- Mailman-users - lists.mailman3.org

How well does DMARC mitigation work nowadays?
by tom＠tomsmyth.ca Sept. 28, 2025

Sept. 28, 2025

Specifically the kind where all list emails come from the the same address, with the sender in Reply-To? It seems like this /should/ be the way it works. Isn't that what Reply-To is for? Do some email clients still mess it up? If they do, wouldn't it make sense to just send them a bounce notice and tell them to clean up their act? Context: considering moving to a paid email service like Mailgun or Twilio and having random unverified email addresses in the From: header seems to be a nonstarter for them, which makes sense.

3 2

CSV Export in Postorius only export email addresses but no names
by Flo Sept. 28, 2025

Sept. 28, 2025

Hi, I want to export the addresses of a mailing list in Postorius. At the List Members section I found 'CSV Export'. However it only exports the email addresses without the names. Is there a trick to make this happen? Thank you. Flo

2 1

Discrepancy in date time of archived message
by Mark Sept. 26, 2025

Sept. 26, 2025

Mailman Core Version GNU Mailman 3.3.10 (Tom Sawyer) Mailman Core API Version 3.1 Mailman Core Python Version 3.11.2 (main, Sep 14 2024, 03:00:30) [GCC 12.2.0] Installation VENV Hi, I have a message posted to a list on 25 September at 20:57 UTC. The server is set to UTC and the date command shows it has the correct date and time. And I received the message ---- 25 September at 20:57 UTC But the message is shown (incorrectly) in the archive as having been posted on 26 September at 8:57 a.m. (out by +12 hours) It should be shown as 25 September 8:57 p.m. Any pointers on where I can adjust/correct this date/time setting for future posts? Thanks, Mark D

2 2

The MAILMAN_ARCHIVER_KEY was not sent as the Authorization HTTP header.
by Marco Marinello Sept. 23, 2025

Sept. 23, 2025

Hi everybody, as per subject, I'm getting this error in the hyperkitty log when mailman daemon tries to archive a mail. I've setup the hyperkitty.cfg file with api_key = MAILMAN_ARCHIVER_KEY in settings_local.py but still nothing. I've seen here and in GitLab issues some errors concerning a wrong api key but here it says that it wasn't sent at all. All packages installed via pip install + latest .zip release, including mailman-hyperkitty. Currently running on apache with mod_wsgi_py3 without https. Any clue? All the best, Marco Marinello

4 12

After server upgrade debian 11→12 and reinstalling everything in (venv), I got this error when accessing → mailman3/lists
by Wikinaut Sept. 23, 2025

Sept. 23, 2025

File "/opt/mailman/venv/lib/python3.11/site-packages/mailmanclient/restbase/connection.py", line 160, in call raise HTTPError(params.get('url'), response.status_code, urllib.error.HTTPError: HTTP Error 500: {"title": "500 Internal Server Error"} ERROR 2025-08-16 19:26:03,720 6588 django.request Internal Server Error: /mailman3/lists/mylist.myserver.tld Can anyone help? Other things do work, including archives, users, domains etc.

4 29

Settings, Message Acceptance, Discard these non-members
by Philip Bondi Sept. 22, 2025

Sept. 22, 2025

Hello to all: We receive quite a bit of spam. I try to maintain some regular expressions in "Discard these non-members" to block spammers. Where would the "discard" notification be logged? I think the docs say "mailman.log". What would I search for?

2 1

Settings | Alter Messages, Settings | DMARC Mitigations
by Philip Bondi Sept. 22, 2025

Sept. 22, 2025

Hello to all: I thought I should share. We have: Anonymous List: No DMARC mitigation action: Wrap the message in an outer message From: the list. But our message weren't being wrapped. After I period of months, I experimented. Now I've realized that "DMARC wrapped message text" must contain some message. Now our messages are wrapped.

2 1

/etc/logrotate.d/mailman3 and issue #931
by Philip Bondi Sept. 21, 2025

Sept. 21, 2025

Hello to everyone: You are all superheroes. Thank you for your coaching. I would like to share my experience with this post https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message… I still had issue #931 after suggested work-around, so I used the following: /opt/mailman/venv_mm/var/logs/*.log { daily dateext rotate 90 maxage 90 missingok sharedscripts postrotate if [ -r /opt/mailman/venv_mm/var/master.pid ]; then #sudo -u mailman /opt/mailman/venv_mm/bin/mailman restart &>/dev/null || true systemctl restart mailmanweb mailman3 fi if [ -r /opt/mailman/venv_mm/var/gunicorn.pid ]; then PID=`cat /opt/mailman/venv_mm/var/gunicorn.pid` kill -s USR1 $PID fi endscript }

