Authentication of posts to a Mailman installation
I have a suspect post that appears to be from a member but has a link to a potential scam site. I am not knowledgeable about spoofed addresses in the header; can a hacker simply put someone else's address somewhere in the header and have the message accepted if that address appears in the list of members?
Steve Brown, administrator of a small list.
Steve Brown via Mailman-users writes:
I have a suspect post that appears to be from a member but has a link to a potential scam site. I am not knowledgeable about spoofed addresses in the header; can a hacker simply put someone else's address somewhere in the header and have the message accepted if that address appears in the list of members?
Yes. Everything in email can be spoofed by default. Senders (who you cannot control) can participate in the SPF and DKIM protocols which make spoofing much harder. Mailman does not currently provide controls based on those protocols. Those need to be implemented in the MTA (mail server).
However, if you only see one or a few of these, I would suspect that the member was convinced to use that link (or perhaps copied an ad for a product when they meant to link to article content). Or, depending on your subscription policies, somebody may have subscribed specifically to send a couple of spams.
You can reduce your exposure to spoofing by restricting which sender headers are checked in Mailman, and having your MTA refuse mail with spoofed senders to mailing list addresses.
To give more detailed advice we'd need to know a lot more about your lists. What kind of users (casual, technical, employment-related), what kind of domains provide their addresses (big domains all properly sign their outgoing mail nowadays), what your sign-up policies are.
Steve
-- GNU Mailman consultant (installation, migration, customization) Sirius Open Source https://www.siriusopensource.com/ Software systems consulting in Europe, North America, and Japan
Thanks. That helps. By MTA, do you mean the server that hosts my Mailman3 installation--one of the mailmanlists.net servers?
Other Steve
On Mon, Aug 10, 2026 at 8:46 PM Steve Brown via Mailman-users < mailman-users@mailman3.org> wrote:
Thanks. That helps. By MTA, do you mean the server that hosts my Mailman3 installation--one of the mailmanlists.net servers?
MTA = Mail Transfer Agent. Examples: Postfix, Exim, etc
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
Thanks, Odhiambo. I was about to disable message receipt as I usually do after getting answers, when I got an email to my Gmail account that was possibly a phishing attempt just after I had asked about authentication. Coincidence or something I should be worried about? I'll just delete the message soon, but below is the suspect email. I can probably get the headers if anyone is interested.
"[MM3-users] [lists.mailman3.org] Please Confirm Your Email Address Inbox mailman@mailman3.org
8:09 PM (2 hours ago)
to mailman-users Hello from lists.mailman3.org!
You're receiving this email because user ctfuser_b9a970ab has given your email address to register an account on lists.mailman3.org.
To confirm this is correct, go to https://mail.mailman3.org/accounts/confirm-email/NDkzNA:1wtcrs:67lKrZT5Tk2ex...
Thank you for using lists.mailman3.org! lists.mailman3.org
Mailman-users mailing list -- mailman-users@mailman3.org To unsubscribe send an email to mailman-users-leave@mailman3.org https://lists.mailman3.org/mailman3/lists/mailman-users.mailman3.org/ Archived at: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/message/..."
On 8/11/26 17:56, Steve Brown via Mailman-users wrote:
Thanks, Odhiambo. I was about to disable message receipt as I usually do after getting answers, when I got an email to my Gmail account that was possibly a phishing attempt just after I had asked about authentication. Coincidence or something I should be worried about? I'll just delete the message soon, but below is the suspect email. I can probably get the headers if anyone is interested.
"[MM3-users] [lists.mailman3.org] Please Confirm Your Email Address
That message went to the mailman-users@mailman3.org list (i.e., this list). It is nothing for you to be concerned about.
It happened because someone attempted to sign up the address mailman-users@mailman3.org for an account at lists.mailman3.org and the address confirmation email was sent to that address which is the list posting address. That email was sent from mailman@mailman3.org which unfortunately was and unmoderated list member so it went to the list. The mailman@mailman3.org list member is now moderated so it won't happen again.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (4)
-
Mark Sapiro -
Stephen J. Turnbull -
Steve Brown -
Washington Odhiambo