You can rewrite almost anything using your mailserver. For instance in postfix, see:

https://serverfault.com/questions/344104/rewrite-from-address-of-all-outgoin...

However, I have found that this doesn't work in a practical sense a lot of the time because spam filters and blacklists notice it -- reverse name resolution doesn't work.

I run a very small mailinglist for forensic pathologists to allow them to discuss cases anonymously. Since many of our cases can have political burdens (e.g. George Floyd), and because of the current political climate in the US, we sometimes cannot speak freely when discussing cases -- and it's important to get "curbside consults" on difficult cases. So I set up an anonymous mailinglist to allow those discussions without as much fear of being persecuted.

My solution has been to go to one of those vendors who will rent you an anonymous vps, buy it with cryptocurrency, get an anonymus domain name (for instance from najalla.la), and set up a server there. My current server is supposedly owned by some name in Turkey. The practical downside of this is that you have to be careful which vendor you use. I got my first server from a vendor that was fairly notorious for supporting spammers, and I found that my ip address was on a number of blacklists -- not because of what *I* had done but because servers on nearby numbers had been spamming and blacklist services now often block broad swaths of numbers on either side of the offender. Thus, if 1.2.3.4 is the spammer and I am at 1.2.3.101, I will still get blacklisted. Yahoo, gmail, att, bellsouth, and others are *very* restrictive.

In order to get around *that* I ended up relaying from my anonymous vendor through one of my non-anonymous servers. Some isps will also block mail that is relayed as well, though.

In fact, one of my not-anonymous servers was a vps hosted by bluehost. I found that I could not even ping or ssh one of my anonymous servers from there. I opened a ticket and found out that the entire class C address range had been firewalled by bluehost.

For awhile, I had aserver on the onion network, and routed my mail:

anonymous clearnet -> onion site -> anonymous clearnet -> users

But -- I'm not sure onionmail is worth the work. It was exhausting to set that up and get it working. I took it down after a few months.

I strongly suggested to my users that they get anonymous email addresses from places like protonmail, whch are sometimes also less restrictive when it comes to blacklisting. Unfortunately, many of my users are not very sophisticated, and insisted on using things like gmail or yahoo.

So, in the end, I had to tailor my relaying and routing for each of the major ISPs. Mail to users from my anonymous site that went to bellsouth went through a different process than those who went to gmail recipients.

Finally, remember that no matter what you do, you will always leave *some* breadcrumbs. One of the nice things about some of these anonymous vps vendors is that you can destroy and create servers on a whim. So, I close down old servers and open up new ones every few months, and transfer the mail service from machine to machine. It requires having disposable domain names and such, and making sure users whitelist them, but they are now a dime a dozen as long as you don't mind having nonsense names.

billo

On Tue, 2023-05-09 at 11:00 +0200, Roland Miyamoto via Mailman-users wrote:

Dear community,

Could anyone tell me whether there is a way to hide the sender address of list mails completely from the recipients.

Even for an anonymous list, the sender still occurs in two fields

   envelope-from <sender@sender-domain.tld> X-MailFrom: sender@sender-domain.tld

of the mail header. Is there a way to suppress this information?

   Best wishes, Roland

---

Mailman-users mailing list -- mailman-users@mailman3.org To unsubscribe send an email to mailman-users-leave@mailman3.org https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ Archived at: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message/...

This message sent to billo@billoblog.com

Dear Mark and everyone,

On 09/05/2023 17:12, Mark Sapiro wrote:

Anonymous lists should be removing any X-MailFrom: or X-Envelope-From: headers from delivered mail. The envelope-from in the outgoing mail should be the list-bounces address, not the original sender. If you are seeing this information in mail from an anonymous list, it is a bug and I would like to see a raw message as received from the list with this information.

Thank you very much for replying so quickly. At the end of this email, I include a message's header received from one of my Mailman3 lists (renamed to ourlist here) with the following settings in the web interface:

Alter Messages • Filter content =Yes • Collapse alternatives= No • Convert html to plaintext=No • Anonymous list= Yes • Include RFC2369 headers= Yes • Include the list post header = No • First strip reply to = Yes • Reply goes to list = Explicit Reply-to set; no Cc added • Pipeline = default-posting-pipeline

DMARC Mitigations • DMARC mitigation action = No DMARC mitigation • DMARC Mitigate unconditionally = No

As you can see, the header contains the sender's address

sender@otherdomain.tld

twice.

