The mailing list for listmasters using Sympa

[Olivier Salaün <address@concealed>]

Hi Patrick,

Sympa is indeed well adapted to cope with spam thanks to its 
authorization scenarios feature. It provides a flexible and easily 
extensible way to express the workflow for each action (including the 
message submition), at different levels (mailing list, site).

What we do on our mailing list server using Sympa  is check the spam 
assassin header fields and depending on the "spam mark" either request a 
confirmation form the owner, trigger moderation or reject the message 
(with or without notification to the sender). These rules can be set in 
a single place for the whole mailing list server and you can set 
exceptions on a per-list basis. All that is natively supported by Sympa 
; it is just a configuration matter.

Here is an entry from our FAQ that deals with spam protection : 
http://www.sympa.org/fom-serve/cache/248.html
Here is the manual chapter dealing with authorization scenarios : 
http://www.sympa.org/doc/html/node13.html

Serge might add some comments regarding your concerns regarding SPF, DK,...

Patrick von der Hagen a écrit :

> currently spamcop is giving me quite a headache.... again....
>
> We have been blacklisted several time now due to autoresponders by our 
> mailinglist-software. Messages like "your mail is waiting for 
> moderator-approval", "you are not authorized to send messages to this 
> private list", etc.
>
> Basically, I believe mail must not disappear. It must either reach the 
> recipient or it must be returned to the sender as a bounce-message.
> However, there is the problem of colateral spam. Someone forges a 
> sender-address, sends spam, listserv/sympa/whatever processes the spam 
> and bounces later, sending an unwanted response to an innocent 
> third-party.
>
> We still run listserv, but I'm evaluating alternatives. If sympa had 
> better bounce-processing (e.g. VERP) it would probably place first, 
> but since a large percentage of my users heavily use forwards, the 
> bounces usually won't contain the adress subscribed to sympa and 
> therefore sympa-bounce-processing currently is quite insufficient...
>
> I certainly know that sympa would be much better suited for us, since 
> it would be possible to say "only sent autoresponder if the mail is 
> not considered to be spam by SpamAssassin", which can't be done by 
> listserv. Thus the number of autoresponders would be greatly reduced, 
> hitting less innocent third-parties.
> [...]