January 2025 - Mailman-users - lists.mailman3.org

Phantom Email Address in Nonmember List
by Steve Brown Jan. 31, 2026

Jan. 31, 2026

Have an issue that is more of a puzzle than a problem. No real harm done. So don't spend much time on it if you don't recognize the issue. I am administrator for a small list, radg(a)lists.radg.us, hosted by Mailmanlists.net. They are trying hard to figure it out but so far unsuccessful. Looking at the headers of emails sent from steve(a)stevebrown.us to the list and boomeranged back to me, I see a line “X-MailFrom: bounce+66273f.99dcd9c-radg=lists.radg.us(a)stevebrown.xn--us-02t. I gather that it is designating the return path where a message would be sent if there was a delivery problem. From its position in the header, I suspect it is added as they pass through Mailgun, maybe related to DKIM. I am hoping you might know why that bounce address is recognized by Mailman 3 as a real address for my emails, but not for others, even from my wife’s computer traversing the same path from our home to the Mailman 3 server. The Mailman installation does get and process the post, but also puts the “bounce+,,,” address in its list of nonmembers. Mailmanlists.net hasn’t figured out the behavior. I can provide full header information if that would help. My understanding of how headers work is very limited. Steve Brown

2 9

Internal Server Error: /mailman3/accounts/fedora/login/
by Alain D D Williams Nov. 20, 2025

