Mailman appears to send an email to a closed list, from a member who was removed from that list
My project is doing testing of our mailing lists and came across what appears to be a bug. I believe it's not but she insists that it is. So before I do a bunch of research I wanted to post my steps to reproduce and ask for input. I'm including the full (redacted) mailing list config at the bottom of this post for reference.
- I have a closed mailing list, acme-closed@foo.com
- That mailing list has multiple subscribers, including user-1. I confirmed this by shelling into our server and running
mailman members acme-closed@foo.com --role=anyon the OS command line. This showed all of the subscribers, including user-1. - I sent an mail FROM user-1 TO acme-closed, and it was received. And by that I mean I received an email TO acme-closed, FROM user-1. I also received the same email emails sent to the other subscribers since I use a catch all address for local testing.
- In our system I closed user-1's account (which removes that user from the mailing list). I confirmed this by running the
mailman memberscommand and noting that user-1 was no longer a subscriber. - I sent another mail FROM user-1 TO acme-closed, and received two emails. One showed what appears to be a successful send to the mailing list. It showed acme-closed as the TO address, and user-1 as the sender. But I also received a second email TO user-1 FROM acme-closed whose body reads "Your message to the Acme-closed mailing-list was rejected for the following reasons: The message is not from a list member. The original message as received by Mailman is attached."
So my PM is insistent that the first email is proof that there's a bug. "No e-mail sent from an e-mail address for a closed account should be sent to the mailing list." I on the other hand am arguing that the second email is proof that the email _wasn't_ actually sent to the list, and was instead a sort of bounceback to the user, However it's tough to argue with her logic because I agree the first email seems to have been incorrectly sent.
Can you help me understand why the first email was sent, and if there's a way to prove with certainty that Mailman is behaving correctly?
accept_these_nonmembers: []
acceptablealias: []
admin_immed_notify: True
admin_notify_mchanges: True
administrators: [5 <Members>]
administrivia: True
advertised: False
allow_list_posts: True
anonymous_list: False
archive_policy: ArchivePolicy.private
archive_rendering_mode: ArchiveRenderingMode.text
autorespond_owner: ResponseAction.none
autorespond_postings: ResponseAction.none
autorespond_requests: ResponseAction.none
autoresponse_grace_period: 90 days, 0:00:00
autoresponse_owner_text:
autoresponse_postings_text:
autoresponse_request_text:
bounce_info_stale_after: 7 days, 0:00:00
bounce_matching_headers:
bounce_notify_owner_on_bounce_increment: False
bounce_notify_owner_on_disable: True
bounce_notify_owner_on_removal: True
bounce_score_threshold: 5
bounce_you_are_disabled_warnings: 3
bounce_you_are_disabled_warnings_interval: 7 days, 0:00:00
bounces_address: acme-closed-bounces@foo.com
collapse_alternatives: True
convert_html_to_plaintext: False
created_at: 2025-07-18 17:22:54.921936
data_path: /var/mailman/lists/acme-closed.@foo.com
default_member_action: Action.accept
default_nonmember_action: Action.reject
description: closed
digest_is_default: False
digest_last_sent_at: None
digest_members: []
digest_send_periodic: True
digest_size_threshold: 30.0
digest_volume_frequency: DigestFrequency.monthly
digests_enabled: True
discard_these_nonmembers: []
display_name: Acme-closed
dmarc_addresses: []
dmarc_mitigate_action: DMARCMitigateAction.munge_from
dmarc_mitigate_unconditionally: False
dmarc_moderation_notice:
dmarc_wrapped_message_text:
domain: <Domain @foo.com>
emergency: False
encode_ascii_prefixes: False
filter_action: FilterAction.discard
filter_content: False
filter_extensions: []
filter_types: []
first_strip_reply_to: None
forward_auto_discards: True
forward_unrecognized_bounces_to: UnrecognizedBounceDisposition.discard
fqdn_listname: acme-closed@foo.com
gateway_to_mail: False
gateway_to_news: False
hold_these_nonmembers: []
id: 2
include_rfc2369_headers: True
