- Mailman-users - lists.mailman3.org

/etc/logrotate.d/mailman3 and issue #931
by Philip Bondi Sept. 21, 2025

Sept. 21, 2025

Hello to everyone: You are all superheroes. Thank you for your coaching. I would like to share my experience with this post https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message… I still had issue #931 after suggested work-around, so I used the following: /opt/mailman/venv_mm/var/logs/*.log { daily dateext rotate 90 maxage 90 missingok sharedscripts postrotate if [ -r /opt/mailman/venv_mm/var/master.pid ]; then #sudo -u mailman /opt/mailman/venv_mm/bin/mailman restart &>/dev/null || true systemctl restart mailmanweb mailman3 fi if [ -r /opt/mailman/venv_mm/var/gunicorn.pid ]; then PID=`cat /opt/mailman/venv_mm/var/gunicorn.pid` kill -s USR1 $PID fi endscript }

2 1

Need to mass remove all unsubscription requests from server
by zachr＠mta.ca Sept. 19, 2025

Sept. 19, 2025

Thanks in advance for any help! I tried the steps in this post: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/… But I tried changing the 'pend-type' to 'unsubscription' and 'un-subscription' neither of which worked: >>> pendings = getUtility(IPendings) >>> for token, data in pendings.find( ... token_owner=TokenOwner.subscriber, ... pend_type='un-subscription'): ... pendings.confirm(token, expunge=True) ... >>> commit() I would like to remove all un-subscription requests from all lists on the server. Cheers

2 3

Postfix and Rspamd reject all Mailman messages after upgrading to Mailcow 2025-09b
by Jesper Holck Sept. 18, 2025