Nov. 20, 2025

Twice today I have received many (50+) emails like the one below. Many at about 1pm, then it stopped now I am getting them again. An Internet search does not bring up anything useful. The domain at the start of 'Request URL' varies as does the name of the list (in this example 'announce(a)leavesden.org') The domain of the list is not necessarily the same as the domain at the start of the URL. I can receive several in a minute. Anyone any idea ? ----- Forwarded message from root(a)bf2024.phcomp.co.uk ----- Date: Mon, 02 Dec 2024 22:19:12 -0000 From: root(a)bf2024.phcomp.co.uk To: root@localhost Subject: [Django] ERROR (EXTERNAL IP): Internal Server Error: /mailman3/accounts/fedora/login/ Internal Server Error: /mailman3/accounts/fedora/login/ TypeError at /accounts/fedora/login/ OpenIDProvider.get_server_settings() missing 1 required positional argument: 'endpoint' Request Method: GET Request URL: https://www.leavesden.org.uk/mailman3/accounts/fedora/login/?next=%2Fmailma… Django Version: 3.2.19 Python Executable: /usr/bin/uwsgi-core Python Version: 3.11.2 Python Path: ['.', '', '/usr/lib/python311.zip', '/usr/lib/python3.11', '/usr/lib/python3.11/lib-dynload', '/usr/local/lib/python3.11/dist-packages', '/usr/lib/python3/dist-packages', '/usr/lib/python3.11/dist-packages'] Server time: Mon, 02 Dec 2024 22:19:07 +0000 Installed Applications: ('hyperkitty', 'postorius', 'django_mailman3', 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.sites', 'django.contrib.messages', 'django.contrib.staticfiles', 'rest_framework', 'django_gravatar', 'compressor', 'haystack', 'django_extensions', 'django_q', 'allauth', 'allauth.account', 'allauth.socialaccount', 'django_mailman3.lib.auth.fedora') Installed Middleware: ('django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.middleware.locale.LocaleMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'django.middleware.security.SecurityMiddleware', 'django_mailman3.middleware.TimezoneMiddleware', 'postorius.middleware.PostoriusMiddleware') Traceback (most recent call last): File "/usr/lib/python3/dist-packages/django/core/handlers/exception.py", line 47, in inner response = get_response(request) File "/usr/lib/python3/dist-packages/django/core/handlers/base.py", line 181, in _get_response response = wrapped_callback(request, *callback_args, **callback_kwargs) File "/usr/lib/python3/dist-packages/django/views/generic/base.py", line 70, in view return self.dispatch(request, *args, **kwargs) File "/usr/lib/python3/dist-packages/django/views/generic/base.py", line 98, in dispatch return handler(request, *args, **kwargs) File "/usr/lib/python3/dist-packages/django_mailman3/lib/auth/fedora/views.py", line 56, in get return self.post(request, *args, **kwargs) File "/usr/lib/python3/dist-packages/django_mailman3/lib/auth/fedora/views.py", line 67, in post client = _openid_consumer( File "/usr/lib/python3/dist-packages/allauth/socialaccount/providers/openid/views.py", line 27, in _openid_consumer server_settings = provider.get_server_settings(endpoint) Exception Type: TypeError at /accounts/fedora/login/ Exception Value: OpenIDProvider.get_server_settings() missing 1 required positional argument: 'endpoint' Request information: USER: AnonymousUser GET: next = '/mailman3/hyperkitty/list/announce(a)leavesden.org.uk/2020/12/' process = 'login' POST: No POST data FILES: No FILES data COOKIES: No cookie data META: CONTEXT_DOCUMENT_ROOT = '/var/www/leavesden/html' CONTEXT_PREFIX = '' DOCUMENT_ROOT = '/var/www/leavesden/html' GATEWAY_INTERFACE = 'CGI/1.1' HTTPS = 'on' HTTP_ACCEPT = 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' HTTP_ACCEPT_ENCODING = 'gzip' HTTP_ACCEPT_LANGUAGE = 'en-us,en-gb,en;q=0.7,*;q=0.3' HTTP_CONNECTION = 'Keep-Alive' HTTP_HOST = 'www.leavesden.org.uk' HTTP_USER_AGENT = 'serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; abuse(a)serpstatbot.com)' PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' PATH_INFO = '/accounts/fedora/login/' QUERY_STRING = 'next=%2Fmailman3%2Fhyperkitty%2Flist%2Fannounce%40leavesden.org.uk%2F2020%2F12%2F&process=login' REMOTE_ADDR = '144.76.69.39' REMOTE_PORT = '33902' REQUEST_METHOD = 'GET' REQUEST_SCHEME = 'https' REQUEST_URI = '/mailman3/accounts/fedora/login/?next=%2Fmailman3%2Fhyperkitty%2Flist%2Fannounce%40leavesden.org.uk%2F2020%2F12%2F&process=login' SCRIPT_FILENAME = 'proxy:uwsgi://localhost//accounts/fedora/login/' SCRIPT_NAME = '/mailman3' SCRIPT_URI = 'https://www.leavesden.org.uk/mailman3/accounts/fedora/login/' SCRIPT_URL = '/mailman3/accounts/fedora/login/' SERVER_ADDR = '85.119.82.114' SERVER_ADMIN = 