Subject: [Tools-discuss] Postconfirm - allow authenticated From address of list subscribers?

From: Jesse Thompson <[email-masked]>
Date: Tue, 30 Nov 2021 20:58:45 +0000

Hello tools-discuss,

I was redirected to this list by IETF support, after he resolved the following issue for me.

When I switched employment I used an email address within one of my personal email domains to resubscribe to the dmarc list, so I had a good archive. Naturally, I used this address to attempt to send to the list, since that address was already subscribed. The service I use is hosted by a provider which sends DKIM and SPF passing mail aligned to my domain's DMARC policy. It uses a unique return path address (relaxed SPF-aligned) for each outbound message for purposes of bounce and spam complaint processing. I have no ability to send another message with the same return path address, as a result.

After sending the message I received a reply saying that my return path address isn't subscribed to the list, and I simply need to reply back (from that address) in order for the message to be posted. But I can't do that, as stated above.

Support confirmed that this is the current behavior of Postconfirm; to use the envelope from address to determine if the message author is a subscriber. He subsequently created an exemption for me, and I followed up with the following question, which he recommended I ask on this list:

I'm curious if you have an expert opinion about whether it would ever be appropriate to modify Postconfirm to use the address in the From header to validate the identity of the subscriber, assuming the SPF and/or DKIM results are properly aligned to the domain? I'm mostly curious as to the validity of this idea as an emerging best practice as DMARC becomes more widely adopted, vs. whether there are specific reasons why the envelope from address would still need to be the only supported identifier. This feedback would be useful for me to provide to my email hosting provider.

Thanks,
Jesse Thompson