On this page
A mailing list that keeps the original From: address and adds a footer often breaks DKIM, so messages bounce once the sender domain uses p=reject. Lists that rewrite From: to the list’s own address still deliver cleanly under DMARC. If you run or join a list, knowing which behavior you have avoids surprise bounces after you tighten policy.
What happens when someone posts
A member sends mail to the list address. Their own domain usually has a valid DKIM signature and SPF that matches their mail server. That works for ordinary replies to people. The list software then rebuilds and resends the message from its own servers, which is a different path on the wire.
Why footers and tags break alignment
Many lists add a footer, a subject tag, or extra headers. Any change to a signed body invalidates a simple DKIM signature that covered that body. The list still sends From: the member, from the list’s IP. SPF fails because that IP is not in the member’s SPF. DKIM fails because the body changed. With DMARC at p=reject on the member domain, receivers discard the post. From the members’ side, the list simply stops working.
Rewrite From: or leave the signed body alone
Lists that set From: to the list address (or a plus-address they control) and put the member in Reply-To stay aligned. Their own SPF and DKIM apply, so DMARC can pass. Members still follow the thread through Reply-To. Lists that keep the original From: must not alter signed parts. ARC can help some receivers, but not all of them. Mailman and solid ESPs offer a “munge From” style option. Turn that on before you move domains that post to p=reject.
External services such as Google Groups follow their own rules. Test with p=none and read your rua reports before you enforce. If rua shows org=google.com failing alignment on From: your domain, that is Groups traffic, not random spam. Decide whether those posts need a From: rewrite or a dedicated address you control.
If you only receive list mail and do not run a list, you do not need to change the mailbox. If you run “a list” as a pile of forwarders on this server, stop and move it into real list software that understands DMARC, then enforce policy.
Tagged
Was this article helpful?
Be the first to rate this article.