'addw(a)phcomp.co.uk' SERVER_NAME = 'www.leavesden.org.uk' SERVER_PORT = '443' SERVER_PROTOCOL = 'HTTP/1.1' SERVER_SIGNATURE = '********************' SERVER_SOFTWARE = 'Apache/2.4.62 (Debian)' SSL_TLS_SNI = 'www.leavesden.org.uk' uwsgi.core = 1 uwsgi.node = b'bf2024.phcomp.co.uk' uwsgi.version = b'2.0.21-debian' wsgi.errors = <_io.TextIOWrapper name=2 mode='w' encoding='UTF-8'> wsgi.file_wrapper = <built-in function uwsgi_sendfile> wsgi.input = <uwsgi._Input object at 0x7f42defc8b50> wsgi.multiprocess = False wsgi.multithread = True wsgi.run_once = False wsgi.url_scheme = 'https' wsgi.version = '(1, 0)' Settings: Using settings module settings ABSOLUTE_URL_OVERRIDES = {} ACCOUNT_AUTHENTICATION_METHOD = 'username_email' ACCOUNT_DEFAULT_HTTP_PROTOCOL = 'https' ACCOUNT_EMAIL_REQUIRED = True ACCOUNT_EMAIL_VERIFICATION = 'mandatory' ACCOUNT_UNIQUE_EMAIL = True ADMINS = "(('Mailman Suite Admin', 'root@localhost'),)" ALLOWED_HOSTS = ['*'] APPEND_SLASH = True AUTHENTICATION_BACKENDS = "('django.contrib.auth.backends.ModelBackend', 'allauth.account.auth_backends.AuthenticationBackend')" AUTH_PASSWORD_VALIDATORS = '********************' AUTH_USER_MODEL = 'auth.User' BASE_DIR = '/usr/share/mailman3-web' CACHES = {'default': {'BACKEND': 'django.core.cache.backends.locmem.LocMemCache'}} CACHE_MIDDLEWARE_ALIAS = 'default' CACHE_MIDDLEWARE_KEY_PREFIX = '********************' CACHE_MIDDLEWARE_SECONDS = 600 COMPRESSORS = {'css': 'compressor.css.CssCompressor', 'js': 'compressor.js.JsCompressor'} COMPRESS_CACHEABLE_PRECOMPILERS = '()' COMPRESS_CACHE_BACKEND = 'default' COMPRESS_CACHE_KEY_FUNCTION = '********************' COMPRESS_CLEAN_CSS_ARGUMENTS = '' COMPRESS_CLEAN_CSS_BINARY = 'cleancss' COMPRESS_CLOSURE_COMPILER_ARGUMENTS = '' COMPRESS_CLOSURE_COMPILER_BINARY = 'java -jar compiler.jar' COMPRESS_CSS_HASHING_METHOD = 'mtime' COMPRESS_DATA_URI_MAX_SIZE = 1024 COMPRESS_DEBUG_TOGGLE = None COMPRESS_ENABLED = True COMPRESS_FILTERS = {'css': ['compressor.filters.css_default.CssAbsoluteFilter', 'compressor.filters.cssmin.rCSSMinFilter'], 'js': ['compressor.filters.jsmin.rJSMinFilter']} COMPRESS_JINJA2_GET_ENVIRONMENT = <function CompressorConf.JINJA2_GET_ENVIRONMENT at 0x7f42e6122700> COMPRESS_MINT_DELAY = 30 COMPRESS_MTIME_DELAY = 10 COMPRESS_OFFLINE = True COMPRESS_OFFLINE_CONTEXT = {'STATIC_URL': '/mailman3/static/'} COMPRESS_OFFLINE_MANIFEST = 'manifest.json' COMPRESS_OFFLINE_TIMEOUT = 31536000 COMPRESS_OUTPUT_DIR = 'CACHE' COMPRESS_PARSER = 'compressor.parser.AutoSelectParser' COMPRESS_PRECOMPILERS = '()' COMPRESS_REBUILD_TIMEOUT = 2592000 COMPRESS_ROOT = '/var/lib/mailman3/web/static' COMPRESS_STORAGE = 'compressor.storage.CompressorFileStorage' COMPRESS_TEMPLATE_FILTER_CONTEXT = {'STATIC_URL': '/mailman3/static/'} COMPRESS_URL = '/mailman3/static/' COMPRESS_URL_PLACEHOLDER = '/__compressor_url_placeholder__/' COMPRESS_VERBOSE = False COMPRESS_YUGLIFY_BINARY = 'yuglify' COMPRESS_YUGLIFY_CSS_ARGUMENTS = '--terminal' COMPRESS_YUGLIFY_JS_ARGUMENTS = '--terminal' COMPRESS_YUI_BINARY = 'java -jar yuicompressor.jar' COMPRESS_YUI_CSS_ARGUMENTS = '' COMPRESS_YUI_JS_ARGUMENTS = '' CSRF_COOKIE_AGE = 31449600 CSRF_COOKIE_DOMAIN = None CSRF_COOKIE_HTTPONLY = False CSRF_COOKIE_NAME = 'csrftoken' CSRF_COOKIE_PATH = '/' CSRF_COOKIE_SAMESITE = 'Lax' CSRF_COOKIE_SECURE = False CSRF_FAILURE_VIEW = 'django.views.csrf.csrf_failure' CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN' CSRF_TRUSTED_ORIGINS = [] CSRF_USE_SESSIONS = False DATABASES = {'default': {'ENGINE': 'django.db.backends.mysql', 'NAME': 'mailman3web', 'USER': 'mailman3web', 'PASSWORD': '********************', 'HOST': 'localhost', 'PORT': '', 'OPTIONS': {'init_command': "SET sql_mode='STRICT_TRANS_TABLES'", 'charset': 'utf8mb4'}, 'ATOMIC_REQUESTS': False, 'AUTOCOMMIT': True, 'CONN_MAX_AGE': 0, 'TIME_ZONE': None, 'TEST': {'CHARSET': None, 'COLLATION': None, 'MIGRATE': True, 'MIRROR': None, 'NAME': None}}} DATABASE_ROUTERS = [] DATA_UPLOAD_MAX_MEMORY_SIZE = 2621440 DATA_UPLOAD_MAX_NUMBER_FIELDS = 1000 DATA_UPLOAD_MAX_NUMBER_FILES = 100 DATETIME_FORMAT = 'N j, Y, P' DATETIME_INPUT_FORMATS = ['%Y-%m-%d %H:%M:%S', '%Y-%m-%d %H:%M:%S.%f', '%Y-%m-%d %H:%M', '%m/%d/%Y %H:%M:%S', '%m/%d/%Y %H:%M:%S.%f', '%m/%d/%Y %H:%M', '%m/%d/%y %H:%M:%S', '%m/%d/%y %H:%M:%S.