¿ªÔÆÌåÓý

Hank,

Now because I had set it up originally, any Welcome/Invite message
goes out with MY display name and linked to my email address.

It is not because you founded the group, see the references Duane cited.

Invites go out with a constructed email address in the From that facilitates accepting the invitation by a simple reply. The text of the invitation contains the identification of the owner or moderator sending the invitation ("You have been Invited by ..."). That's intentional so that the invitees have some idea who is sending the invitation and why.

The Welcome notice goes out From the group's +owner address (e.g. [email protected]). The Welcome text you can customize, and need to adjust anytime you change the group's address.

2) How could I set up a way for anyone (member or not) to send an
email to moderators with questions and not have it only come only to
me?.

That's what the +owner address does. It forwards to all owners and moderators who elect to receive +owner messages. See the bottom of your Subscription page - you may need to adjust the setting to receive +owner messages from non-members. Same goes for any other owners/mods in your group.

Shal


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

Jim,

@Shal Farley, I'm using "p=reject" intentionally because I am much
more interested in stopping spammers using our domains to the maximum
extent possible.

To be clear, if your domain is used only by you or members of your organization to communicate directly with individuals then I think that's perfectly appropriate. That is the designed use case for DMARC.

I would rather deal with any resulting issues but have had none so
far.

If your domain is a general mailbox provider then I disagree. You may not have experienced any resulting issues, but that doesn't mean there aren't any.

Your mailbox users might well wish to use services like Groups.io, or traditional email list services, to communicate indirectly with others; and in those cases you're causing trouble for them and their correspondents.

I believe there is a reason Gmail does not use p=reject (nor do they blindly obey the p=reject of others) - I think they understand that there would be adverse consequences for their users if they did.* In my opinion the mailbox providers that do use DMARC this way are acting a bit like Lily Tomlin's character Ernestine: "We don't care, we don't have to. We're the phone company."

Maybe someday ARC (RFC 8617) will gain enough adoption to effectively resolve the mailing-list problems with DMARC, but it hasn't happened yet.


Shal
* That said, Gmail has tightend up a bit on the deliverability of messages with non-aligned envelope and header From, at least in the specific case of messages I receive that have my own address in the header From. They deliver them to my inbox, but with a large warning banner about not being able to authenticate the message. But so far they haven't taken any adverse action against messages from other Gmail users (or non-Gmail users) that I receive indirectly.


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

@Mark Berry,
The problem with setting SPF to use that single IP is that there are actually two?addresses listed in the GIO SPF and they are subject to change. Using the "include" statement avoids the need to monitor and stays up-to-date automatically.

The current GIO SPF is:
? ? "v=spf1 ip4:66.175.222.12 ip4:66.175.222.108 include:mail.zendesk.com include:smtp.zendesk.com ~all"
Yes, it includes zendesk, too, but I don't have a problem with that at all.

Also, @Mark Berry, it is all but certain that spammers are using your domain now, judging by those counts. I am very confident it has nothing to do with GIO whatsoever.

I strongly recommend using?"p=reject" and "pct=100" as well as "adkim=s" and "aspf=s" to alert receivers accordingly. They still have the option of passing it and flagging it as spam but this is the only real defense available to you because SPF and DKIM are simply not enough, alone or together.

@Shal Farley, I'm using "p=reject" intentionally because I am much more interested in stopping spammers using our domains to the maximum extent possible. I would rather deal with any resulting issues but have had none so far. I included the GIO SPF in our SPF.? No one else should be sending email on our behalf at this time. If that changes, I will make adjustments as necessary.

FYI, our SPF is:
? ? "v=spf1 +a +mx +include:spf.protection.outlook.com +include:groups.io -all"
In case anyone is wondering, the "+" signs create an implicit statement because I have learned you cannot always rely on defaults. See .

Our DMARC is:
? ? "v=DMARC1; p=reject; sp=reject; pct=100; adkim=s; aspf=s; rua=[redacted]"

There does seem to be another problem, however, that may be exacerbating the problems experienced by Mark Berry!

I am finding that the DKIM Signature Body Hash generated by GIO is failing on two (other than Valimail) testing sites that can perform DMARC, DKIM and SPF checks against GIO headers.

I used MxToolBox () and AppMailDev () on quite a few emails received via?O365?and on?Gmail?and, even though both O365 and Gmail shows "dkim=pass" in the "Authentication" section, they all failed during testing.

So, I then tested emails from Capital One, Cisco, AT&T, etc., and they all failed DKIM as well. That's a real problem! It leads me to believe DKIM checking may be faulty on both testing sites and perhaps on Valimail, as well, so I will be considering third-party "header check" results as "unverified" or "questionable" going forward.

For the time being, I will only treat DMARC reports as valid since they are sourced directly from receiving mail servers.
--
Jim

On Sat, Aug 8, 2020 at 10:13 PM, Larry McDavid wrote:

it is easy to enter many special characters that are not on the standard computer keyboard, using both Windows and Apple computers.

Unless it¡¯s windows laptops, no Num pads.?

It kills me not being able to enter a null character sometimes, when a space doesn¡¯t make it in certain situations/software.?

