Top.Mail.Ru
[tech] ALERT: Yahoo and AOL users, all list admins - Sibylla Bostoniensis — LiveJournal
? ?

Fri, Jun. 6th, 2014, 03:57 pm
[tech] ALERT: Yahoo and AOL users, all list admins

If you have an email address at yahoo.com or aol.com please be advised that Yahoo and AOL have made your email address a poison pill to email lists.

If you try to post to any modern email list that has automatic bounce processing (e.g. Mailman) with a yahoo.com or aol.com address:

1) When your post goes out over the list and a copy is delivered to yourself it will be BOUNCED by Yahoo/AOL as forbidden, and the bounce will go back to the list server which will unsubscribe you, and,

2) Even more hilariously, when your post is delivered to any other DMARC-using company -- which is at the very least is all the other subscribers with accounts on Gmail, Hotmail (Outlook.com) and Comcast, as well as any fellow AOL and Yahoo users -- it will be bounced from those accounts, too, back to the server, causing subscribers on those services to be unsubscribed too.

How/why is this happening? There's this system (DMARC) which allows an email server to check up on an email, by allowing it to contact the alleged sending server and say, "Did you really send this? Is this email cool?" Yahoo and AOL's DMARC servers are denying the legitimacy of all emails sent across lists.

So when, say, Gmail's email server gets an email for a Gmail account from one "somebodyorother@yahoo.com", Gmail contacts Yahoo, and says, "Dude, I got this from this list server somewhere. Is this really yours?" Yahoo is now replying. "Nope. If it didn't come from me, it's not mine. Got it from a third party? You should totally bounce it. Must be spam."

As a consequence, list owners are preemptively putting all AOL and Yahoo subscribers on moderation so they can't post or just unsubbing them outright.

Now would be an excellent time to have some other email address.

I'm a little preoccupied right now, so don't have the time or spoons to think it through, but my first thought was that this is a problem that might be solvable with aliases, i.e. forwarding addresses, rather than by moving services. (Fellow geeks, is that right?)

P.S. for the geeknoscenti: DMARC is made of SPF, of which, when I learned about it in 2007, I commented, "Is it just me, or is this all incredibly stupid?" Signs point to "This is all incredibly stupid". ITYS.

P.P.S. I think there is a very good chance that this problem with Yahoo and AOL will never be fixed, because Yahoo and AOL court naive users; the vast majority of their users aren't savvy enough to notice or care if there is some functionality which is missing or broken. I'd like to be wrong, but 10+ years of discussing with hosting companies their email policies suggests that I am not. That suggests that anyone who wants fully featured grown-up email will have to move somewhere else.

But on the other hand, I think there's a seriously non-zero chance this practice will spread to other free email services, simply because of the economics of the thing, and because of a particular problem in American psychology (concerning how we think about identity, about which I would like to post, but busy). Moving may not work in the longer term.

Fri, Jun. 6th, 2014 08:50 pm (UTC)
alierak

All signs point to Yahoo and AOL considering it a feature, and accepting feedback to the contrary from approximately nobody. So if you run a mailing list, look for the recent hastily released patch to your mailing list software that will attempt to work around the problem. I'm using Listserv, and their most recent version will check the sender's DMARC policy and if it's bad, replace the address with a unique one at my domain. Whee.

Fri, Jun. 6th, 2014 08:51 pm (UTC)
siderea

*rolls eyes* Whee indeed.

Sat, Jun. 7th, 2014 02:11 am (UTC)
ron_newman

So who exactly is violating what internet standard (RFC)? SMTP is supposed to be *simple*.

Sat, Jun. 7th, 2014 09:33 am (UTC)
(Anonymous)

...and the motivation for doing this is...?
I thought Yahoo was in the business of running groups, and therefore lists...?
Are they doing this with their own groups/lists?
Or is this a truly ham handed attempt to say, "it just doesn't work when you try to DIY, just sign up for a handy-dandy Yahoo group"?
Sigh.

Sat, Jun. 7th, 2014 03:08 pm (UTC)
siderea

...quick, somebody with an AOL address, sign up for a yahoo group!

Sat, Jun. 7th, 2014 09:06 pm (UTC)
kelkyag

Yahoo seems to be "fixing" this for their own mailing lists by rewriting the headers such that the sender's address appears in the comment part of the "From:" line with the mailing list as the address. The sender's address also appears at the bottom of the body of the message, and nowhere else useful. Replying to just the sender is now a PITA.

Sun, Jun. 8th, 2014 07:11 pm (UTC)
cellio

I've noticed in the last few days that messages from Yahoo-based mailing lists now all come with from lines like "sender name sender@gmail.com [list name] <listname@yahoogroups.com>". Which, by the way, breaks "reply to sender (only)" if you aren't paying attention (and it requires manual editing, so even people who notice might not do the right thing there). Oh goodie.

Wed, Jun. 18th, 2014 05:46 pm (UTC)
jducoeur

I agree with most of this, but:

2) Even more hilariously, when your post is delivered to any other DMARC-using company -- which is at the very least is all the other subscribers with accounts on Gmail, Hotmail (Outlook.com) and Comcast, as well as any fellow AOL and Yahoo users -- it will be bounced from those accounts, too, back to the server, causing subscribers on those services to be unsubscribed too.

Haven't seen this happen, at least with Gmail. What *does* happen is that you get a flood of emails from Yahoo and AOL users in your Spam folder. (And if you tell Google that no, this isn't spam, all of those messages show up with Big Yellow Warnings that amount to, "We told you so".)

But yeah, DMARC is a remarkable piece of fail. I could imagine ways to have possibly done this without massive fail, but those require having both patience and respect for your users...