%f', '%m/%d/%y %H:%M'] DATE_FORMAT = 'N j, Y' DATE_INPUT_FORMATS = ['%Y-%m-%d', '%m/%d/%Y', '%m/%d/%y', '%b %d %Y', '%b %d, %Y', '%d %b %Y', '%d %b, %Y', '%B %d %Y', '%B %d, %Y', '%d %B %Y', '%d %B, %Y'] DEBUG = False DEBUG_PROPAGATE_EXCEPTIONS = False DECIMAL_SEPARATOR = '.' DEFAULT_AUTO_FIELD = 'django.db.models.AutoField' DEFAULT_CHARSET = 'utf-8' DEFAULT_EXCEPTION_REPORTER = 'django.views.debug.ExceptionReporter' DEFAULT_EXCEPTION_REPORTER_FILTER = 'django.views.debug.SafeExceptionReporterFilter' DEFAULT_FILE_STORAGE = 'django.core.files.storage.FileSystemStorage' DEFAULT_FROM_EMAIL = 'mailman3(a)bf2024.phcomp.co.uk' DEFAULT_HASHING_ALGORITHM = 'sha256' DEFAULT_INDEX_TABLESPACE = '' DEFAULT_TABLESPACE = '' DISALLOWED_USER_AGENTS = [] EMAILNAME = 'bf2024.phcomp.co.uk' EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend' EMAIL_HOST = 'localhost' EMAIL_HOST_PASSWORD = '********************' EMAIL_HOST_USER = '' EMAIL_PORT = 25 EMAIL_SSL_CERTFILE = None EMAIL_SSL_KEYFILE = '********************' EMAIL_SUBJECT_PREFIX = '[Django] ' EMAIL_TIMEOUT = None EMAIL_USE_LOCALTIME = False EMAIL_USE_SSL = False EMAIL_USE_TLS = False FILE_UPLOAD_DIRECTORY_PERMISSIONS = None FILE_UPLOAD_HANDLERS = ['django.core.files.uploadhandler.MemoryFileUploadHandler', 'django.core.files.uploadhandler.TemporaryFileUploadHandler'] FILE_UPLOAD_MAX_MEMORY_SIZE = 2621440 FILE_UPLOAD_PERMISSIONS = 420 FILE_UPLOAD_TEMP_DIR = None FILTER_VHOST = False FIRST_DAY_OF_WEEK = 0 FIXTURE_DIRS = [] FORCE_SCRIPT_NAME = None FORMAT_MODULE_PATH = None FORM_RENDERER = 'django.forms.renderers.DjangoTemplates' HAYSTACK_CONNECTIONS = {'default': {'ENGINE': 'haystack.backends.whoosh_backend.WhooshEngine', 'PATH': '/var/lib/mailman3/web/fulltext_index'}} HOSTNAME = 'localhost' IGNORABLE_404_URLS = [] INSTALLED_APPS = "('hyperkitty', 'postorius', 'django_mailman3', 'django.contrib.admin', 'django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.sites', 'django.contrib.messages', 'django.contrib.staticfiles', 'rest_framework', 'django_gravatar', 'compressor', 'haystack', 'django_extensions', 'django_q', 'allauth', 'allauth.account', 'allauth.socialaccount', 'django_mailman3.lib.auth.fedora')" INTERNAL_IPS = [] LANGUAGES = [('af', 'Afrikaans'), ('ar', 'Arabic'), ('ar-dz', 'Algerian Arabic'), ('ast', 'Asturian'), ('az', 'Azerbaijani'), ('bg', 'Bulgarian'), ('be', 'Belarusian'), ('bn', 'Bengali'), ('br', 'Breton'), ('bs', 'Bosnian'), ('ca', 'Catalan'), ('cs', 'Czech'), ('cy', 'Welsh'), ('da', 'Danish'), ('de', 'German'), ('dsb', 'Lower Sorbian'), ('el', 'Greek'), ('en', 'English'), ('en-au', 'Australian English'), ('en-gb', 'British English'), ('eo', 'Esperanto'), ('es', 'Spanish'), ('es-ar', 'Argentinian Spanish'), ('es-co', 'Colombian Spanish'), ('es-mx', 'Mexican Spanish'), ('es-ni', 'Nicaraguan Spanish'), ('es-ve', 'Venezuelan Spanish'), ('et', 'Estonian'), ('eu', 'Basque'), ('fa', 'Persian'), ('fi', 'Finnish'), ('fr', 'French'), ('fy', 'Frisian'), ('ga', 'Irish'), ('gd', 'Scottish Gaelic'), ('gl', 'Galician'), ('he', 'Hebrew'), ('hi', 'Hindi'), ('hr', 'Croatian'), ('hsb', 'Upper Sorbian'), ('hu', 'Hungarian'), ('hy', 'Armenian'), ('ia', 'Interlingua'), ('id', 'Indonesian'), ('ig', 'Igbo'), ('io', 'Ido'), ('is', 'Icelandic'), ('it', 'Italian'), ('ja', 'Japanese'), ('ka', 'Georgian'), ('kab', 'Kabyle'), ('kk', 'Kazakh'), ('km', 'Khmer'), ('kn', 'Kannada'), ('ko', 'Korean'), ('ky', 'Kyrgyz'), ('lb', 'Luxembourgish'), ('lt', 'Lithuanian'), ('lv', 'Latvian'), ('mk', 'Macedonian'), ('ml', 'Malayalam'), ('mn', 'Mongolian'), ('mr', 'Marathi'), ('my', 'Burmese'), ('nb', 'Norwegian Bokmål'), ('ne', 'Nepali'), ('nl', 'Dutch'), ('nn', 'Norwegian Nynorsk'), ('os', 'Ossetic'), ('pa', 'Punjabi'), ('pl', 'Polish'), ('pt', 'Portuguese'), ('pt-br', 'Brazilian Portuguese'), ('ro', 'Romanian'), ('ru', 'Russian'), ('sk', 'Slovak'), ('sl', 'Slovenian'), ('sq', 'Albanian'), ('sr', 'Serbian'), ('sr-latn', 'Serbian Latin'), ('sv', 'Swedish'), ('sw', 'Swahili'), ('ta', 'Tamil'), ('te', 'Telugu'), ('tg', 'Tajik'), ('th', 'Thai'), ('tk', 'Turkmen'), ('tr', 'Turkish'), ('tt', 'Tatar'), ('udm', 'Udmurt'), ('uk', 'Ukrainian'), ('ur', 'Urdu'), ('uz', 'Uzbek'), ('vi', 'Vietnamese'), ('zh-hans', 'Simplified Chinese'), ('zh-hant', 'Traditional Chinese')] LANGUAGES_BIDI = ['he', 'ar', 'ar-dz', 'fa', 'ur'] LANGUAGE_CODE = 'en-gb' LANGUAGE_COOKIE_AGE = None LANGUAGE_COOKIE_DOMAIN = None LANGUAGE_COOKIE_HTTPONLY = False LANGUAGE_COOKIE_NAME = 'django_language' LANGUAGE_COOKIE_PATH = '/' LANGUAGE_COOKIE_SAMESITE = None LANGUAGE_COOKIE_SECURE = False LOCALE_PATHS = [] LOGGING = {'version': 1, 'disable_existing_loggers': False, 'filters': {'require_debug_false': {'()': 'django.utils.log.RequireDebugFalse'}}, 'handlers': {'mail_admins': {'level': 'ERROR', 'filters': ['require_debug_false'], 'class': 'django.utils.log.AdminEmailHandler'}, 'file': {'level': 'INFO', 'class': 'logging.handlers.RotatingFileHandler', 'filename': '/var/log/mailman3/web/mailman-web.log', 