Forum OpenACS Q&A: acs-mail-lite and spam control (SPF)

Collapse
1: acs-mail-lite and spam control (SPF)
Posted by Michael Totschnig on 09/02/08 06:28 PM
Hello,

A user of one of our instances told me that mails sent out by the bulk-mail package get classified as spam by his spam filter because its sender does not match SPF record.
Has anybody already dealt with such a problem and knows if tcllib's smtp package which acs-mail-lite uses, can set the envelope sender to something different then the one in the From header?

Michael

Collapse
2: Re: acs-mail-lite and spam control (SPF) (response to 1)
Posted by Patrick Giagnocavo on 09/02/08 06:49 PM
You can just add more info into the SPF record. Usually however the smtp package does the equivalent of [ns_info hostname] I believe.
Collapse
3: Re: acs-mail-lite and spam control (SPF) (response to 2)
Posted by Michael Totschnig on 09/03/08 06:05 PM
Thank you Patrick for your answer.
But the problem is that the mail that goes out of my system seems to have an envelope sender set to the email of the user writing the bulk mail message. That is at least what the SPF error report says:

--
< some.foreign.domain > rejected a message that claimed an envelope sender address of < mailto:user@email.address >.

< some.foreign.domain > received a message from < my.domain > (< ip.address >) that claimed an envelope sender address of < mailto:user@email.address >.

However, the domain < foreign.domain > has declared using SPF that it does not send mail through < my.domain > (< ip.address >). That is why the message was rejected.
--

Obviously I have no influence on some.foreign.domain's SPF record.
Is there something wrong on my setup, or is the SPF system flawed?

Regards,

Michael

Collapse
4: Re: acs-mail-lite and spam control (SPF) (response to 3)
Posted by Patrick Giagnocavo on 09/04/08 01:26 AM
SPF is doing what it is supposed to. What I recommend you do, is to find the code and change it to suit your purposes.

For instance, you could programmatically change mailto:patrick@zill.net (my email address) to mailto:bounce-patrick+zill.net@yourdomain.com, then set up your mail server to collect all messages addressed to bounce* at yourdomain.com to go into a mailbox that you monitor to ensure that users are not abusing your server.

Collapse
5: Re: acs-mail-lite and spam control (SPF) (response to 4)
Posted by Michael Totschnig on 09/04/08 11:23 AM
This is an interesting suggestion, but shouldn't there be a possibility to set the envelope sender to mydomain.com, and keep the user's address in the From header?
Collapse
6: Re: acs-mail-lite and spam control (SPF) (response to 1)
Posted by Emmanuelle Raffenne on 09/04/08 08:18 PM
Hi Michael,

Until 5.3, the envelope sender was set to a bounce address of the domain of the openacs instance. Unfortunately that has been lost during the refactoring of acs-mail-lite for 5.4.

I just committed a patch to both HEAD and oacs-5-4 to set the envelope sender using the bounce address, as it used to be, and to pass it to smtp::sendmessage using the -originator switch. That should fix your problem.

Collapse
7: Re: acs-mail-lite and spam control (SPF) (response to 6)
Posted by Michael Totschnig on 09/09/08 11:46 AM
This is good news. Thank you Emmanuelle!