Sept. 18, 2025

Thanks for looking into this. I'm sorry to admit that I unfortunately mixed up two apparently unrelated issues. The first of these was some problem, where my mailman-installation was unable to send mails to some subscribers. The mails were rejected with SPOOFED_UNAUTH messages - I will not deal with this here. My installation is based on Debian 12 (Bookworm), with dockerized versions of Mailcow and Mailman 3 as described here: https://docs.mailcow.email/third_party/mailman3/third_party-mailman3/ The server is a VM, running on Proxmox. Mailcow and Mailman are on the same VM. It took a little time for me to setup things correctly, but mostly it seemed to work nicely. But a week ago it stopped working - I guess because I upgraded Mailcow to 2025-09b. The problem for me right now is that Rspamd rejects all messages, coming from Mailman. Postfix receives mails coming to the mailing lists, but when Mailman tries to forward the mails to the subscribers, Postfix/Rspamd block all of them. Postfix/Rspamd also block mails sent directly from Mailman, such as Welcome-messages - see an example below. In Mailcow, I have under "Options" added 172.19.199.1/24 as a "Forwarding Host" with no spam filter. I hoped this would make Rspamd happy, but apparently not. All messages, sent directly from Mailcow, pass various on-line tests of SSL, SPF, DKIM, and DMARC, and are accepted by other servers (Gmail, Hotmail etc.). All web-interfaces to Mailcow and Mailman work fine. Messages to the various lists are archived, but not sent to the subscribers. Any help appreciated :-) Jesper Example of rspamd rejecting a welcome message from Mailman: HFILTER_HOSTNAME_UNKNOWN (8.5) DMARC_POLICY_QUARANTINE (8) [mydomain.dk : No valid SPF, No valid DKIM, quarantine] R_SPF_FAIL (8) [-all] HFILTER_HELO_BADIP (4.5) [172.19.199.4, 1] VIOLATED_DIRECT_SPF (3.5) FORGED_W_BAD_POLICY (3) RDNS_NONE (2) SUBJ_EXCESS_QP (1.2) MIME_BASE64_TEXT_BOGUS (1) MID_RHS_NOT_FQDN (0.5) MIME_BASE64_TEXT (0.1) RBL_SENDERSCORE_REPUT_9 (-1) [172.19.199.1:from] MAILLIST (-0.2) [mailman] MIME_GOOD (-0.1) [text/plain] HAS_LIST_UNSUB (-0.01) BAYES_HAM (-0.005474) [42.14%] BCC (0) FORGED_SENDER_MAILLIST (0) ARC_SIGNED (0) [mydomain.dk:s=dkim:i=1] TO_DOM_EQ_FROM_DOM (0) FORGED_SENDER (0) [mylist-request(a)mydomain.dk, mylist-bounces(a)mydomain.dk] RCPT_COUNT_ONE (0) [1] FROM_NEQ_ENVFROM (0) [mylist-request(a)mydomain.dk, mylist-bounces(a)mydomain.dk] MISSING_XM_UA (0) R_DKIM_NA (0) FROM_NO_DN (0) ARC_NA (0) TO_DN_ALL (0) RCVD_COUNT_ZERO (0) [0] TO_MATCH_ENVRCPT_ALL (0) MIME_TRACE (0) [0:+] PRECEDENCE_BULK (0) I don't know how to see the exact contains, including headers, of this message, unfortunately. My understanding is that e.g. DKIM-headers should be provided my Mailcow, not by Mailman itself. Below are contents of various files that may be relevant: Contents of /opt/docker-mailman/docker-compose.yaml: version: '2' services: mailman-core: image: maxking/mailman-core:0.4 # Use a specific version tag (tag latest is not published) container_name: mailman-core hostname: mailman-core restart: unless-stopped volumes: - /opt/mailman/core:/opt/mailman/ stop_grace_period: 30s links: - database:database depends_on: database: condition: service_healthy environment: - DATABASE_URL=postgresql://mailman:mailmanpass@database/mailmandb - DATABASE_TYPE=postgres - DATABASE_CLASS=mailman.database.postgresql.PostgreSQLDatabase - HYPERKITTY_API_KEY=someapikey ports: - "127.0.0.1:8001:8001" # API - "127.0.0.1:8024:8024" # LMTP - incoming emails networks: mailman: (lines cut here) networks: mailman: driver: bridge ipam: driver: default config: - subnet: 172.19.199.0/24 Contents of /opt/docker-mailman/docker-compose.override.yaml: version: '2' services: mailman-core: environment: - DATABASE_URL=postgresql://mailman:vbxsV0Rx7Srqyirc6HzfX6H4qRjo1s@database/mailmandb - HYPERKITTY_API_KEY=3lKR1K6eLuuTA5vxhjQbUGZus8WioQ - TZ=Europe/Berlin - MTA=postfix restart: always networks: - mailman (lines cut here) Contents of /opt/mailcow-dockerized/docker-compose.yml: services: (lines cut here) rspamd-mailcow: image: ghcr.io/mailcow/rspamd:2.3 stop_grace_period: 30s depends_on: - dovecot-mailcow - clamd-mailcow environment: - TZ=${TZ} - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1} - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} - SPAMHAUS_DQS_KEY=${SPAMHAUS_DQS_KEY:-} volumes: - ./data/hooks/rspamd:/hooks:Z - ./data/conf/rspamd/custom/:/etc/rspamd/custom:z - ./data/conf/rspamd/override.d/:/etc/rspamd/override.d:Z - ./data/conf/rspamd/local.d/:/etc/rspamd/local.d:Z - ./data/conf/rspamd/plugins.d/:/etc/rspamd/plugins.d:Z - ./data/conf/rspamd/lua/:/etc/rspamd/lua/:ro,Z - ./data/conf/rspamd/rspamd.conf.local:/etc/rspamd/rspamd.conf.local:Z - ./data/conf/rspamd/rspamd.conf.override:/etc/rspamd/rspamd.conf.override:Z - rspamd-vol-1:/var/lib/rspamd restart: always hostname: rspamd dns: - ${IPV4_NETWORK:-172.22.1}.254 networks: mailcow-network: aliases: - rspamd (lines cut here) postfix-mailcow: image: ghcr.io/mailcow/postfix:1.81 depends_on: mysql-mailcow: condition: service_started unbound-mailcow: condition: service_healthy postfix-tlspol-mailcow: condition: service_started volumes: - ./data/hooks/postfix:/hooks:Z - ./data/conf/postfix:/opt/postfix/conf:z - ./data/assets/ssl:/etc/ssl/mail/:ro,z - postfix-vol-1:/var/spool/postfix - crypt-vol-1:/var/lib/zeyple - rspamd-vol-1:/var/lib/rspamd - mysql-socket-vol-1:/var/run/mysqld/:z environment: - LOG_LINES=${LOG_LINES:-9999} - TZ=${TZ} - DBNAME=${DBNAME} - DBUSER=${DBUSER} - DBPASS=${DBPASS} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME} - SPAMHAUS_DQS_KEY=${SPAMHAUS_DQS_KEY:-} cap_add: - NET_BIND_SERVICE ports: - "${SMTP_PORT:-25}:25" - "${SMTPS_PORT:-465}:465" - "${SUBMISSION_PORT:-587}:587" restart: always dns: - ${IPV4_NETWORK:-172.22.1}.254 networks: mailcow-network: ipv4_address: ${IPV4_NETWORK:-172.22.1}.253 aliases: - postfix (lines cut here) netfilter-mailcow: image: ghcr.io/mailcow/netfilter:1.62 stop_grace_period: 30s restart: always privileged: true environment: - TZ=${TZ} - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1} - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n} - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n} - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-} - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-} - REDISPASS=${REDISPASS} - MAILCOW_REPLICA_IP=${MAILCOW_REPLICA_IP:-} - DISABLE_NETFILTER_ISOLATION_RULE=${DISABLE_NETFILTER_ISOLATION_RULE:-n} network_mode: "host" volumes: - /lib/modules:/lib/modules:ro (lines cut here) networks: mailcow-network: driver: bridge driver_opts: com.docker.network.bridge.name: br-mailcow enable_ipv6: ${ENABLE_IPV6:-true} ipam: driver: default config: - subnet: ${IPV4_NETWORK:-172.22.1}.0/24 - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} (lines cut here) Contents of /opt/mailcow-dockerized/docker-compose.override.yml: services: postfix-mailcow: volumes: - /opt/mailman:/opt/mailman networks: - docker-mailman_mailman rspamd-mailcow: # https://docs.mailcow.email/post_installation/firststeps-dmarc_reporting/ environment: - MASTER=${MASTER:-y} labels: ofelia.enabled: "true" ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: "@every 24h" ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\"" ofelia-mailcow: depends_on: - rspamd-mailcow networks: docker-mailman_mailman: external: true On Monday, September 15, 2025 10:23 CEST, "Stephen J. Turnbull" <steve(a)turnbull.jp> wrote: jesper.holck--- via Mailman-users writes: > My problem is not related to anonymous lists. But