Not sure if this will help but months ago I saw a problem with a member of our group that also referenced i/o timeout.? The issue in that case was the member was having his gmail address subscribed to the group automatically forward email to another address.? There was a problem (member never explained the problem) with the address being forwarded to.

John P

It might be best if you go through the new guide to check all of your group settings.? You can also check the Owners Manual for more detail on many things.

Duane
--
The official Groups.io user documentation is in the Groups.io Help Center.
GMF's Unofficial Help Wiki: /g/GroupManagersForum/wiki

Hello,

My name is Hank.? Briefly, I have two problems/questions.

1) I started the group some time ago to test and see how it worked.? I am getting ready to move members onto the group.
Now because I had set it up originally, any Welcome/Invite message goes out with MY display name and linked to my email address.? I'd like to have that not be? my address.
2) How could I set up a way for anyone (member or not) to send an email to moderators with questions and not have it only come only to me?.
.? I have a sub-group set up, but non-members are blocked.
?If I look for a way to forward the addressed to me personally OR with questions to Moderators, the moderators would get all messages, both personal and moderator questiosn

Thank you in advance for any clues.
Confused in Gettysburg.

Hi all,

This week's change log:


Feel free to reply to this topic if you'd like to comment on the
changes. Or better yet, if you expect a lot of discussion start a new
topic (or rejoin an existing one) about a specific change.

DOCS: The new Getting Started Guide For Group Owners is now live, with
a link from the Help Center.

Nice!

Hopefully this will prove a valuable resource that we can cite to help answer questions here.


Comments about these others are also welcome:

APP: A test version of the Android app is now available and bugs are
being fixed.
DOCS: Various updates from Nina.
SYSADMIN: Oversaw Linode bug patching of several servers.
BUGFIX: For enterprise groups that did not have disable signups set to
true but did have a logged out wiki page defined, we would
erroneously redirect all logged out accesses to the / URL and
display the logged out wiki page, preventing access to any of the
group.
API: Added polls_visible to perms object.
INTERNAL: Upgraded pgx library to latest version.
CHANGE: Rollback change to poll/topic locking behavior. Locking a
topic once again does not close the poll.

Please call out any you find significant.

Shal
--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

It is surprising how many folks don't know it is easy to enter many special characters that are not on the standard computer keyboard, using both Windows and Apple computers.

ASCII is a 7-bit character set and is quite limited but UTF-8 is a variable-width character set capable of encoding 1,112,064 valid character code points in Unicode using one to four one-byte code units. As Shal pointed out below, groups.io messages handle UTF-8 characters, though in practice very few of the many combinations are needed for our simple textual emails.

I use many of these multi-keystroke characters in my emails and have found them easy to enter into my local-client Thunderbird emails in Windows. Similar multi-keystroke characters are available in Apple OS but I have no experience actually testing them. Replies to my emails suggest the characters all seem to reproduce as intended, though I offer no guarantee of that, especially if you are not using Windows and a local client like Thunderbird. You will need to test them yourself.

I would never choose to use any of these special characters in a file name, but only in message text. The problem discussed in this GMF topic relates to improper use of special characters in file names. It is likely the method described below was used to enter the en dash in the photo file name; really, it should have been rejected there as an invalid filename.

These multi-keystroke characters are entered by holding down the ALT (or, Option) key and then simultaneously pressing the additional digits but you must use the numeric keypad, not the number keys on the standard keyboard. In my abbreviated sample table below the "+" means "and."

Character Windows Apple OS

Hyphen: -
en dash: ¨C ALT+0150 Option+hyphen
em dash: ¡ª ALT+0151 Option+shift+hyphen
Degree: ¡ã ALT+0176 Option+shift+8
+/-: ¡À ALT+0176 Option+shift+=
Pi: ¦Ð ALT+227
Micro: ? ALT+0181 Option+m
Euro: € ALT+0128


Note that the hyphen, en dash and the em dash are all available and reproduce as intended in Thunderbird. I don't use the groups.io web interface to create messages so I have not tested that.

There are *many* more of these multi-keystroke characters available but, often, not all you really want to use are listed on the same website; you may need to do multiple searches to find what you want. One place to start is here:



Larry

--
Best wishes,

Larry McDavid W6FUB
Anaheim, California (SE of Los Angeles, near Disneyland)

Mark,

That's the first time I've heard that groups.io header rewriting only
starts when I set p=reject.

I misremembered. It is also in effect for senders with p=quarantine. That make sense.

For a day or so it also included p=none, but that was rolled back.

Comparing email headers from your message ... both follow the form
"username=domain<at>groups.io".

There are other circumstances where Groups.io applies DMARC rewriting. One is me receiving my own messages back, because otherwise Gmail puts up a big bright and annoying warning about the message not actually being from me. But Gmail's inbound processing doesn't seem to object to other addresses being spoofed, even other Gmail addresses.

As I recall there are other domains where messages to self are rewritten, and also receiving domains where all messages are rewritten because otherwise the receiving service rejects or quarantines the message, even though the header From domain didn't request that behavior.

