Yahoo!, DMARC and List Servers

As you may know we host lots of mailing lists at The Hug using mailman, which is pretty much the de facto standard open source solution for such things, and yesterday I saw a bounce from Yahoo! which had rejected an email sent through the list server to a subscriber using a yahoo.co.uk email address. The reason took my breath away.

The page the bounce points you to explains that:

Your message wasn't delivered because Yahoo was unable to verify that it came from a legitimate email sender.

and goes on to mention methods such as DKIM signing which I've talked about here before. Which was odd as we do DKIM sign all our outgoing mail, including mail from mailing lists. But here's the rub: they also use DMARC and the email originally came from someone at an aol.com address, who do too.

The page says of mailing lists:

In almost all cases, we recommend that you switch to sending mail from your own domain. For mailing lists, also known as "listservs," you should change your sending behavior by adding the mailing lists' address to the "From:" line, rather than the sender's address. Also, enter the actual user/sender address into the "Reply-To:" line.

The DMARC web site gives similar advice, note option 3. in particular, which is where we would need to go as we modify the Subject: header and the message body.

So let's be clear what they're saying here. Suppose I mail milton-chat (a mailing list we host). Then currently the email as sent to the list will have three headers as follows:

Now I'm aware there is a element of religion here: some people believe you should set the Reply-To: header to the sender, then people can click on Reply to reply only to the sender and Reply All to reply to the list. All I can say is that in my experience that doesn't work for many users - they simply don't understand the distinction - and we've found working the way we do, which is the old fashioned way mailing lists worked, to be far easier for people to grasp.

Anyway what they're saying is that we should change this so that instead the mail sent to the list reads:

Which works fine if you already operate on the basis I described above where Reply-To: is set to the sender but for us that would mean re-training subscribers in how to use all our lists. So we would have to use:

And you can see the problem right away: the sender's identity is now lost.

I discover having Googled about that I'm not the first person to come across this. In April The Register covered the issue and it also looks like the AOL is doing the same thing. Their page has pretty much exactly the same wording as Yahoo! in their advice to list owners.

Back in April the main issue was list servers not correctly DKIM signing their emails. Well we do that, so we were safe from that, but now Yahoo! have moved it up a notch and they're respecting AOL's p=reject DMARC record to reject mail apparently from an AOL user (which it was of course) but DKIM signed by our list server rather than AOL's.

So I'm now left with three options:

1. Change the From: address to be the mailing list address, set the Reply-To: address to be the sender and then re-educate all our subscribers.
2. Change the From: address to be the mailing list address and put the sender's email address at the top of the message body.
3. Ignore the issue and accept that it will become impossible for people with email addresses at Yahoo!, AOL and an increasing number of other major ISPs to use our list server.

Sadly I don't think option 3. is tenable, much as I would like to go that way. At the moment I'm leaning towards 2. as the grief of re-educating subscribers on option 1. both initially and repeatedly thereafter doesn't bear thinking about.

Anyway I'd be interested in people's thoughts on this one, either using the "Comment on this article" link below or by mail to

So, as you'll see from the comments below, it looks like option 2. but modified by Steven's suggestion is the best solution. So this means that the email to the list would look like this:

That actually renders quite well in a couple of mail clients I've tried it in (Thunderbird and SquirrelMail). You can still clearly see the original sender and their email address as most mail clients now tend to preferentially display the text version of the From address. It'll probably screw up automatically updated address books mind you.

As Dave pointed out below later versions of mailman do resolve this problem. Sort of. We've got 2.1.6 on the new server and this is what it does:

Which is fine as far as it goes but if, like we do on our lists, we don't want Reply-To: set to the poster then what you end up with is this:

So other posters can't see the email address of the poster. After some head scratching I've found a solution though. We already pre-process the email before passing it to mailman so as part of that I've change the From: address to "Paul Oldham paul@the-hug.org" <paul@the-hug.org> so then mailman produces a mail that looks like this:

Which is pretty much the result I was looking for.