messages from my > lists are blocked by mailcow/rspamd, unless I set "DMARC mitigation > action" to "Wrap the message in an outer message From: the list". > Here is an example: We really need to see the corresponding headers. We also need to know more about the configuration of your network (including VMs and containers), and where you're sending mail from. If you are going to substitute IP addresses, I recommend you do that consistently, and with a convention that it makes is easy to identify the public Internet (I use 10/8 addresses for this), your internal network (I use 172.16/12), and the Mailman host(s) (I use 192.168/16 addresses -- these are all just suggestions, and I've never had a problem ignoring the effect of netmasks on routing).[1] I'm going to reorder the list for clarity. > HFILTER_HOSTNAME_UNKNOWN (8.5) > HFILTER_HELO_BADIP (4.5) [172.19.199.3, 1] > RDNS_NONE (2) I guess "HFILTER" refers to the HELO command sent by Mailman to mailcow. "host 172.19.199.3" is a private IP address, so I suspect you are using Docker with multiple containers (different hosts as far as the mail software is concerned). I suspect you need to set up or reconfigure an internal DNS, or configure some kind of host list in Mailcow, to clear this. IIRC rspamd defaults to "reject on >= 15" so if RDNS is part of this group (I'm just guessing), this message is already rejected. > DMARC_POLICY_QUARANTINE (8) [mydomain.dk : No valid SPF, quarantine] Apparently you have p=quarantine for mydomain.dk. Mail from mydomain.dk will need to have DMARC mitigation of some kind. > R_SPF_FAIL (8) [-all] > R_DKIM_REJECT (8) [anotherdomain.dk:s=selector1] I'd say these are normal, except that between them "reject > 15" is going to reject your message. I would guess that's an rspamd misconfiguration. Also, nothing in your description explains why anotherdomain.dk is signing the message. Is that your personal email provider where you send test messages? > VIOLATED_DIRECT_SPF (3.5) > FORGED_W_BAD_POLICY (3) Not sure what these mean, but the numbers are too big to ignore. Perhaps they'll be fixed in passing if you fix the issues above. > HTML_SHORT_LINK_IMG_1 (2) You can't do much about this, but if your posters are using short links you might see if you can adjust that deduction down in rspamd. Everything below is either favorable or you can ignore it as normal. > ARC_REJECT (0.1) [signature check failed: fail, {[1] = sig:mydomain.dk:reject}] > RCVD_NO_TLS_LAST (0.1) > MIME_BASE64_TEXT (0.1) > BAYES_SPAM (0.00002) [21.41%] > RBL_SENDERSCORE_REPUT_9 (-1) [172.19.199.1:from] > MAILLIST (-0.2) [mailman] > MIME_GOOD (-0.1) [multipart/mixed, multipart/related, multipart/alternative, text/plain] > HAS_LIST_UNSUB (-0.01) > FROM_HAS_DN (0) > RCPT_COUNT_ONE (0) [1] > FROM_NEQ_ENVFROM (0) [test(a)mydomain.dk, test-bounces(a)mydomain.dk] > TO_EQ_FROM (0) > FORGED_SENDER_MAILLIST (0) > RCVD_COUNT_THREE (0) [3] > HAS_REPLYTO (0) [Jesper.Holck(a)anotherdomain.dk] > PREVIOUSLY_DELIVERED (0) [test(a)mydomain.dk] > REPLYTO_DOM_NEQ_FROM_DOM (0) > REPLYTO_DOM_NEQ_TO_DOM (0) > TO_DN_EQ_ADDR_ALL (0) > FORGED_RECIPIENTS_MAILLIST (0) > DKIM_TRACE (0) [anotherdomain.dk:-] > MISSING_XM_UA (0) > FORGED_SENDER (0) [test(a)mydomain.dk, test-bounces(a)mydomain.dk] > MIME_TRACE (0) [0:+, 1:+, 2:+, 3:+, 4:~, 5:~, 6:+] > TAGGED_RCPT (0) > BCC (0) Footnotes: [1] I use 10/8, 172.16/12), and 192.168/16 addresses, respectively, for public, internal, and Mailman nodes. I've never had a problem ignoring the effect of netmasks on routing, it's all directly addressable. This works because when you've got a Docker network or similar, you can have network problems, but you'd never get to rspamd. These are all just suggestions, of course. -- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan

4 3

HSTS Missing from HTTPS Server
by jkoral＠luc.edu Sept. 17, 2025

Sept. 17, 2025

In my configuration, I am using Apache to reverse proxy the requests to a uwsgi. After our security office scanned the server, it was shown that HSTS is missing from the HTTPS server. The instructions say to add some lines to /etc/apache2/sites-enabled/. The only file in there is 000-default.conf that holds the configuration, but the VirtualHost is port 80. I am using an F5 to to automatically redirect port 80 to port 443, but it is still showing this vulnerability. My question is, how can enable the Virtual Host for 443 on the server? Or can that configuration be located somewhere else? Or can I just create a new Virtual Host with the added configuration for mailman? Thanks, Joe Koral

3 2

How to subscribe members without sending unsubscribe message
by Flo Sept. 16, 2025

Sept. 16, 2025

Hi, I need to remove subscribed members without sending them an unsubscription message. Despite of my research I haven't figured out how to do this using the GUI. Can anyone help? Flo

3 3

Problems with SPOOFED_UNAUTH
by M.Ede Sept. 15, 2025

Sept. 15, 2025

Hello everyone, I use mailman together with mailcow and have configured my mailing list as follows: - Anonymous list: Yes - DMARC mitigation action: Replace From: with list address - DMARC Mitigate unconditionally: Yes My problem is that my emails are not being accepted by mailcow (rspamd) with the error SPOOFED_UNAUTH (50.00) In the out-queue of mailman the headers look like this: [QUOTE] Authentication-Results: <my.mailserv.er>; dkim=none; spf=pass (<my.mailserv.er>: domain of sender(a)t-online.de designates 194.25.134.81 as permitted sender) smtp.mailfrom=sender(a)t-online.de; dmarc=pass (policy=none) header.from=t-online.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.<list.domain>; s=dkim; t=1757400255; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zmDaIaGeCj1IT8TuP4aJmXRbfyNHV3LqjIfHveVMS0M=; b=Im4F/mpchty4CJvvcW4ZqxMl0BRNnybjcmkPboUSuodopd7nOXaesj3w6kgIwZkLHn1uHY FOiSSjyfZ8Zu0/w4l4Du5uoij2qDCEYHvGFhEugFizE9HJ71i7x0SzoEVSZ9uve6sqnWaE X8+GqtCE+vf0TLLeKhXKHJaBdltbMSqO+QT0BOlbmOdvmUCy6MIqysocTod9io5/+CQOgd SSvsSdDq00CG1IBUsg0Tm2rSf/L2bpGD3bl7QEBKS2id7NeLFM/Zme/3mkHo0N/u7m47xy XSLS9R0C3Kg/YxHY8ctPt7Yas6fwYfzGAOXRvVJz1eeXSrl8B5vWfzJ8+WrE5Q== ARC-Authentication-Results: i=1; <my.mailserv.er>; dkim=none; spf=pass (<my.mailserv.er>: domain of sender(a)t-online.de designates 194.25.134.81 as permitted sender) smtp.mailfrom=sender(a)t-online.de; dmarc=pass (policy=none) header.from=t-online.de ARC-Seal: i=1; s=dkim; d=lists.<list.domain>; t=1757400255; a=rsa-sha256; cv=none; b=yrD6cRE7c/L/v8D76U5Ohn57/MJ7/VsObkzQdAHbFny5DbyEO8pZvM0VCVYA5hUGXqoqoU nnKpEW6/CqvNIZmsS9hKzQQEdO5yIzNnyYjARcW5w5MpAlkMjmH3dQ68mLIS9SUyXUsoXj m1zAeYmdTjZWQOiYanaNJLRuxCWSFQHOpAljZe/lZt+4llNNA01YqirqGBRe6uMaJoebe6 2ubsHTr6VlfTrBrdFqLLSWyRBls+e0JwOd2jGahaQ6/ZIf4l1dOqdaUHSq31RjEDAiofmK IGeKC97iu3r9LiFsjICyi+/yedMGbwSeyyFMzz+cAV7wM84eWfSx2S2kPP1c9Q== [END QUOTE] When the email arrives at rspamd for verification, the DKIM header is added, but there is also the entry: arc=reject ("signature check failed: fail, {[1] = sig:lists.list.domain:reject}"): [QUOTE] DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.list.domain; s=dkim; t=1757413251; h=from:reply-to:subject:date:message-id:to:mime-version:content-type: content-transfer-encoding:content-language:list-id:list-help: list-owner:list-unsubscribe:list-subscribe:list-post; bh=jH/b69qzW7O+s5h3yE2MxKTwFLElX7b39ILc9yHGhkc=; b=AApU4mb2iuN9u1lYTrIKIcPnB4jzXDX+8vC+2/WwHC8JvCukiR2Std5k3E10cuAyYFhPVk zn6AWY+s6c6HKslDn0RiO3i9QYRLAY5MESxvj0tKO1dKDMz+A8RdcOf4kdO4hDr0DQBf7v yQLLnLjgK8QpZdW8MrlfxcQpQ9XrlyP2GX+ntFh5vDl7frNPXQfnBMoo+l0DIs6SWQuaFX ikrOiISYKugL8TmWXnGohXiAM84W/JT0lvP/Lmt3NjxlyNsAWpHQz736LphydY4r5/JjHI of99pRcbTvEmkZogthHFaXMOG2sDGxGwlIc3+oIUHoXqyY+VLsBQs8FzjR+eaw== Authentication-Results: <my.mailserv.er>; arc=reject ("signature check failed: fail, {[1] = sig:lists.list.domain:reject}") ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.list.domain; s=dkim; t=1757413249; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QSqNoTMweT1jo6F77TLHa+Nh7a0n/g9qDOsUTT8KpQ4=; b=rDgMC26uNsyTPgmddqQOiUsJh25KUa69TeMJfekVn5sFOnvhQdoa9LCogRMMKzJomA0wu6 CCdi6jGJpjtJdzB7PQ8UhQbeFiOUy9JNswFxQ+Qk1GXBxgN892C6KL/DiB/VW1j1nL0xOk Tc0BNC1zH1/MG2hB332t6u/rjWO+PtxIznAdcCP29AhO39RWWY/J0c/CHCOoqFYKCEf1ZH J4Wqeu9ANF44cPwopuJzJioWts6JKRvAM5TjnInZ+HaSv5QmuHvdI0fWvh272O3vGfvEPc iG1QsJS9XWpzkymRjYWo6h1c4/eY7eZd4FEzSR/TtW6Ud9b04A5lUmPpEvTxlQ== ARC-Authentication-Results: i=1; <my.mailserv.er>; dkim=none; dmarc=pass (policy=none) header.from=t-online.de; spf=pass (<my.mailserv.er>: domain of sender(a)t-online.de designates 194.25.134.20 as permitted sender) smtp.mailfrom=sender(a)t-online.de [END QUOTE] What am I still doing wrong? Can you help me, which setting is still missing? What informations are you still missing? Thanks for your help, Matthias