2 1

Need to mass remove all unsubscription requests from server
by zachr＠mta.ca Sept. 19, 2025

Sept. 19, 2025

Thanks in advance for any help! I tried the steps in this post: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/… But I tried changing the 'pend-type' to 'unsubscription' and 'un-subscription' neither of which worked: >>> pendings = getUtility(IPendings) >>> for token, data in pendings.find( ... token_owner=TokenOwner.subscriber, ... pend_type='un-subscription'): ... pendings.confirm(token, expunge=True) ... >>> commit() I would like to remove all un-subscription requests from all lists on the server. Cheers

2 3

Postfix and Rspamd reject all Mailman messages after upgrading to Mailcow 2025-09b
by Jesper Holck Sept. 18, 2025

Sept. 18, 2025

Thanks for looking into this. I'm sorry to admit that I unfortunately mixed up two apparently unrelated issues. The first of these was some problem, where my mailman-installation was unable to send mails to some subscribers. The mails were rejected with SPOOFED_UNAUTH messages - I will not deal with this here. My installation is based on Debian 12 (Bookworm), with dockerized versions of Mailcow and Mailman 3 as described here: https://docs.mailcow.email/third_party/mailman3/third_party-mailman3/ The server is a VM, running on Proxmox. Mailcow and Mailman are on the same VM. It took a little time for me to setup things correctly, but mostly it seemed to work nicely. But a week ago it stopped working - I guess because I upgraded Mailcow to 2025-09b. The problem for me right now is that Rspamd rejects all messages, coming from Mailman. Postfix receives mails coming to the mailing lists, but when Mailman tries to forward the mails to the subscribers, Postfix/Rspamd block all of them. Postfix/Rspamd also block mails sent directly from Mailman, such as Welcome-messages - see an example below. In Mailcow, I have under "Options" added 172.19.199.1/24 as a "Forwarding Host" with no spam filter. I hoped this would make Rspamd happy, but apparently not. All messages, sent directly from Mailcow, pass various on-line tests of SSL, SPF, DKIM, and DMARC, and are accepted by other servers (Gmail, Hotmail etc.). All web-interfaces to Mailcow and Mailman work fine. Messages to the various lists are archived, but not sent to the subscribers. Any help appreciated :-) Jesper Example of rspamd rejecting a welcome message from Mailman: HFILTER_HOSTNAME_UNKNOWN (8.5) DMARC_POLICY_QUARANTINE (8) [mydomain.dk : No valid SPF, No valid DKIM, quarantine] R_SPF_FAIL (8) [-all] HFILTER_HELO_BADIP (4.5) [172.19.199.4, 1] VIOLATED_DIRECT_SPF (3.5) FORGED_W_BAD_POLICY (3) RDNS_NONE (2) SUBJ_EXCESS_QP (1.2) MIME_BASE64_TEXT_BOGUS (1) MID_RHS_NOT_FQDN (0.5) MIME_BASE64_TEXT (0.1) RBL_SENDERSCORE_REPUT_9 (-1) [172.19.199.1:from] MAILLIST (-0.2) [mailman] MIME_GOOD (-0.1) [text/plain] HAS_LIST_UNSUB (-0.01) BAYES_HAM (-0.005474) [42.14%] BCC (0) FORGED_SENDER_MAILLIST (0) ARC_SIGNED (0) [mydomain.dk:s=dkim:i=1] TO_DOM_EQ_FROM_DOM (0) FORGED_SENDER (0) [mylist-request(a)mydomain.dk, mylist-bounces(a)mydomain.dk] RCPT_COUNT_ONE (0) [1] FROM_NEQ_ENVFROM (0) [mylist-request(a)mydomain.dk, mylist-bounces(a)mydomain.dk] MISSING_XM_UA (0) R_DKIM_NA (0) FROM_NO_DN (0) ARC_NA (0) TO_DN_ALL (0) RCVD_COUNT_ZERO (0) [0] TO_MATCH_ENVRCPT_ALL (0) MIME_TRACE (0) [0:+] PRECEDENCE_BULK (0) I don't know how to see the exact contains, including headers, of this message, unfortunately. My understanding is that e.g. DKIM-headers should be provided my Mailcow, not by Mailman itself. Below are contents of various files that may be relevant: Contents of /opt/docker-mailman/docker-compose.yaml: version: '2' services: mailman-core: image: maxking/mailman-core:0.4 # Use a specific version tag (tag latest is not published) container_name: mailman-core hostname: mailman-core restart: unless-stopped volumes: - /opt/mailman/core:/opt/mailman/ stop_grace_period: 30s links: - database:database depends_on: database: condition: service_healthy