Hello, So I have two things I would like to address which I have realised: Firstly is the fact that Arch Linux almost always picks IPv4 over IPv6 when delivery the mail. I am aware this is not a big issue because I still receive the email but Arch Linux has full support for IPv6, and I would like to have it used (especially for the hope in the future we can all use single stack IPv6 and get rid of legacy IPv4). I believe this is not an issue with Arch Linux, but the mailing list software used (which I believe is mailman). I have discussed the same issue with the Gajim developers on XMPP. I believe GNU mailman uses Happy Eyeballs (like which Gajim uses) (more info: https://en.wikipedia.org/wiki/Happy_Eyeballs), which when I test it on my network for about 200-300 attempts, IPv6 is picked 299/300 of the times, so I should be seeing almost always IPv6, but I get the opposite. I assume GNU mailman uses the GNU python network library (forgot what it is called) which contains a Happy Eyeballs implementation (the same one Gajim uses). So there is a strong likelihood that it is an issue with the library being biased towards picking IPv4 over IPv6, because I do not have this issue with any other software. So this is not something which Arch is responsible for, but if anyone has more information about this, I would be grateful to be given it :) I did think for a while I had setup IPv6 incorrectly, but when I see Microsoft delivering emails solely over IPv6 (not a single use of IPv4), I do not believe it is an issue on my end, but correct me if I am wrong :D The second issue I want to bring up is the issue of gmail (and also sometimes outlook emails) spamming my emails. I have a few thoughts on this: - Google employs IP whitelisting, my email server is small and thus is suspicious, other small email servers know the going trend of "it being impossible to stay out of gmail spam folders", even legitimate emails from big companies sometimes end up in gmail spam, so for those who keep complaining about my emails being put into your spam, it is not an issue on my end, I have checked numerous times. - DKIM signatures are broken in transit, and depending on how the spam filter classifies something as spam, it could be picked up as a incorrect DKIM signature and thus spammed instantly, I will use David Rankin's email from this morning as a reference for this (https://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/m...) Here are the relevant headers: Received: from mail.polarian.dev by email with LMTP id +Pw5ALfTAmV1LwAAotfoXQ (envelope-from <arch-general-bounces@lists.archlinux.org>) for <polarian@localhost>; Thu, 14 Sep 2023 09:34:47 +0000 Received: from lists.archlinux.org (lists.archlinux.org [IPv6:2a01:4f9:c010:9eb4::1]) by mail.polarian.dev (Postfix) with ESMTPS id 9B5AB10A0772 for <polarian@polarian.dev>; Thu, 14 Sep 2023 09:34:46 +0000 (UTC) Authentication-Results: mail.polarian.dev; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20221208 header.b=S2HFsXca Received: from lists.archlinux.org (localhost [IPv6:::1]) by lists.archlinux.org (Postfix) with ESMTP id AD29AF4E9A0; Thu, 14 Sep 2023 09:34:30 +0000 (UTC) Received: from mail-oo1-xc35.google.com (mail-oo1-xc35.google.com [IPv6:2607:f8b0:4864:20::c35]) by lists.archlinux.org (Postfix) with ESMTPS id 3AC84F4E993 for <arch-general@lists.archlinux.org>; Thu, 14 Sep 2023 09:34:20 +0000 (UTC) Authentication-Results: lists.archlinux.org; dkim=pass header.d=gmail.com header.s=20221208 header.b=S2HFsXca; spf=pass (lists.archlinux.org: domain of drankinatty@gmail.com designates 2607:f8b0:4864:20::c35 as permitted sender) smtp.mailfrom=drankinatty@gmail.com; dmarc=pass (policy=none) header.from=gmail.com Received: by mail-oo1-xc35.google.com with SMTP id 006d021491bc7-57355a16941so450114eaf.2 for <arch-general@lists.archlinux.org>; Thu, 14 Sep 2023 02:34:20 -0700 (PDT) Sorry for the bad formatting, and apologies to David Rankin for using your email headers as a reference, but I assume its fine because it was posted to a public mailing list which we can already see, its public information, but if you do mind, I am sorry. The bottom hop is just google hopping the email between their servers, but once it hits lists.archlinux.org you can see that the authentication results is that it passes both spf and dkim, also I would like to draw attention to the fact that it was delivered to the mailing list via IPv6, which does show that IPv6 is definitely functioning on Arch's end. It