info:
join_address: acme-closed-join@foo.com
last_digest_recipients: []
last_post_at: 2025-07-18 17:26:28.155475
leave_address: acme-closed-leave@foo.com
linked_newsgroup:
list_id: acme-closed.@foo.com
list_name: acme-closed
mail_host: @foo.com
max_days_to_hold: 0
max_message_size: 20000
max_num_recipients: 0
member_moderation_notice:
member_roster_visibility: RosterVisibility.moderators
members: [6 members]
metadata: MetaData()
moderator_password: None
moderators: [5 Members]
newsgroup_moderation: NewsgroupModeration.none
next_digest_number: 1
next_request_id: 1
nntp_prefix_subject_too: True
no_reply_address: noreply@foo.com
nonmember_rejection_notice:
nonmembers: [2 Members]
obscure_addresses: True
owner_address: acme-closed-owner@foo.com
owner_chain: default-owner-chain
owner_pipeline: default-owner-pipeline
owners: []
pass_extensions: []
pass_types: []
personalize: Personalization.none
post_id: 2
posting_address: acme-closed@foo.com
posting_chain: default-posting-chain
posting_pipeline: default-posting-pipeline
preferred_language: <Language [en] English (USA)>
process_bounces: False
regular_members: [6 Members]
reject_these_nonmembers: []
reply_goes_to_list: ReplyToMunging.no_munging
reply_to_address: None
request_address: acme-closed-request@foo.com
require_explicit_destination: True
respond_to_post_requests: False
scrub_nondigest: False
send_goodbye_message: False
send_welcome_message: False
subject_prefix: [Acme-closed]
subscribe_address: acme-closed-subscribe@foo.com
subscribers: 13 Members]
subscription_policy: SubscriptionPolicy.moderate
topics: []
topics_bodylines_limit: 5
topics_enabled: False
unsubscribe_address: acme-closed-unsubscribe@foo.com
unsubscription_policy: SubscriptionPolicy.confirm
usenet_watermark: None
volume: 1
Even without reading your list config, I'm restraining myself from saying something about your PM. What is a MuA supposed to do? To tell you that it's refused to send an email? 😂
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
On Fri, Jul 18, 2025, 21:08 Andy Matthews <andy@commadelimited.com> wrote:
My project is doing testing of our mailing lists and came across what appears to be a bug. I believe it's not but she insists that it is. So before I do a bunch of research I wanted to post my steps to reproduce and ask for input. I'm including the full (redacted) mailing list config at the bottom of this post for reference.
- I have a closed mailing list, acme-closed@foo.com
- That mailing list has multiple subscribers, including user-1. I confirmed this by shelling into our server and running
mailman members acme-closed@foo.com --role=anyon the OS command line. This showed all of the subscribers, including user-1.- I sent an mail FROM user-1 TO acme-closed, and it was received. And by that I mean I received an email TO acme-closed, FROM user-1. I also received the same email emails sent to the other subscribers since I use a catch all address for local testing.
- In our system I closed user-1's account (which removes that user from the mailing list). I confirmed this by running the
mailman memberscommand and noting that user-1 was no longer a subscriber.- I sent another mail FROM user-1 TO acme-closed, and received two emails. One showed what appears to be a successful send to the mailing list. It showed acme-closed as the TO address, and user-1 as the sender. But I also received a second email TO user-1 FROM acme-closed whose body reads "Your message to the Acme-closed mailing-list was rejected for the following reasons: The message is not from a list member. The original message as received by Mailman is attached."
So my PM is insistent that the first email is proof that there's a bug. "No e-mail sent from an e-mail address for a closed account should be sent to the mailing list." I on the other hand am arguing that the second email is proof that the email _wasn't_ actually sent to the list, and was instead a sort of bounceback to the user, However it's tough to argue with her logic because I agree the first email seems to have been incorrectly sent.
Can you help me understand why the first email was sent, and if there's a way to prove with certainty that Mailman is behaving correctly?