'formatter': 'verbose'}, 'console': {'class': 'logging.StreamHandler', 'formatter': 'simple'}}, 'loggers': {'django.request': {'handlers': ['mail_admins', 'file'], 'level': 'INFO', 'propagate': True}, 'django': {'handlers': ['file'], 'level': 'INFO', 'propagate': True}, 'hyperkitty': {'handlers': ['file'], 'level': 'INFO', 'propagate': True}, 'postorius': {'handlers': ['file'], 'level': 'INFO', 'propagate': True}}, 'formatters': {'verbose': {'format': '%(levelname)s %(asctime)s %(process)d %(name)s %(message)s'}, 'simple': {'format': '%(levelname)s %(message)s'}}} LOGGING_CONFIG = 'logging.config.dictConfig' LOGIN_REDIRECT_URL = 'list_index' LOGIN_URL = 'account_login' LOGOUT_REDIRECT_URL = None LOGOUT_URL = 'account_logout' MAILMAN_ARCHIVER_FROM = "('127.0.0.1', '::1')" MAILMAN_ARCHIVER_KEY = '********************' MAILMAN_REST_API_PASS = '********************' MAILMAN_REST_API_URL = '********************' MAILMAN_REST_API_USER = '********************' MANAGERS = [] MEDIA_ROOT = '' MEDIA_URL = '/mailman3/' MESSAGE_STORAGE = 'django.contrib.messages.storage.fallback.FallbackStorage' MESSAGE_TAGS = {40: 'danger'} MIDDLEWARE = "('django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.middleware.locale.LocaleMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'django.middleware.security.SecurityMiddleware', 'django_mailman3.middleware.TimezoneMiddleware', 'postorius.middleware.PostoriusMiddleware')" MIGRATION_MODULES = {} MONTH_DAY_FORMAT = 'F j' NUMBER_GROUPING = 0 PASSWORD_HASHERS = '********************' PASSWORD_RESET_TIMEOUT = '********************' PASSWORD_RESET_TIMEOUT_DAYS = '********************' POSTORIUS_TEMPLATE_BASE_URL = 'http://localhost/mailman3/' PREPEND_WWW = False Q_CLUSTER = {'timeout': 300, 'retry': 400, 'save_limit': 100, 'orm': 'default', 'poll': 5} ROOT_URLCONF = 'urls' SECRET_KEY = '********************' SECURE_BROWSER_XSS_FILTER = False SECURE_CONTENT_TYPE_NOSNIFF = True SECURE_HSTS_INCLUDE_SUBDOMAINS = False SECURE_HSTS_PRELOAD = False SECURE_HSTS_SECONDS = 0 SECURE_PROXY_SSL_HEADER = None SECURE_REDIRECT_EXEMPT = [] SECURE_REFERRER_POLICY = 'same-origin' SECURE_SSL_HOST = None SECURE_SSL_REDIRECT = False SERVER_EMAIL = 'root(a)bf2024.phcomp.co.uk' SESSION_CACHE_ALIAS = 'default' SESSION_COOKIE_AGE = 1209600 SESSION_COOKIE_DOMAIN = None SESSION_COOKIE_HTTPONLY = True SESSION_COOKIE_NAME = 'sessionid' SESSION_COOKIE_PATH = '/' SESSION_COOKIE_SAMESITE = 'Lax' SESSION_COOKIE_SECURE = False SESSION_ENGINE = 'django.contrib.sessions.backends.db' SESSION_EXPIRE_AT_BROWSER_CLOSE = False SESSION_FILE_PATH = None SESSION_SAVE_EVERY_REQUEST = False SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer' SETTINGS_MODULE = 'settings' SHORT_DATETIME_FORMAT = 'm/d/Y P' SHORT_DATE_FORMAT = 'm/d/Y' SIGNING_BACKEND = 'django.core.signing.TimestampSigner' SILENCED_SYSTEM_CHECKS = [] SITE_ID = 1 SOCIALACCOUNT_PROVIDERS = {} STATICFILES_DIRS = '()' STATICFILES_FINDERS = "('django.contrib.staticfiles.finders.FileSystemFinder', 'django.contrib.staticfiles.finders.AppDirectoriesFinder', 'compressor.finders.CompressorFinder')" STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage' STATIC_ROOT = '/var/lib/mailman3/web/static' STATIC_URL = '/mailman3/static/' TEMPLATES = [{'BACKEND': 'django.template.backends.django.DjangoTemplates', 'DIRS': [], 'APP_DIRS': True, 'OPTIONS': {'context_processors': ['django.template.context_processors.debug', 'django.template.context_processors.i18n', 'django.template.context_processors.media', 'django.template.context_processors.static', 'django.template.context_processors.tz', 'django.template.context_processors.csrf', 'django.template.context_processors.request', 'django.contrib.auth.context_processors.auth', 'django.contrib.messages.context_processors.messages', 'django_mailman3.context_processors.common', 'hyperkitty.context_processors.common', 'postorius.context_processors.postorius']}}] TEST_NON_SERIALIZED_APPS = [] TEST_RUNNER = 'django.test.runner.DiscoverRunner' THOUSAND_SEPARATOR = ',' TIME_FORMAT = 'P' TIME_INPUT_FORMATS = ['%H:%M:%S', '%H:%M:%S.%f', '%H:%M'] TIME_ZONE = 'UTC' USE_I18N = True USE_L10N = True USE_THOUSAND_SEPARATOR = False USE_TZ = True USE_X_FORWARDED_HOST = True USE_X_FORWARDED_PORT = False WSGI_APPLICATION = 'wsgi.application' X_FRAME_OPTIONS = 'DENY' YEAR_MONTH_FORMAT = 'F Y' ----- End forwarded message ----- -- Alain Williams Linux/GNU Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer. +44 (0) 787 668 0256 https://www.phcomp.co.uk/ Parliament Hill Computers. Registration Information: https://www.phcomp.co.uk/Contact.html #include <std_disclaimer.h>