is then hopped to my mail server, this was the only email which I have so far which was hopped to me via IPv6, so I was amazed when I saw it, so it definitely seems to be a issue with Happy Eyeballs. Anyways back to the topic, the signature then fails dkim validation (Yes I do not currently check spf, ip address spoofing is trivial compared to cryptographic signing and thus I was lazy and haven't yet bothered (its been over a year since my current mail server was configured :P). I assume that Google with their strict (and pointless) spam filter, sees that their mail server has failed to validate dkim and spams said email. I know I am not the only person being spammed too, I have seen other people being informed "hey your email was spammed for me", and 9 times out of 10 its those who self host, and thus are less known. Welcome to Googles dictatorship on email. I believe people running rspamd picks up that further down the hop chain it was valid, and thus takes that into account possibly, because I haven't heard people struggling to pass rspamd filtering. The reason for me bringing this up is getting an email every time I post to a mailing list from 3 different people complaining how google spammed my emails is a pain, and heres the kicker, half the time DKIM is valid and half the time it is broken when hopping through lists.archlinux.org, so wrap your ahead around that one! If you are getting legitimate emails spammed, then you either need to relax your email spam filter, or simply get used to checking your spam often to pull legitimate emails out. Personally I do not employ a spam filter, because just the likelihood of a legitimate email being spammed or bounced is a bad idea in my mind. As people complain about my email length, I will give a TL;DR: - Arch Linux (or GNU mailman) seems to have issues when it comes to picking between IPv4 and IPv6. - DKIM signatures are randomly broken when passing through lists.archlinux.org - If emails from the mailing list are being spammed, it might be wise to relax your spam settings, as even fully verified emails can be spammed from companies like google simply because their AI doesn't like the content of said email, or their IP whitelist doesn't include the sender. Maybe I should start putting a TL;DR at the top of every email? and then below that is the usual email with all the context and explanation. If someone thinks this is a good idea let me know (any way for me to annoy people less is a good thing :P) Any advice on how to improve (or hopefully fix) the two above issues would be highly appreciated. Take care, -- Polarian GPG signature: 0770E5312238C760 Website: https://polarian.dev JID/XMPP: polarian@icebound.dev
On 9/14/23 14:34, Polarian wrote:
Hello,
...
- DKIM signatures are broken in transit, and ... ... hi
There was a discussion of DKIM and mail list back last October [1]. There was, and seems still is, an open mailman issue [2]. The Arch thread is informative, in particular around content-transfer-encoding. Perhaps this is helpful. Regards gene [1] https://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/t... [2] https://gitlab.com/mailman/mailman/-/issues/636
Hello,
There was a discussion of DKIM and mail list back last October [1]. There was, and seems still is, an open mailman issue [2].
The Arch thread is informative, in particular around content-transfer-encoding. Perhaps this is helpful.
I believe I have read this thread already, but I will take a second look. As the mailman issue has yet to be resolved, there is not much which can be done here unfortunately.
Nope I don't mind -- 100% fine. I was just chucking at having the privilege to serve as the example :)
Well that is a relief. I am glad you got some enjoyment out of it :D
Just to say I may be out of date but I take ‘to spam’ to mean to send spam rather than classing ham as spam and spam-bucketing the email. :-)
People understood what I meant, no need to nitpick it :)
as you can see in the headers, the MTA sending mails is not mailman itself, but Postfix.
Mailman hooks into postfix, it still has its own logic. Hence why DKIM is being broken during the processing of the email.
As I got your mail via IPv6, I think it's just the default behaviour of Postfix:
http://www.postfix.org/postconf.5.html#smtp_address_preference
As pointed out in the docs, setting ipv6 as preference is considered unsafe. As an IPv6 enthusiast, I had set my Postfix to ipv6 myself and remember some issues with broken MX.
