internals@lists.php.net
References: <CAPzBOBMKL_70sQkM_DrfFSaJz-ustCEhF5pTZP-wee+ceh46ag@mail.gmail.com>
 <DF2009FC-C510-4E0D-ADF8-CDCA7AB84AA6@php.net>
 <DS0PR12MB6464B746DA5DCA5C1CC1D472DB562@DS0PR12MB6464.namprd12.prod.outlook.com>
In-Reply-To: <DS0PR12MB6464B746DA5DCA5C1CC1D472DB562@DS0PR12MB6464.namprd12.prod.outlook.com>
From: info@phpgangsta.de (Michael Kliewe)

This is a multi-part message in MIME format.
--------------vI5FEwsNEifUCKELIk96W9zN
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Am 22.02.2024 um 15:14 schrieb Jeffrey Dafoe:
>> Gmail is rejecting emails after we moved the servers without telling us why, in
>> enough detail to do anything about it.
> It's not just gmail.

I guess it's because of a wrong setting in the mailinglist server.

The content of the original email is changed (the subject is prepended 
by "[PHP-DEV]"), which breaks the original DKIM signature by the sender.

A new DKIM-signature is added by php.net, but it's not aligned to the 
From:-header domain (which is still the original sender).

So the email doesn't have a valid ALIGNED DKIM signature.

SPF is valid for the envelope from, but is not aligned to the From:-header.

The result is:

There is no aligned SPF nor aligned DKIM, which results in a dmarc=fail.

Providers which honor DMARC will quarantine or reject these 
unauthorized/forged emails.

There are 2 solutions:

1. Don't change the content or the DKIM-signed headers of the email (do 
not prepend something in the subject). Then the original DKIM signature 
stays valid and the From:-header can stay untouched

2. If you change the the email and break the original DKIM signature, 
also change the From:-header to a domain which matches the new DKIM 
signature, in this case set the From:-header to internals@lists.php.net. 
This is called "munging" in mailinglist software.

Michael

--------------vI5FEwsNEifUCKELIk96W9zN
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">Am 22.02.2024 um 15:14 schrieb Jeffrey
      Dafoe:<br>
    </div>
    <blockquote type="cite"
cite="mid:DS0PR12MB6464B746DA5DCA5C1CC1D472DB562@DS0PR12MB6464.namprd12.prod.outlook.com">
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">Gmail is rejecting emails after we moved the servers without telling us why, in
enough detail to do anything about it.
</pre>
      </blockquote>
      <pre class="moz-quote-pre" wrap="">
It's not just gmail.</pre>
    </blockquote>
    <p>I guess it's because of a wrong setting in the mailinglist
      server.</p>
    <p><span style="white-space: pre-wrap">The content of the original email is changed (the subject is prepended by "[PHP-DEV]"), which breaks the original DKIM signature by the sender.</span></p>
    <p><span style="white-space: pre-wrap">A new DKIM-signature is added by php.net, but it's not aligned to the From:-header domain (which is still the original sender).</span></p>
    <p><span style="white-space: pre-wrap">So the email doesn't have a valid ALIGNED DKIM signature.</span></p>
    <p><span style="white-space: pre-wrap">SPF is valid for the envelope from, but is not aligned to the From:-header.</span></p>
    <p><span style="white-space: pre-wrap">The result is:</span></p>
    <p><span style="white-space: pre-wrap">There is no aligned SPF nor aligned DKIM, which results in a dmarc=fail.</span></p>
    <p><span style="white-space: pre-wrap">Providers which honor DMARC will quarantine or reject these unauthorized/forged emails.</span></p>
    <p><span style="white-space: pre-wrap">There are 2 solutions:</span></p>
    <p><span style="white-space: pre-wrap">1. Don't change the content or the DKIM-signed headers of the email (do not prepend something in the subject). Then the original DKIM signature stays valid and the From:-header can stay untouched</span></p>
    <p><span style="white-space: pre-wrap">2. If you change the the email and break the original DKIM signature, also change the From:-header to a domain which matches the new DKIM signature, in this case set the From:-header to <a class="moz-txt-link-abbreviated" href="mailto:internals@lists.php.net">internals@lists.php.net</a>. This is called "munging" in mailinglist software.</span></p>
    <p><span style="white-space: pre-wrap">Michael
</span></p>
  </body>
</html>

--------------vI5FEwsNEifUCKELIk96W9zN--