4 5

Xapian alternatives
by Andrew Bernard Nov. 11, 2025

Nov. 11, 2025

Are there alternative search engines to Xapian that can be used for Mailman 3? I have come to understand that Xapian development stalled in the v2.0 attempt.

5 8

Sendgrid experiences
by Andrew Hodgson Oct. 6, 2025

Oct. 6, 2025

Hi. I am temporarily using Sendgrid now on my Mailman instance. Initial observations have been positive. A list with 100 users is racking up email delivers though, I am on the basic paid account which gives me 50k emails per month. I was hoping to use a cheaper provider and pay overage costs per email on the assumption that I'm seeing a spike in traffic today because people have started getting the messages again. Sendgrid is maintaining the Message-Id header which is good for archiving. It is re-writing the Return-Path header though which means that bounce handling in Mailman won't work, but I think all the services do this in some way so I am happy to live with that for the moment. Hope this helps. Andrew.

10 24

The MAILMAN_ARCHIVER_KEY was not sent as the Authorization HTTP header.
by Marco Marinello Sept. 23, 2025

Sept. 23, 2025

Hi everybody, as per subject, I'm getting this error in the hyperkitty log when mailman daemon tries to archive a mail. I've setup the hyperkitty.cfg file with api_key = MAILMAN_ARCHIVER_KEY in settings_local.py but still nothing. I've seen here and in GitLab issues some errors concerning a wrong api key but here it says that it wasn't sent at all. All packages installed via pip install + latest .zip release, including mailman-hyperkitty. Currently running on apache with mod_wsgi_py3 without https. Any clue? All the best, Marco Marinello

4 12

HSTS Missing from HTTPS Server
by jkoral＠luc.edu Sept. 17, 2025

Sept. 17, 2025

In my configuration, I am using Apache to reverse proxy the requests to a uwsgi. After our security office scanned the server, it was shown that HSTS is missing from the HTTPS server. The instructions say to add some lines to /etc/apache2/sites-enabled/. The only file in there is 000-default.conf that holds the configuration, but the VirtualHost is port 80. I am using an F5 to to automatically redirect port 80 to port 443, but it is still showing this vulnerability. My question is, how can enable the Virtual Host for 443 on the server? Or can that configuration be located somewhere else? Or can I just create a new Virtual Host with the added configuration for mailman? Thanks, Joe Koral

