From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-it0-x235.google.com (mail-it0-x235.google.com [IPv6:2607:f8b0:4001:c0b::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 84E9F3B25E for ; Thu, 29 Sep 2016 19:22:34 -0400 (EDT) Received: by mail-it0-x235.google.com with SMTP id n143so14526330ita.1 for ; Thu, 29 Sep 2016 16:22:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r2z1gl35RJy92V+CDcDPGRG0MqxMQLQ85eT+ocXKOQY=; b=kXrJiXdtEE+Dk2x/wgbfbcPWExHD+ZGgJaPJKL3ur4v+NutMpF56DBVaDthGgCrBT9 C894pa6/BLBCA6vnemtWVWFHXicZiecXUWTTuTq/2VBxreb40vKYHi2WDZs56ad3b1am PNKn1DkD/klqchQ3WRf8a1ZcDH69JLmQWI12sJ/uIfarZOOvxZ+sF08VxmJSI2uwk2/T twRanrI0TLxCJUz7AuDcDQ5D0B5HBRvm2vYLqiZ3AtHhVfzi6NFDOnIIKgSzZ2HxNkyE iohi5Ezm1KQiYcObXtXGTavJMfKwsiI0RfCkavsPwxl4ZTClX6SWGOTBlcoYnIv0VzvK 6tNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r2z1gl35RJy92V+CDcDPGRG0MqxMQLQ85eT+ocXKOQY=; b=TWRkX3q/PRrtRqJ156QVJhINXmTPQL1Wa3GCWQd8LXWDfZxVsYbDeRC9gkzdskNkYs 01wKj3uaa4YfbSqQHAijsWr7dm08HErLxL8EjMLTXBQDzbZJQd7aEaWI/dBW6y1I85sR PzS4DzFCysXi9vP8H7iuuUTyTv2WewUNFkLSLr8zihY1Ny9hmnvvlzZ55gOBFDM2+C1Z RbmG8RJ1CpkRl8VjOzBzkHjxw4iMAVVSlRF6GAGdReXdoeewIgYVZOlwq4RZ3f1w/tsK VBBVA4r3YLzCB4k+3NzaA/5noNsmvaSjOgCuGXtbJ1H5ZRuq2Eywq7oeCj+ABLtUqFvQ Lr+A== X-Gm-Message-State: AA6/9RlTp+KySiitdl3s/Ex35zaUKIMcyCv6j2fyWIvhDZPC3JCm8RnrcNRWaOBogiGHqPugzIjych0KdOZmRg== X-Received: by 10.107.30.11 with SMTP id e11mr5527529ioe.57.1475191353957; Thu, 29 Sep 2016 16:22:33 -0700 (PDT) MIME-Version: 1.0 References: <06273A79-CAEB-4981-9BEE-22939D333D66@gmail.com> <30DC0151-C918-4664-A1FE-9179E08DE833@gmail.com> In-Reply-To: <30DC0151-C918-4664-A1FE-9179E08DE833@gmail.com> From: Neil Shepperd Date: Thu, 29 Sep 2016 23:22:23 +0000 Message-ID: To: Jonathan Morton , Dave Taht Cc: cake@lists.bufferbloat.net Content-Type: multipart/alternative; boundary=001a1141bb36a0e1ce053dadc0bf Subject: Re: [Cake] cake for net-next 4.8 X-BeenThere: cake@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: Cake - FQ_codel the next generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Sep 2016 23:22:34 -0000 --001a1141bb36a0e1ce053dadc0bf Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable I think I have now accumulated enough spam/nonspam classified emails to make a statistically signification observation: it seems like all emails classified as spam from these lists were send from ipv6: SPF: PASS with IP 2600:3c03:0:0:f03c:91ff:fe61:86ce All emails from bufferbloat.net lists are failing DKIM (because of the mailing list footer breaking the DKIM signature) which might be worth fixing, and failing DMARC because all mailing lists fails DMARC (however google does not have a strict DMARC policy so that shouldn't matter, I hope). By the way, it's not just you, either. I have emails from others on these lists in my spam folder. The distinguishing factor seems to be whether the email was sent from the lists.bufferbloat.net ipv6 address. Unless this address corresponds to some kind of tunnel broker possibly also used by spammers, I can only assume this is some kind of bug (after all, it was spf validated so the address shouldn't matter at that point?). I'm going to see if I can file some sort of a bug with special googler powers, but I probably won't be allowed to tell you anything if they reply. On Tue, 27 Sep 2016 at 12:14 Jonathan Morton wrote: > > > On 27 Sep, 2016, at 19:04, Dave Taht wrote: > > > > Annoying. Perhaps my link to the blog in my .sig? Perhaps they object > > to my verbosity? > > This seems relevant in the headers: > > Authentication-Results: mx.google.com; dkim=3Dneutral (body hash did not > verify) header.i=3D@gmail.com; spf=3Dpass (google.com: best guess record = for > domain of cake-bounces@lists.bufferbloat.net designates 45.79.142.77 as > permitted sender) smtp.mailfrom=3Dcake-bounces@lists.bufferbloat.net; > dmarc=3Dfail (p=3DNONE dis=3DNONE) header.from=3Dgmail.com > > I forget exactly how DKIM and DMARC work, but DKIM seems to be stymied by > the list adding its own message footer (which is nevertheless > best-practice). I don=E2=80=99t know how relevant a DMARC fail is to the= ir filter, > or how relevant it *should* be. > > Could the listserver replace an original, verified DKIM certificate with > its own after adding the footer? > > On the upside, I was able to add a filter specifically saying =E2=80=9Cne= ver send > to Spam folder=E2=80=9D, and it appears to be working so far. But everyo= ne > probably needs to do that; it=E2=80=99s not a scalable solution, only a w= orkaround. > > - Jonathan Morton > > _______________________________________________ > Cake mailing list > Cake@lists.bufferbloat.net > https://lists.bufferbloat.net/listinfo/cake > --001a1141bb36a0e1ce053dadc0bf Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I think I have now accumulated enough spam/nonspam classif= ied emails to make a statistically signification observation: it seems like= all emails classified as spam from these lists were send from ipv6:
SPF:PASS=C2=A0with IP 2600:3c03:0:0:f03c:91f= f:fe61:86ce= =C2=A0

