The mailing list for listmasters using Sympa

[Steve Shipway <address@concealed>]

> I know there are more than a few on here using Sympa that have their
> student population in the cloud with Office365.  My question to y'all:
> have you had to do anything special with message delivery to avoid MS from
> blocking your Sympa traffic to your students?

We use Gmail for our students rather than 365, but I suspect the general 
principal is the same.

First of all, our Sympa server is within our main domain, and so all outgoing 
emails are automatically signed by our DKIM key and conform to our domain's 
SPF.

Next, we control our Student Gmail domain (aucklanduni.ac.nz) and so we 
ensure 
that our central mail gateway is in the SPF record in addition to the Gmail 
chain.

Now, on our Student Gmail domain (aucklanduni.ac.nz), we can configure an IP 
whitelist to whitelist our mail gateway servers.  This sorts out almost all 
the issues, as we can be sure that there is no rate limiting or 
misclassification as spam.  We can also whitelist the @auckland.ac.nz mail 
domain, but ONLY for messages with a valid DKIM signature, which takes care 
of 
the rest.

Finally, on selected lists in the domain where we know there may be external 
members from DMARC-enabled domains, we activate the DMARC Protection, 
specifically for domains which have DMARC records.  This rewrites the From 
header to get around DMARC tests that ignore the Sender header.

We do also use a couple of cloud-based services for our Service Desk, but 
they 
have DKIM signatures and SPF records, and we also whitelist their mail 
gateways, so there is no issue.  We no longer have any known cases of valid 
emails being blocked by Gmail for students in the @aucklanduni.ac.nz domain.

Steve

Steve Shipway
T: +64 9 3737 599 ext 86487
E: address@concealed

Attachment: smime.p7s
Description: S/MIME cryptographic signature