Subject: [spfbis] [meta-issue] Mis-use of MAIL FROM for list authentication

From: Stuart Gathman <[email-masked]>
Date: Wed, 4 May 2016 13:40:03 -0400

I'm behind on my own promised volunteer work, so I'm only posting this
to make sure it is on record as a problem.

When I post to the spfbis mailing list, I have to confirm my posting, as
the list uses MAIL FROM to identify the poster, and my MAIL FROM is
variable to make it signed and possible to validate:

  Return-Path: <SRS0=42CRp=Q5==[email-masked]>

However, the list *should* be looking at the From: header, which is also
signed and validated by ietf:

    Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key)
     header.d=gathman.org

...

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gathman.org;
     i=@gathman.org; 
     q=dns/txt; s=default; t=1462377254; h=Subject : To : References : From 
     : Message-ID : Date : MIME-Version : In-Reply-To : Content-Type : 
     Content-Transfer-Encoding : Subject : From : Date; 
     bh=Js7wvPmM6OkBsT0VkhJyck4Jg+rOjGMFiYq5n6Cz+cw=; 
     b=HwaPU2ZDgnjpOuYpxzCfkuPTSQreyv8qmEJbILAo34G7GHZ9a8BFpt7F/pnY+c/KiQxJif
     an5OyFCbN8gW4GT3rry3jTAPyhsxBcUuH/bQPKAn9hjQAIMptGQLTzbXB+Tu5rj20h6MKzmS
     Qh8VelFuCBRnGmE2C1YIp2KFcHSwI=

...

    From: Stuart Gathman <[email-masked]>

---

From: S Moonesamy <[email-masked]>
Date: Wed, 04 May 2016 11:29:57 -0700

Hi Stuart,
At 10:40 04-05-2016, Stuart Gathman wrote:
>When I post to the spfbis mailing list, I have to confirm my 
>posting, as the list uses MAIL FROM to identify the poster, and my 
>MAIL FROM is variable to make it signed and possible to validate:
>
>   Return-Path: 
> <mailto:SRS0=42CRp=Q5==[email-masked]><SRS0=42CRp=Q5==[email-masked]>
>
>However, the list *should* be looking at the From: header, which is 
>also signed and validated by ietf:

I am one of the list moderators for this mailing list.  The above is 
about an operational issue.  I can enquire about the issue or you, or 
anyone else, could send an email to [email-masked] to enquire 
[1] about this issue.

Regards,
S. Moonesamy

1. http://www.ietf.org/contact.html

---

From: Dave Crocker <[email-masked]>
Date: Wed, 4 May 2016 13:13:35 -0700

Never one to consider the obvious as above mentioning, but I do 
appreciate the irony of this (frankly entirely valid 0complaint, given 
the nature of SPF's basic authentication premise...

d/

On 5/4/2016 11:29 AM, S Moonesamy wrote:
>> When I post to the spfbis mailing list, I have to confirm my posting,
>> as the list uses MAIL FROM to identify the poster, and my MAIL FROM is
> anyone else, could send an email to [email-masked] to enquire [1]
> about this issue.
>
> Regards,
> S. Moonesamy
>
> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis
>

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net