3 2

Errors while importing mm2 list archives
by Odhiambo Washington Sept. 9, 2025

Sept. 9, 2025

MM3-3.3.7, Hyperkitty-1.3.6 While importing, I encountered several of this error: <CUT> MySQLdb.OperationalError: (1366, "Incorrect string value: '\\xF0\\x9F\\x98\\x8A, ...' for column 'content' at row 1") The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/management/commands/hyperkitty_import.py", line 232, in from_mbox add_to_list(self.list_address, message) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/lib/incoming.py", line 153, in add_to_list email.save() File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/base.py", line 812, in save self.save_base( File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/base.py", line 863, in save_base updated = self._save_table( File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/base.py", line 1006, in _save_table results = self._do_insert( File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/base.py", line 1047, in _do_insert return manager._insert( File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/manager.py", line 85, in manager_method return getattr(self.get_queryset(), name)(*args, **kwargs) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/query.py", line 1791, in _insert return query.get_compiler(using=using).execute_sql(returning_fields) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/sql/compiler.py", line 1660, in execute_sql cursor.execute(sql, params) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/backends/utils.py", line 67, in execute return self._execute_with_wrappers( File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/backends/utils.py", line 80, in _execute_with_wrappers return executor(sql, params, many, context) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/backends/utils.py", line 89, in _execute return self.cursor.execute(sql, params) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/utils.py", line 91, in __exit__ raise dj_exc_value.with_traceback(traceback) from exc_value File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/backends/utils.py", line 89, in _execute return self.cursor.execute(sql, params) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/backends/mysql/base.py", line 75, in execute return self.cursor.execute(query, args) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/MySQLdb/cursors.py", line 206, in execute res = self._query(query) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/MySQLdb/cursors.py", line 319, in _query db.query(q) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/MySQLdb/connections.py", line 254, in query _mysql.connection.query(self, query) django.db.utils.OperationalError: (1366, "Incorrect string value: '\\xF0\\x9F\\x98\\x8A, ...' for column 'content' at row 1") </CUT> That occurred several times, but the import process went all the way, to 99% then came to the point below. Message 253d9d44-cc3e-fed1-144b-34da88c52b39(a)emailplus.org failed to import, skipping Computing thread structure Synchronizing properties with Mailman 904 emails left to refresh, checked 0 764 emails left to refresh, checked 0 Warming up cache Traceback (most recent call last): File "/opt/mailman/mm/venv/bin/django-admin", line 8, in <module> sys.exit(execute_from_command_line()) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/core/management/__init__.py", line 446, in execute_from_command_line utility.execute() File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/core/management/__init__.py", line 440, in execute self.fetch_command(subcommand).run_from_argv(self.argv) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/core/management/base.py", line 402, in run_from_argv self.execute(*args, **cmd_options) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/core/management/base.py", line 448, in execute output = self.handle(*args, **options) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/management/commands/hyperkitty_import.py", line 411, in handle call_command("hyperkitty_warm_up_cache", list_address) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/core/management/__init__.py", line 198, in call_command return command.execute(*args, **defaults) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/core/management/base.py", line 448, in execute output = self.handle(*args, **options) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/management/commands/hyperkitty_warm_up_cache.py", line 53, in handle self.warm_up_mlist(mlist, options) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/management/commands/hyperkitty_warm_up_cache.py", line 61, in warm_up_mlist for thread in mlist.recent_threads: File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/models/mailinglist.py", line 162, in recent_threads return self.cached_values["recent_threads"]() File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/models/common.py", line 58, in __call__ return self.get_or_set(*args, **kwargs) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/models/mailinglist.py", line 317, in get_or_set return [Thread.objects.get(pk=pk) for pk in thread_ids] File "/opt/mailman/mm/venv/lib/python3.9/site-packages/hyperkitty/models/mailinglist.py", line 317, in <listcomp> return [Thread.objects.get(pk=pk) for pk in thread_ids] File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/manager.py", line 85, in manager_method return getattr(self.get_queryset(), name)(*args, **kwargs) File "/opt/mailman/mm/venv/lib/python3.9/site-packages/django/db/models/query.py", line 650, in get raise self.model.DoesNotExist( hyperkitty.models.thread.Thread.DoesNotExist: Thread matching query does not exist. (venv) [mailman@gw ~/mm]$ Should I take it that the import was successful, or what should I do next? PS: This is the 1st run after installing MM3 on this server and the MM3 list hasn't gone live. So if anything, I am okay with doing what needs to be done and rerun the import. TIA -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-)

4 14

after last upgrade I've got a CSRF failed verification
by Guillermo Hernandez (Oldno7) Sept. 5, 2025

Sept. 5, 2025

I did upgrade one of my mailman3 server after Abhilasj announcement: "I am pleased to announce several new releases for GNU Mailman project. 1. Mailman Core 3.3.6 1 <https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.…> 2. Postorius 1.3.7 2 <https://docs.mailman3.org/projects/postorius/en/latest/news.html#section-2> 3. Hyperkitty 1.3.6 [3] 4. Mailmanclient 3.3.4 [4] 5. Django-mailman3 1.3.8 [5]" I did it via pip and all seems to be working, but when I try to discard or accept any message via postorius it shows a Forbidden 403 error CSRF verification failed. In my settings.py I have commented out these variables: # Other security settings # SECURE_SSL_REDIRECT = True # If you set SECURE_SSL_REDIRECT to True, make sure the SECURE_REDIRECT_EXEMPT # contains at least this line: # SECURE_REDIRECT_EXEMPT = [ # "archives/api/mailman/.*", # Request from Mailman. # ] # SESSION_COOKIE_SECURE = True # SECURE_CONTENT_TYPE_NOSNIFF = True # SECURE_BROWSER_XSS_FILTER = True # CSRF_COOKIE_SECURE = True # CSRF_COOKIE_HTTPONLY = True # X_FRAME_OPTIONS = 'DENY' I've been messing with them whith no results. It's like it lacked some value in some template... Can someone, please, point me in the right direction? Thanks in advance -- ___________________________________________ Mailman's content filtering has removed the following MIME parts from this message. Content-Type: image/png Name: firma-GHP-emails.png Replaced multipart/alternative part with first alternative.