Thanks for all your effort,

 Roland

(edited) list header follows

From - Fri Apr 21 23:18:21 2023 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: <ourlist-bounces@list.timebrain.org> Received: from mail.timebrain.org by mail.timebrain.org with LMTP id Ph5sJ0XzQmSxBQAAMe3UBQ (envelope-from <ourlist-bounces@list.timebrain.org>); Fri, 21 Apr 2023 22:34:13 +0200 Received: from timebrain.org (localhost [IPv6:::1]) by mail.timebrain.org (Postfix) with ESMTP id 9110FC0082; Fri, 21 Apr 2023 22:34:13 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=list.timebrain.org; s=202205; t=1682109253; bh=KEcouWpeNLb32k6bFssIJDhe16IGlOZEsBeJOIigkLs=; h=Date:To:In-Reply-To:References:From:Reply-To:Subject:List-Id: List-Help:List-Post:List-Subscribe:List-Unsubscribe:From; b=MmI/E0AHnIway3V//e0KNbYj06VBWcDKGMlK4yA+tPGmgCAnje4NwZM9YXbZk/hc7 FKM8O1RRkfUhC6iCUHMQa28XK4Nr9+45G/Yxl7Tgr8h6qt1B/1myOCLS8Mb+4XSwpm CuShRI812x7GkCWVqpLoRBKwq4CP8j8BdDgN4rmrUF18Mdh0J/kkccV13dJvG9xapB XzUkpqcJICWNyQ/1+GY59VEISP3EBQxUzg6Qkd6a4BXkPKNPCRzVUVM0irvQ0nLi8Z nAKnV7iutn5nKMXOkEfX5K+8HuFm2Ixd1cWnSIfPY7gd0WK0DyjLVgsZIINA6Hnwt5 9fABm1Dsr6YeQ== Received: from mail.timebrain.org (localhost [127.0.0.1]) by mail.timebrain.org (Postfix) with ESMTP id C912FC0082 for <ourlist@list.timebrain.org>; Fri, 21 Apr 2023 22:34:11 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=demonetize.it; s=201907; t=1682109251; bh=799sMT9Q1QA5X8QRdz/ErDUnITC5MNct/qLMzA5zPSA=; h=Date:From:To:Subject:In-Reply-To:References:From; b=KKp8OdYRcEStg4A3qhDgKm4fJQg8U6xPL9w1jbcNJ3BozX8QKqg3NqVC6cbcptHtr 9tUzsc1WBCYy1UHH7UOCFXowfNtRu+KlvT8YpBNeGgsa12nZ4Ljhw7IRuENcp1sqyj tnZWWRW8T+wcsJlftOhcCudT59gq1LilZIEPpDNGJ63jgJIX5838IBaz2cXZyHQAWd XMF6uTz/xc5sRutPHWOUtRETHySK0PEI59cpkRz1UvHwDu1opliv4ILZmR4BW32T6a OeK06uv6uhRfH8Gc420zhkp+tYSgUc28Z4G93uDC12MypmKshnsZiR52MUFZp1JM8X eJGEpnGP7xHew== Received: from [IPv6:::1] ([2a02:560:4ca5:ea00:5c9f:6282:e0ec:582]) by mail.timebrain.org with ESMTPSA id zuaKLUPzQmSnBQAAMe3UBQ (envelope-from <sender@otherdomain.tld>) for <ourlist@list.timebrain.org>; Fri, 21 Apr 2023 22:34:11 +0200 Date: Fri, 21 Apr 2023 22:31:08 +0200 To: Ourlist Ourtown <ourlist@list.timebrain.org> User-Agent: K-9 Mail for Android In-Reply-To: <a8c92d51-66c2-2588-f00c-31146bee2f54@timebrain.org> References: <3e35f420-a766-095e-b79a-afb8e795f011@timebrain.org> <a8c92d51-66c2-2588-f00c-31146bee2f54@timebrain.org> Message-ID: <7AB6FFA2-BDA7-4484-BF14-4CF512A4B8E8@demonetize.it> MIME-Version: 1.0 Message-ID-Hash: 7IYNX33ESBTJZ3M4FGHGGVDBTZ3HGL2B X-Message-ID-Hash: 7IYNX33ESBTJZ3M4FGHGGVDBTZ3HGL2B X-MailFrom: sender@otherdomain.tld X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; suspicious-header From: Our List <ourlist@list.timebrain.org> X-Mailman-Version: 3.2.1 Precedence: list Reply-To: Ourlist Ourtown <ourlist@list.timebrain.org> Subject: [Ourlist] Re: whatever was the topic List-Id: Our List <ourlist.list.timebrain.org> List-Help: <mailto:ourlist-request@list.timebrain.org?subject=help> List-Post: NO List-Subscribe: <mailto:ourlist-join@list.timebrain.org> List-Unsubscribe: <mailto:ourlist-leave@list.timebrain.org> Content-Type: multipart/mixed; boundary="===============6841522137146215921=="

--===============6841522137146215921== Content-Type: multipart/alternative; boundary=----F0JANJPGLDOAM8SUMOY3TD9QT0ZRGF Content-Transfer-Encoding: 7bit

------F0JANJPGLDOAM8SUMOY3TD9QT0ZRGF Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Thanks, Mark,

On 10/05/2023 01:50, Mark Sapiro wrote:

Both this and all other incoming Received: headers are removed from posts to anonymous lists beginning with Mailman 3.3.4. X-MailFrom: headers are also removed as of Mailman 3.3.4.

For clarifying.

I am currently running

GNU Mailman 3.2.1 (La Villa Strangiato)

under Debian buster (10). Seems I will have to upgrade to Debian bookworm (12) if I want to stick with the deb package and want complete anonymity to work.

Or else dive into the virtualenv, which seems to be recommended option anyway.

Thank you very much, for me the question is thereby settled.

Roland

Oops. Sorry for the digression. When I read the question, I thought the OP was asking about making the list itself anonymous -- difficult to find and resistant to subpoena -- not turning on anonymization inside of mailman.

So... never mind

On May 9, 2023 11:12:36 AM EDT, Mark Sapiro <mark@msapiro.net> wrote:

On 5/9/23 02:00, Roland Miyamoto via Mailman-users wrote:

...

Could anyone tell me whether there is a way to hide the sender address of list mails completely from the recipients.

Even for an anonymous list, the sender still occurs in two fields

  envelope-from <sender@sender-domain.tld> X-MailFrom: sender@sender-domain.tld

of the mail header. Is there a way to suppress this information?

Anonymous lists should be removing any X-MailFrom: or X-Envelope-From: headers from delivered mail. The envelope-from in the outgoing mail should be the list-bounces address, not the original sender.

If you are seeing this information in mail from an anonymous list, it is a bug and I would like to see a raw message as received from the list with this information.

-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

---

Mailman-users mailing list -- mailman-users@mailman3.org To unsubscribe send an email to mailman-users-leave@mailman3.org https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ Archived at: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message/...

This message sent to billo@billoblog.com