It seems most of my mail is delivered via IPv6, I have checked this but not with a large data set. But it seems most of the emails received from lists.archlinux.org is via IPv4, and the rare chance of IPv6 which is what I am finding is weird. https://serverfault.com/a/565123 This comment implies either Happy Eyeballs or a similar mechanism is being used by postfix. I have a friend who uses postfix and his mail server is configured dual stack and his mail ALWAYS uses IPv6, he hasn't set a preference either. Maybe Arch set IPv4 to be preferred and that is why?
But that note is rather confusing. The setting is describes as the address family to try *first*. Not as the only address family to try at all. So something in the docs is wrong. It's either the note or the documented behavior.
Maybe something to ask the postfix developers about, and possibly write a patch which better explains said mechanism? Thanks for the help! Take care, -- Polarian GPG signature: 0770E5312238C760 Website: https://polarian.dev JID/XMPP: polarian@icebound.dev
On 9/14/23 13:34, Polarian wrote:
Sorry for the bad formatting, and apologies to David Rankin for using your email headers as a reference, but I assume its fine because it was posted to a public mailing list which we can already see, its public information, but if you do mind, I am sorry.
Nope I don't mind -- 100% fine. I was just chucking at having the privilege to serve as the example :) -- David C. Rankin, J.D.,P.E.
Hi Polarian,
The second issue I want to bring up is the issue of gmail (and also sometimes outlook emails) spamming my emails.
Just to say I may be out of date but I take ‘to spam’ to mean to send spam rather than classing ham as spam and spam-bucketing the email. :-) -- Cheers, Ralph.
Hi,
So I have two things I would like to address which I have realised:
Firstly is the fact that Arch Linux almost always picks IPv4 over IPv6 when delivery the mail. I am aware this is not a big issue because I still receive the email but Arch Linux has full support for IPv6, and I would like to have it used (especially for the hope in the future we can all use single stack IPv6 and get rid of legacy IPv4).
as you can see in the headers, the MTA sending mails is not mailman itself, but Postfix. As I got your mail via IPv6, I think it's just the default behaviour of Postfix: http://www.postfix.org/postconf.5.html#smtp_address_preference As pointed out in the docs, setting ipv6 as preference is considered unsafe. As an IPv6 enthusiast, I had set my Postfix to ipv6 myself and remember some issues with broken MX. Regards Bjoern
On 15/09/2023 10:57, Bjoern Franke wrote:
As pointed out in the docs, setting ipv6 as preference is considered unsafe. As an IPv6 enthusiast, I had set my Postfix to ipv6 myself and remember some issues with broken MX.
The docs in question:
smtp_address_preference (default: any)
The address type ("ipv6", "ipv4" or "any") that the Postfix SMTP client will try first, when a destination has IPv6 and IPv4 addresses with equal MX preference. This feature has no effect unless the inet_protocols setting enables both IPv4 and IPv6.
Postfix SMTP client address preference has evolved. With Postfix 2.8 the default is "ipv6"; earlier implementations are hard-coded to prefer IPv6 over IPv4.
Notes for mail delivery between sites that have both IPv4 and IPv6 connectivity:
*
The setting "smtp_address_preference = ipv6" is unsafe. It can fail to deliver mail when there is an outage that affects IPv6, while the destination is still reachable over IPv4.
*
The setting "smtp_address_preference = any" is safe. With this, mail will eventually be delivered even if there is an outage that affects IPv6 or IPv4, as long as it does not affect both.
This feature is available in Postfix 2.8 and later.
But that note is rather confusing. The setting is describes as the address family to try *first*. Not as the only address family to try at all. So something in the docs is wrong. It's either the note or the documented behavior. -- Maarten
participants (6)
-
Bjoern Franke
-
David C. Rankin
-
Genes Lists
-
Maarten de Vries
-
Polarian
-
Ralph Corderoy