Odd behavior: notifications for list membership, etc. from "owner user" sent as "owner user"?
Tracing down an issue of "why are we no longer receiving owner notices" such as list membership changes, moderation list items, etc. we are seeing errors in MS365 side of things about "failing to deliver".
Upon deeper trackdown of this, our owner user mailman@example.com is seeing messages sent to it from @lists.example.com and @distro.example.com from mailman@example.com (despite the From in the envelope being list-bounces+mailman=example.com@[lists|distro].example.com)
Is there any specific reason for this? Is it because the MS365 side is ignoring the Envelope's From address and relying on the actual *from* field which is breaking things because MS365 users are "not allowed to send as [lists|distro].example.com"? This seems highly suspicious if this is the case, and I want to see if there's anything we can do on the Mailman side of things to make this 'work' for the 365 recipient (mailman@example.com is a shared mailbox for the IT team in this case, so it's a legitimate user).
On 7/10/26 09:01, Thomas Ward via Mailman-users wrote:
Upon deeper trackdown of this, our owner user mailman@example.com is seeing messages sent to it from @lists.example.com and @distro.example.com from mailman@example.com (despite the From in the envelope being list-bounces+mailman=example.com@[lists|distro].example.com)
These messages are sent to (envelope recipients) the list admins but with a To: header of `list-owner@...` and a From: header of the address configured as the site_owner in mailman.cfg. You can change the From: from the site owner address to the `list-owner@...` address with a patch like: ``` --- a/src/mailman/email/message.py +++ b/src/mailman/email/message.py @@ -237,10 +237,11 @@ class OwnerNotification(UserNotification): if roster is None: recipients = set([config.mailman.site_owner]) to = config.mailman.site_owner + sender = config.mailman.site_owner else: recipients = set(address.email for address in roster.addresses) to = mlist.owner_address - sender = config.mailman.site_owner + sender = mlist.owner_address super().__init__(recipients, sender, subject, text, mlist.preferred_language) # Envelope sender ``` -- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
On 2026-07-10 12:58, Mark Sapiro wrote:
On 7/10/26 09:01, Thomas Ward via Mailman-users wrote:
Upon deeper trackdown of this, our owner user mailman@example.com is seeing messages sent to it from @lists.example.com and @distro.example.com from mailman@example.com (despite the From in the envelope being list-bounces+mailman=example.com@[lists|distro].example.com)
These messages are sent to (envelope recipients) the list admins but with a To: header of `list-owner@...` and a From: header of the address configured as the site_owner in mailman.cfg. That introduces a problem too... the list-owner is *also* the site owner mailman@example.com.
Short of me hardcoding an alternative (noreply@mailman.example.com) or such, or just changing site owner address, that will break some things. (site owner is IT - IT also owns all lists).
You can change the From: from the site owner address to the `list-owner@...` address with a patch like: ``` --- a/src/mailman/email/message.py +++ b/src/mailman/email/message.py @@ -237,10 +237,11 @@ class OwnerNotification(UserNotification): if roster is None: recipients = set([config.mailman.site_owner]) to = config.mailman.site_owner + sender = config.mailman.site_owner else: recipients = set(address.email for address in roster.addresses) to = mlist.owner_address - sender = config.mailman.site_owner + sender = mlist.owner_address super().__init__(recipients, sender, subject, text, mlist.preferred_language) # Envelope sender ```
On 7/10/26 10:14, Thomas Ward wrote:
That introduces a problem too... the list-owner is *also* the site owner mailman@example.com.
No. My patch will make the address literally list-owner@..., not the
owner's actual address.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Ah, check, I misread.
I'll apply this patch and we can see if this fixes things.
Thomas
On 7/10/26 13:51, Mark Sapiro wrote:
On 7/10/26 10:14, Thomas Ward wrote:
That introduces a problem too... the list-owner is *also* the site owner mailman@example.com.
No. My patch will make the address literally
list-owner@..., not the owner's actual address.
As always, Mark may have better ideas.
