The mailing list for listmasters using Sympa

[Patrick von der Hagen <address@concealed>]

Hi all,

currently spamcop is giving me quite a headache.... again....

We have been blacklisted several time now due to autoresponders by our 
mailinglist-software. Messages like "your mail is waiting for 
moderator-approval", "you are not authorized to send messages to this 
private list", etc.

Basically, I believe mail must not disappear. It must either reach the 
recipient or it must be returned to the sender as a bounce-message.
However, there is the problem of colateral spam. Someone forges a 
sender-address, sends spam, listserv/sympa/whatever processes the spam 
and bounces later, sending an unwanted response to an innocent third-party.

We still run listserv, but I'm evaluating alternatives. If sympa had 
better bounce-processing (e.g. VERP) it would probably place first, but 
since a large percentage of my users heavily use forwards, the bounces 
usually won't contain the adress subscribed to sympa and therefore 
sympa-bounce-processing currently is quite insufficient...

I certainly know that sympa would be much better suited for us, since it 
would be possible to say "only sent autoresponder if the mail is not 
considered to be spam by SpamAssassin", which can't be done by listserv. 
Thus the number of autoresponders would be greatly reduced, hitting less 
innocent third-parties.

However, I try to imagine the best way possible to handle the problem.
I hope to reduce this problem by moving the step of "send a bounce after 
processing by mailinglist-software" forward in the processing-chain, so 
that before accepting a message, the MTA verifies if the 
mailinglist-software would cause a bounce to be sent and in that case 
reject the mail.

There would be several ways to accomplish this, either by extending 
mailinglist-software like sympa by an smtp-daemon or by providing an 
interface to query "wouldThisCauseABounce address@concealed 
address@concealed". The query result could be "5xx private list, 
sender-address not authoized". Thus, if some spam-bot tries to sent a 
spam-message and is rejected, it probably wouldn't bother sending a 
bounce to the third-party, thus reducing overal trouble.

Integration with sendmail, postfix or exim should be quite easy, 
considering the interfaces provided by those MTAs.

So in the end I'd like to see something like

> mail from: address@concealed
< 200 go ahead
> rcpt to: address@concealed
< 550 sender not allowed for this mailinglist

Using sendmail or exim it could even be extended to include the 
message-body, but I'm not sure about postfix...


Could this be done using sympa? Well, it would certainly be possible, 
but could it be accomplished with acceptable effort? Or would a major 
rewrite be needed?
Do others consider my thoughts to be ok, sensible or just dumb and stupid?

What do others expect in the short or in the middle term? Do you 
experience spamcop-problems due to autoresponders now or do you expect 
to face them? Do you expect problems due to SPF, SRS, Domainkeys etc.? 
Personally, I deeply distrust SPF and SRS, but feat that they might gain 
further support.

Do you expect mailinglists to work like they do now in one year? In two 
years? Or will there be more integration with web-forum-software? 
Perhaps web-forums will feed to mailinglists, but web-submission might 
be a standard-way for submission to mailinglists?
Will the number of mailinglists be reduced due to more usage of RSS/Atom 
or other feeds that might at least challenge announce-only-mailinglists?
What else do you expect? Where will we (=mailinglist-users, 
maillinglist-owners, listmasters) be in two years?

Hmmmm, this e-mail is probably much more confused now, than I intended 
it to be.... hoping for your answers and creative ideas, though.


--
CU,
   Patrick.