accept_these_nonmembers: [] acceptablealias: [] admin_immed_notify: True admin_notify_mchanges: True administrators: [5 <Members>] administrivia: True advertised: False allow_list_posts: True anonymous_list: False archive_policy: ArchivePolicy.private archive_rendering_mode: ArchiveRenderingMode.text autorespond_owner: ResponseAction.none autorespond_postings: ResponseAction.none autorespond_requests: ResponseAction.none autoresponse_grace_period: 90 days, 0:00:00 autoresponse_owner_text: autoresponse_postings_text: autoresponse_request_text: bounce_info_stale_after: 7 days, 0:00:00 bounce_matching_headers: bounce_notify_owner_on_bounce_increment: False bounce_notify_owner_on_disable: True bounce_notify_owner_on_removal: True bounce_score_threshold: 5 bounce_you_are_disabled_warnings: 3 bounce_you_are_disabled_warnings_interval: 7 days, 0:00:00 bounces_address: acme-closed-bounces@foo.com collapse_alternatives: True convert_html_to_plaintext: False created_at: 2025-07-18 17:22:54.921936 data_path: /var/mailman/lists/acme-closed.@foo.com default_member_action: Action.accept default_nonmember_action: Action.reject description: closed digest_is_default: False digest_last_sent_at: None digest_members: [] digest_send_periodic: True digest_size_threshold: 30.0 digest_volume_frequency: DigestFrequency.monthly digests_enabled: True discard_these_nonmembers: [] display_name: Acme-closed dmarc_addresses: [] dmarc_mitigate_action: DMARCMitigateAction.munge_from dmarc_mitigate_unconditionally: False dmarc_moderation_notice: dmarc_wrapped_message_text: domain: <Domain @foo.com> emergency: False encode_ascii_prefixes: False filter_action: FilterAction.discard filter_content: False filter_extensions: [] filter_types: [] first_strip_reply_to: None forward_auto_discards: True forward_unrecognized_bounces_to: UnrecognizedBounceDisposition.discard fqdn_listname: acme-closed@foo.com gateway_to_mail: False gateway_to_news: False hold_these_nonmembers: [] id: 2 include_rfc2369_headers: True info: join_address: acme-closed-join@foo.com last_digest_recipients: [] last_post_at: 2025-07-18 17:26:28.155475 leave_address: acme-closed-leave@foo.com linked_newsgroup: list_id: acme-closed.@foo.com list_name: acme-closed mail_host: @foo.com max_days_to_hold: 0 max_message_size: 20000 max_num_recipients: 0 member_moderation_notice: member_roster_visibility: RosterVisibility.moderators members: [6 members] metadata: MetaData() moderator_password: None moderators: [5 Members] newsgroup_moderation: NewsgroupModeration.none next_digest_number: 1 next_request_id: 1 nntp_prefix_subject_too: True no_reply_address: noreply@foo.com nonmember_rejection_notice: nonmembers: [2 Members] obscure_addresses: True owner_address: acme-closed-owner@foo.com owner_chain: default-owner-chain owner_pipeline: default-owner-pipeline owners: [] pass_extensions: [] pass_types: [] personalize: Personalization.none post_id: 2 posting_address: acme-closed@foo.com posting_chain: default-posting-chain posting_pipeline: default-posting-pipeline preferred_language: <Language [en] English (USA)> process_bounces: False regular_members: [6 Members] reject_these_nonmembers: [] reply_goes_to_list: ReplyToMunging.no_munging reply_to_address: None request_address: acme-closed-request@foo.com require_explicit_destination: True respond_to_post_requests: False scrub_nondigest: False send_goodbye_message: False send_welcome_message: False subject_prefix: [Acme-closed] subscribe_address: acme-closed-subscribe@foo.com subscribers: 13 Members] subscription_policy: SubscriptionPolicy.moderate topics: [] topics_bodylines_limit: 5 topics_enabled: False unsubscribe_address: acme-closed-unsubscribe@foo.com unsubscription_policy: SubscriptionPolicy.confirm usenet_watermark: None volume: 1
Mailman-users mailing list -- mailman-users@mailman3.org To unsubscribe send an email to mailman-users-leave@mailman3.org https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ Archived at: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message/...
This message sent to odhiambo@gmail.com
Odhiambo, I can understand her confusion. The second email with the rejection notice makes complete sense. But why did it also send the first email, which appears to have gone to the list?
Andy Matthews wrote on 2025-07-18 12:05:
But why did it also send the first email, which appears to have gone to the list?
Does that email from user-1 show in the list's archives?
Can you confirm if other list members received a copy?
I'm just wondering if a "superuser" received a copy as a form of notification...
Hrm. It doesn't appear that other list members received the email.
How would I look up the message in the list archives?
Andy Matthews wrote on 2025-07-18 12:47:
How would I look up the message in the list archives?
On the list's main page, there's an "Info" tab with a link to the Archives.
URL probably looks something like:
https://lists.domain.tld/archives/list/talk@lists.domain.tld/
On 7/18/25 11:07 AM, Andy Matthews wrote:
- I sent another mail FROM user-1 TO acme-closed, and received two emails. One showed what appears to be a successful send to the mailing list.
What was the content of this message including all headers?
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
I determined that while there's still an "extra" email being landing in my text inbox, it is NOT going to the mailing list because it does not have the list name prefixed to the subject.
participants (4)
-
Andy Matthews -
Mark Sapiro -
Odhiambo Washington -
Ron