Thomas Ward via Mailman-users writes:
Tracing down an issue of "why are we no longer receiving owner notices" such as list membership changes, moderation list items, etc. we are seeing errors in MS365
<img src="friends-dont-let-friends.gif"/>
What is MS365 complaining about? Do you get an informative status, or is it just 5.7.0 administratively denied, or what?
Upon deeper trackdown of this, our owner user mailman@example.com
By "owner user" I assume you mean mailman@example.com is the common list owner for all lists, and not the site owner specified in mailman.cfg.
is seeing messages sent to it from @lists.example.com and @distro.example.com from mailman@example.com
"From" here means RFC 822 From? That seems like correct behavior to me. Mailman has no way to know that "mailman@example.com" is the IT team/site owner/OWNER OF ALL THE THINGS. It doesn't treat it any differently than it would "foo@bar.baz", and so just sticks it in "From". That is RFC 822-ly correct.
(despite the From in the envelope being list-bounces+mailman=example.com@[lists|distro].example.com)
This is to ensure that bounces due to messages originated from the list host go back to the list host for normal bounce processing. Again, Mailman has no reason to think that mailman@example.com can do anything about bouncing mail that originated at *.example.com (or example.com, for that matter).
Is there any specific reason for this [error by MS365]?
The only thing I can think of offhand (aside from the snide "MSFT is always at fault" meme which you should discount but not to zero, it's like DNS that way) is DMARC policy for the three domains. If the subdomains sign as the subdomains, and the policy of the parent domain is p=reject, you will have delivery failures. I suspect the bounces are just handed to the bounce processor which increments the bounce count for mailman@example.com, but if that's not subscribed to a Mailman list I doubt it has any visible effect.
I guess it's also possible that there's a malmail filter that doesn't like mail from me to myself, which is pretty common with spam and phishing in my experience.
It might make a difference whether the various Mailman domains are handled by separate instances, or if they are virtual domains handled by a single instance, though I can't think offhand of any reason why it would matter, other than making the DMARC scenario more likely if they're separate instances.
Is it because the MS365 side is ignoring the Envelope's From address and relying on the actual *from* field which is breaking things because MS365 users are "not allowed to send as [lists|distro].example.com"?� This seems highly suspicious if this is the case,
Could be, but the very similar DMARC policy hypothesis should also be checked.
and I want to see if there's anything we can do on the Mailman side of things to make this 'work' for the 365 recipient (mailman@example.com is a shared mailbox for the IT team in this case, so it's a legitimate user).
I don't see how stock Mailman can help you (especially not without figuring out what is giving MS365 indigestion). There are strong reasons for the formatting of both RFC 822 From and the envelope From. If you want it to treat mailman@example.com specially (either when it is list owner or globally) you'll need to hack Mailman's email origination code.
-- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan
On 2026-07-10 13:28, Stephen J. Turnbull wrote:
As always, Mark may have better ideas.
Thomas Ward via Mailman-users writes:
Tracing down an issue of "why are we no longer receiving owner notices" such as list membership changes, moderation list items, etc. we are seeing errors in MS365
<img src="friends-dont-let-friends.gif"/>
What is MS365 complaining about? Do you get an informative status, or is it just 5.7.0 administratively denied, or what?
<snip>
The actual problem appears to be *after* delivery. It is handed to MS365 and then MS365 says the very annoying failure message ONLY in the MS Exchange logs of "Sending from the lists.example.com domain has been blocked by your email admin."
The additional problem is that MS365 is seeing the 'sender' as the actual 'account' in MS365 and is probably complaining. What I can't tell is *why* it's hard-failing this way.
Given that the issue is intrinsic to the setup and we can't really change it (I don't want to diverge from the tree too much), I think I'll have to raise this with Microsoft to see what's going on. I may temporarily reset everything to email *me* instead temporarily, see what is actually going on. But we'll see what happens.
Thomas
participants (3)
-
Mark Sapiro -
Stephen J. Turnbull -
Thomas Ward