3 8

Missing Base64 encoding from control message reply
by lists-mailman3＠janaberger.de Aug. 22, 2025

Aug. 22, 2025

Dear all, I have a setup with GNU Mailman 3.3.8 where a user tried to subscribe. When replying to the "confirm" message, the user received a completely garbled response, like so: N�z˥��ʋ�zf��&��j��u�[zZ0:��v��,j�z֢��k�e�0 4Dҹ��r�^b��r�ߊ��*'��yם��{ax�L�X��0:��v��,j�z֢��k�d�m�-��zz�rn��l]y+��-E�( �^N��'��M��tۯ��Mz��^i��׮��}�o�\ӷ��6sN�zf��ݮ��r��z˥��b�{h��݉��f�r�ne== (The line above contains numerous unprintable characters, etc.) The user then forwarded the .eml file to me, which clearly shows the contents of the mail as plain text while being announced as base64 (Content-Transfer-Encoding: base64): START OF EML Return-Path: <LISTNAME-bounces(a)lists.DOMAIN.COM> Received: from DOMAIN.COM ([144.76.173.241]) by mx-ha.USERDOMAIN.NET (mx06 [IP]) with ESMTPS (Nemesis) id 1M27WV-1qhRFk39Sr-00AQcR for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:37 +0200 Received: from localhost (localhost.localdomain [127.0.0.1]) by DOMAIN.COM (Postfix) with ESMTP id 4058B3BD5EEF for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:37 +0200 (CEST) Received: from DOMAIN.COM ([127.0.0.1]) by localhost (DOMAIN.COM [127.0.0.1]) (amavis, port 10024) with ESMTP id x0ngnlRnGraH for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:37 +0200 (CEST) Received: from [IP] (unknown [IP]) by DOMAIN.COM (Postfix) with ESMTP id DC8603BD5EEE for <USER(a)USERDOMAIN.NET>; Thu, 21 Sep 2023 19:10:36 +0200 (CEST) Subject: =?utf-8?q?The_results_of_your_email_commands?= From: LISTNAME-bounces(a)lists.DOMAIN.COM To: USER(a)USERDOMAIN.NET Content-Transfer-Encoding: base64 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Message-ID: <169531623416.29.5762261018677554285@mailman-core> Date: Thu, 21 Sep 2023 17:10:34 +0000 Precedence: bulk X-Mailman-Version: 3.3.8 List-Id: <LISTNAME.lists.DOMAIN.COM> List-Help: <mailto:LISTNAME-request@lists.DOMAIN.COM?subject=help> List-Owner: <mailto:LISTNAME-owner@lists.DOMAIN.COM> List-Subscribe: <mailto:LISTNAME-join@lists.DOMAIN.COM> List-Unsubscribe: <mailto:LISTNAME-leave@lists.DOMAIN.COM> Envelope-To: <USER(a)USERDOMAIN.NET> X-Spam-Flag: NO The results of your email command are provided below. - Original message details: From: USER <USER(a)USERDOMAIN.NET> Subject: Re: Your confirmation is needed to join the LISTNAME(a)lists.DOMAIN.COM mailing list. Date: Thu, 21 Sep 2023 19:10:26 +0200 Message-ID: <3c1eaaf8-1677-432f-b9dc-07f18902c06c(a)email.android.com> - Results: Confirmation token did not match - Done. END OF EML Is this possibly a bug in Mailman? Any ideas on what else could be causing this?

7 16

Upgrading other python packages than the mailman ones in a venv results in dependency conflicts
by Ulf R. July 29, 2025

July 29, 2025

Hello, I know this should be the way to upgrade: https://docs.mailman3.org/en/latest/upgrade-guide.html I have 3.3.10 installed. I saw that some python packages are outdated an tried this which install all outdated packages in a row: pip list --outdated --format=json | jq '.[].name' | xargs -n1 pip install -U One outdated package was django and this part happened: ------------------------------- vDownloading Django-5.1.4-py3-none-any.whl (8.3 MB) Installing collected packages: Django Attempting uninstall: Django Found existing installation: Django 4.2.16 Uninstalling Django-4.2.16: Successfully uninstalled Django-4.2.16 ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts. hyperkitty 1.3.12 requires django<5.1,>=4.2, but you have django 5.1.4 which is incompatible. mailman-web 0.0.9 requires django<4.3,>=4.0, but you have django 5.1.4 which is incompatible. postorius 1.3.13 requires django<5.1,>=4.2, but you have django 5.1.4 which is incompatible. django-mailman3 1.3.15 requires django<5.1,>=4.2, but you have django 5.1.4 which is incompatible. Successfully installed Django-5.1.4 ------------------------------- So I made a roll back. Is this really the only secure way to update the venv?: pip install -U mailman postorius django-mailman3 hyperkitty mailman-web May be yes and I have to ignore the rest? ;-) Thank you und regards

5 6