environment: - DATABASE_URL=postgresql://mailman:mailmanpass@database/mailmandb - DATABASE_TYPE=postgres - DATABASE_CLASS=mailman.database.postgresql.PostgreSQLDatabase - HYPERKITTY_API_KEY=someapikey ports: - "127.0.0.1:8001:8001" # API - "127.0.0.1:8024:8024" # LMTP - incoming emails networks: mailman: (lines cut here) networks: mailman: driver: bridge ipam: driver: default config: - subnet: 172.19.199.0/24 Contents of /opt/docker-mailman/docker-compose.override.yaml: version: '2' services: mailman-core: environment: - DATABASE_URL=postgresql://mailman:vbxsV0Rx7Srqyirc6HzfX6H4qRjo1s@database/mailmandb - HYPERKITTY_API_KEY=3lKR1K6eLuuTA5vxhjQbUGZus8WioQ - TZ=Europe/Berlin - MTA=postfix restart: always networks: - mailman (lines cut here) Contents of /opt/mailcow-dockerized/docker-compose.yml: services: (lines cut here) rspamd-mailcow: image: ghcr.io/mailcow/rspamd:2.3 stop_grace_period: 30s depends_on: - dovecot-mailcow - clamd-mailcow environment: - TZ=${TZ} - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1} - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} - SPAMHAUS_DQS_KEY=${SPAMHAUS_DQS_KEY:-} volumes: - ./data/hooks/rspamd:/hooks:Z - ./data/conf/rspamd/custom/:/etc/rspamd/custom:z - ./data/conf/rspamd/override.d/:/etc/rspamd/override.d:Z - ./data/conf/rspamd/local.d/:/etc/rspamd/local.d:Z - ./data/conf/rspamd/plugins.d/:/etc/rspamd/plugins.d:Z - ./data/conf/rspamd/lua/:/etc/rspamd/lua/:ro,Z - ./data/conf/rspamd/rspamd.conf.local:/etc/rspamd/rspamd.conf.local:Z - ./data/conf/rspamd/rspamd.conf.override:/etc/rspamd/rspamd.conf.override:Z - rspamd-vol-1:/var/lib/rspamd restart: always hostname: rspamd dns: - ${IPV4_NETWORK:-172.22.1}.254 networks: mailcow-network: aliases: - rspamd (lines cut here) postfix-mailcow: image: ghcr.io/mailcow/postfix:1.81 depends_on: mysql-mailcow: condition: service_started unbound-mailcow: condition: service_healthy postfix-tlspol-mailcow: condition: service_started volumes: - ./data/hooks/postfix:/hooks:Z - ./data/conf/postfix:/opt/postfix/conf:z - ./data/assets/ssl:/etc/ssl/mail/:ro,z - postfix-vol-1:/var/spool/postfix - crypt-vol-1:/var/lib/zeyple - rspamd-vol-1:/var/lib/rspamd - mysql-socket-vol-1:/var/run/mysqld/:z environment: - LOG_LINES=${LOG_LINES:-9999} - TZ=${TZ} - DBNAME=${DBNAME} - DBUSER=${DBUSER} - DBPASS=${DBPASS} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME} - SPAMHAUS_DQS_KEY=${SPAMHAUS_DQS_KEY:-} cap_add: - NET_BIND_SERVICE ports: - "${SMTP_PORT:-25}:25" - "${SMTPS_PORT:-465}:465" - "${SUBMISSION_PORT:-587}:587" restart: always dns: - ${IPV4_NETWORK:-172.22.1}.254 networks: mailcow-network: ipv4_address: ${IPV4_NETWORK:-172.22.1}.253 aliases: - postfix (lines cut here) netfilter-mailcow: image: ghcr.io/mailcow/netfilter:1.62 stop_grace_period: 30s restart: always privileged: true environment: - TZ=${TZ} - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1} - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n} - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} - MAILCOW_REPLICA_IP=${MAILCOW_REPLICA_IP:-} - DISABLE_NETFILTER_ISOLATION_RULE=${DISABLE_NETFILTER_ISOLATION_RULE:-n} network_mode: "host" volumes: - /lib/modules:/lib/modules:ro (lines cut here) networks: mailcow-network: driver: bridge driver_opts: com.docker.network.bridge.name: br-mailcow enable_ipv6: ${ENABLE_IPV6:-true} ipam: driver: default config: - subnet: ${IPV4_NETWORK:-172.22.1}.0/24 - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} (lines cut here) Contents of /opt/mailcow-dockerized/docker-compose.override.yml: services: postfix-mailcow: volumes: - /opt/mailman:/opt/mailman networks: - docker-mailman_mailman rspamd-mailcow: # https://docs.mailcow.email/post_installation/firststeps-dmarc_reporting/ environment: - MASTER=${MASTER:-y} labels: ofelia.enabled: "true" ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: "@every 24h" ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\"" ofelia-mailcow: depends_on: - rspamd-mailcow networks: docker-mailman_mailman: external: true On Monday, September 15, 2025 10:23 CEST, "Stephen J. Turnbull" <steve(a)turnbull.jp> wrote: jesper.holck--- via Mailman-users writes: > My problem is not related to anonymous lists. But messages from my > lists are blocked by mailcow/rspamd, unless I set "DMARC mitigation > action" to "Wrap the message in an outer message From: the list". > Here is an example: We really need to see the corresponding headers. We also need to know more about the configuration of your network (including VMs and containers), and where you're sending mail from. If you are going to substitute IP addresses, I recommend you do that consistently, and with a convention that it makes is easy to identify the public Internet (I use 10/8 addresses for this), your internal network (I use 172.16/12), and the Mailman host(s) (I use 192.168/16 addresses -- these are all just suggestions, and I've never had a problem ignoring the effect of netmasks on routing).[1] I'm going to reorder the list for clarity. > HFILTER_HOSTNAME_UNKNOWN (8.5) > HFILTER_HELO_BADIP (4.5) [172.19.199.3, 1] > RDNS_NONE (2) I guess "HFILTER" refers to the HELO command sent by Mailman to mailcow. "host 172.19.199.3" is a private IP address, so I suspect you are using Docker with multiple containers (different hosts as far as the mail software is concerned). I suspect you need to set up or reconfigure an internal DNS, or configure some kind of host list in Mailcow, to clear this. IIRC rspamd defaults to "reject on >= 15" so if RDNS is part of this group (I'm just guessing), this message is already rejected. > DMARC_POLICY_QUARANTINE (8) [mydomain.dk : No valid SPF, quarantine] Apparently you have p=quarantine for mydomain.dk. Mail from mydomain.dk will need to have DMARC mitigation of some kind. > R_SPF_FAIL (8) [-all] > R_DKIM_REJECT (8) [anotherdomain.dk:s=selector1] I'd say these are normal, except that between them "reject > 15" is going to reject your message. I would guess that's an rspamd misconfiguration. Also, nothing in your description explains why anotherdomain.dk is signing the message. Is that your personal email provider where you send test messages? > VIOLATED_DIRECT_SPF (3.5) > FORGED_W_BAD_POLICY (3) Not sure what these mean, but the numbers are too big to ignore. Perhaps they'll be fixed in passing if you fix the issues above. > HTML_SHORT_LINK_IMG_1 (2) You can't do much about this, but if your posters are using short links you might see if you can adjust that deduction down in rspamd. Everything below is either favorable or you can ignore it as normal. > ARC_REJECT (0.1) [signature check failed: fail, {[1] = sig:mydomain.dk:reject}] > RCVD_NO_TLS_LAST (0.1) > MIME_BASE64_TEXT (0.1) > BAYES_SPAM (0.00002) [21.41%] > RBL_SENDERSCORE_REPUT_9 (-1) [172.19.199.1:from] > MAILLIST (-0.2) [mailman] > MIME_GOOD (-0.1) [multipart/mixed, multipart/related, multipart/alternative, text/plain] > HAS_LIST_UNSUB (-0.01) > FROM_HAS_DN (0) > RCPT_COUNT_ONE (0) [1] > FROM_NEQ_ENVFROM (0) [test(a)mydomain.dk, test-bounces(a)mydomain.dk] > TO_EQ_FROM (0) > FORGED_SENDER_MAILLIST (0) > RCVD_COUNT_THREE (0) [3] > HAS_REPLYTO (0) [Jesper.Holck(a)anotherdomain.dk] > PREVIOUSLY_DELIVERED (0) [test(a)mydomain.dk] > REPLYTO_DOM_NEQ_FROM_DOM (0) > REPLYTO_DOM_NEQ_TO_DOM (0) > TO_DN_EQ_ADDR_ALL (0) > FORGED_RECIPIENTS_MAILLIST (0) > DKIM_TRACE (0) [anotherdomain.dk:-] > MISSING_XM_UA (0) > FORGED_SENDER (0) [test(a)mydomain.dk, test-bounces(a)mydomain.dk] > MIME_TRACE (0) [0:+, 1:+, 2:+, 3:+, 4:~, 5:~, 6:+] > TAGGED_RCPT (0) > BCC (0) Footnotes: [1] I use 10/8, 172.16/12), and 192.168/16 addresses, respectively, for public, internal, and Mailman nodes. I've never had a problem ignoring the effect of netmasks on routing, it's all directly addressable. This works because when you've got a Docker network or similar, you can have network problems, but you'd never get to rspamd. These are all just suggestions, of course. -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan

4 3