5 25

Postgres upgrade from 13 to 16?
by Dave McGuire Sept. 14, 2025

Sept. 14, 2025

Hi folks, we're running a decent-sized MM3 server backed by a Postgres database server that is also used by a number of other applications. It's currently running Postgres 13, and we are looking at upgrading to 16. Can anyone tell me what the implications of such an upgrade be in the context of Mailman3? Any gotchas? Thanks, -Dave -- Dave McGuire, AK4HZ New Kensington, PA

3 3

2.1 -> 3 migration without mboxes?
by David Romerstein Sept. 12, 2025

Sept. 12, 2025

Hey, folks. I've searched the list archive but haven't found a relevant thread yet. Any pointers would be helpful. I have a handful of lists in a 2.1 instance for which I have web archives but not original .mbox files. Is there a way to migrate those lists, including the years of archives, to 3?

2 1

Issues sending to gmail and yahoo e-mails
by jkoral＠luc.edu Sept. 12, 2025

Sept. 12, 2025

Has anyone experienced recent issues with Mailman3 not being able to send to gmail and yahoo e-mail addresses. I am trying to figure out if Google has our server blocked or not. When I send a manual e-mail from the server, the my yahoo e-mail gets delivered, but the gmail one does not. Here is the message I get in the logs when trying to send to the gmail address from the command line, but I do not get anything when it tries to send from Mailman. 2025-09-09T18:57:09.344493-05:00 lstprdls01 postfix/smtp[3544622]: BE67F1C09AF: to=<jmjk(a)gmail.com>, relay=gmail-smtp-in.l.google.com[173.194.194.26]:25, delay=0.55, delays=0.01/0/0.27/0.27, dsn=5.7.26, status=bounced (host gmail-smtp-in.l.google.com[173.194.194.26] said: 550-5.7.26 Your email has been blocked because the sender is unauthenticated. 550-5.7.26 Gmail requires all senders to authenticate with either SPF or DKIM. 550-5.7.26 550-5.7.26 Authentication results: 550-5.7.26 DKIM = did not pass 550-5.7.26 SPF [lstprdls01.xxx.xxx.edu] with ip: [xxx.xxx.10.33] = did not pass 550-5.7.26 550-5.7.26 For instructions on setting up authentication, go to 550 5.7.26 https://support.google.com/mail/answer/81126#authentication 8926c6da1cb9f-50d8f268ab7si36484097173.142 - gsmtp (in reply to end of DATA command)) I added DMARC mitigation to this list with "Replace From: with list address" and "DMARC Mitigate unconditinally - Yes" The DMARC Address I have in there is ^.*(a)gmail\.com$ Do I have to do anything else? Restart any services or anything?

5 11

Hyperkitty Text/Markdown/HTML
by Sam Darwin Sept. 11, 2025

Sept. 11, 2025

How about a feature to include "HTML" in the current Hyperkitty choices of (Text or Markdown) rendering? A sanitizer must be used to prevent malicious attacks. https://github.com/messense/nh3 . lxml is another package that processes html. A sanitizer would be helpful for more aspects. Permit a limited set of markdown so that messages still appear professional. Gitlab/Github don't allow arbitrary fonts or font sizes, right? Mostly remove these tags. A way that code blocks could be presented: determine an established list of known codeblock styles. Configure the sanitizer to permit this range of fonts or styling elements. By allowing them through the filter, a code styling is rendered. (It is permitted/allowed to be rendered.) Even better, when the sanitizer recognizes the fonts, it replaces them with an "official" set of codeblock fonts. Otherwise, if other font tags are entirely removed, if they are missing, the email client or web ui will decide the font selection, and it will appear "standard". In order for both email clients and Hyperkitty to view the same result, the sanitizer should ideally be applied to outgoing emails as well as rendering in the UI. That means this feature would affect more than just Hyperkitty. (i.e. mailman-core). Although, that could be implemented as a separate step, until which time emails would get a full range of HTML, without sanitizing. In this scheme, ensure outgoing emails are multi-part MIME with plain text and html versions. Some of our users are really in favor of more formatting. Others prefer plain text. Those who prefer plain text have various arguments that HTML messages will be rendered badly, and won't be legible. Questions: 1. Would "multi-part MIME with plain text and html versions both" solve the problem for users who prefer plain text? 2. What percentage of email clients that support HTML formatting when sending will also include a plain text rendering of the same content in the outgoing message? 3. Is it usually the responsibility of a receiving mail client to be able to convert HTML to plain text if the user requests it? 4. When mailman-core receives and then sends out a message, can it receive HTML, generate a plain-text version, and then send both? Thoughts?

3 10