All emails from bufferbloat.net lists are failing DKIM (because of the mailing list= footer breaking the DKIM signature) which might be worth fixing, and faili= ng DMARC because all mailing lists fails DMARC (however google does not hav= e a strict DMARC policy so that shouldn't matter, I hope).

By the way, it'= ;s not just you, either. I have emails from others on these lists in my spa= m folder.

The distinguishing factor seems to be whether the email was sent from t= he lists.bufferbloat.net ipv6 = address. Unless this address corresponds to some kind of tunnel broker poss= ibly also used by spammers, I can only assume this is some kind of bug (aft= er all, it was spf validated so the address shouldn't matter at that po= int?).

I'm going to see if I can file some sort of a bug with special g= oogler powers, but I probably won't be allowed to tell you anything if = they reply.

On Tue, 27= Sep 2016 at 12:14 Jonathan Morton <chromatix99@gmail.com> wrote:

> On 27 Sep, 2016, at 19:04, Dave Taht <dave.taht@gmail.com>= ; wrote:
>
> Annoying. Perhaps my link to the blog in my .sig? Perhaps they object<= br> > to my verbosity?

This seems relevant in the headers:

Authentication-Results: mx.google.com; dkim=3Dneu= tral (body hash did not verify) header.i=3D@gmail.com= ; spf=3Dpass (google.com: best guess record f= or domain of cake-bounces@lists.bufferbloat.net designates 45.79.142= .77 as permitted sender) smtp.mailfrom=3Dcake-bounces@lists.bufferbloat.= net; dmarc=3Dfail (p=3DNONE dis=3DNONE) header.from=3Dgmail.com

I forget exactly how DKIM and DMARC work, but DKIM seems to be stymied by t= he list adding its own message footer (which is nevertheless best-practice)= .=C2=A0 I don=E2=80=99t know how relevant a DMARC fail is to their filter, = or how relevant it *should* be.

Could the listserver replace an original, verified DKIM certificate with it= s own after adding the footer?

On the upside, I was able to add a filter specifically saying =E2=80=9Cneve= r send to Spam folder=E2=80=9D, and it appears to be working so far.=C2=A0 = But everyone probably needs to do that; it=E2=80=99s not a scalable solutio= n, only a workaround.

=C2=A0- Jonathan Morton

_______________________________________________
Cake mailing list
Cake@lists.bufferbloat.net
https://lists.bufferbloat.net/listinfo/cake
--001a1141bb36a0e1ce053dadc0bf--