I don't recall how (the other) Mark decides which domains need those variations on the theme, but perhaps he's decided yours is one such.

groups.io and my domain. It's like it is somehow extracting both
domains from the FROM line. And then it's only a "bestguesspass":

Authentication-Results: spf=pass (sender IP is 66.175.222.12)
smtp.mailfrom=groups.io; mydomain.com; dkim=pass (signature was

verified)

header.d=groups.io;mydomain.com; dmarc=bestguesspass action=none
header.from=groups.io;compauth=pass reason=109

The smtp.mailfrom it is showing you is the domain specified in the
MAIL FROM command in the SMTP transaction when Groups.io's outbound server connected to your inbound server (aka the "envelope From").

That's what DMARC requires to align with the "header From" domain.

I guess I will try modifying my SPF record to allow groups.io as a
sender and see if that lets DMARC pass.

I don't know if that's a recommended way, but I think it would work (that is, I think that's exactly what Yahoo Mail did with regard to Yahoo Groups). The downside I can see is that you'll end up with having to do the same for every other service used by your mailbox users (if there are any but you).

Shal


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

tommy0421,

Apparently what does not work on a Groups.io webpage may work in the
email copy of that message.

I mentioned that earlier.

It would depend on the particular email interface used to view the message. Some might also have a problem with non-ASCII characters in the img src filename.

If I'm remembering correctly, most email programs can read UFT-8.

Well, Eudora can't. But it was discontinued long ago.

Groups.io webpage apparently can not.

Is that close? :)

Close, but the problem is specifically UTF-8 encoding in the filename passed as part of the source reference to an embedded image.

In the text of the message Groups.io handles UTF-8 encoded characters just fine. For example in the popular shrug emoji ?\_(¥Ä)_/? the hands and face are UTF-8 encoded characters. Only the arms and sides of the head are ASCII characters.

Shal


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

On Fri, Aug 7, 2020 at 07:12 AM, Jim Wilson wrote:

Separately, I think the short answer may be to simply add GIO to the DNS TXT entry for SPF on your domain by inserting "include:groups.io" before your "~all" or "-all" statement.

Giving this a try. However after discovering that there is apparently no A or CNAME record pointing to the groups.io sending IP address, and after reviewing the groups.io SPF record, I decided to go with the IP4 syntax:

"v=spf1 include:spf.protection.outlook.com ip4:66.175.222.12 -all"

tommy0421,

I thought I had replied to this but apparently I have not.

You did: /g/GroupManagersForum/message/33139

... it was the en-dash character. That is a dash preceded by a space
and followed by a space.

As Sharon alluded, spaces do not an en-dash make.

In the email message hyphen, en-dash, em-dash, and other horizontal line shaped characters, are all represented by different character codes (code points, in Unicode parlance). They may look alike on your screen, but they are not the same to a program parsing the message content.

Where the confusion comes in is that some document-processing applications, and MS-Word in particular, will auto-convert come combinations of keystrokes into alternate characters. That's a "convenience" feature because keyboards standardized around a relatively limited typewriter-based set of keys, but document typography commonly uses many more characters ("marks") than there are keys on a keyboard.

But the image also failed to display when posted to Shal's test group
even with the spaces before and after the dash deleted but the dash
still there. (Technically creating a hyphen, I think?)

Nope. I'm not sure what program you were using when deleting the spaces, but that wouldn't normally change the identity of the character between them.

But the dash was the problem. Lesson being, DO NOT use dashes when
naming image files.

Not typographic dashes, but hyphens are innocent.

The other lesson is: DO report this bug on beta, maybe Mark can fix the parsing to handle such cases. That could result in the already posted messages displaying properly.

Shal


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

Shal,

Thanks for trying to explain that and provide history.

On Sat, Aug 8, 2020 at 03:07 PM, Shal Farley wrote [emphasis mine]:

Facing the same issue Groups.io rewrites the outbound From header (in a more sensible way), but only when the posting member's domain has a DMARC p=reject policy. Many services do not do that (including Gmail) so you'll see unmodified From addresses from many members (including me).
/helpcenter/faq/1/group-member-faq/q-why-are-some-people-s-email

That's the first time I've heard that groups.io header rewriting only starts when I set p=reject. Comparing email headers from your message and mine, both say "via groups.io" and both follow the form "username=domain<at>groups.io". In fact, given that, I don't understand why the SPF and DKIM are unaligned, since all domains reference groups.io.

The Authentication=Results header is perhaps telling--it includes both groups.io and my domain. It's like it is somehow extracting both domains from the FROM line. And then it's only a "bestguesspass":

Authentication-Results: spf=pass (sender IP is 66.175.222.12)
?smtp.mailfrom=groups.io; mydomain.com; dkim=pass (signature was verified)
?header.d=groups.io;mydomain.com; dmarc=bestguesspass action=none
?header.from=groups.io;compauth=pass reason=109

As for the huge uptick in spoofing since posting here, it occurs to me that savvy scammers would subscribe to this forum as a way to harvest email addresses from everyone who posts. Sigh. Further reason to move to p=reject!

I guess I will try modifying my SPF record to allow groups.io as a sender and see if that lets DMARC pass.

Mark

Chuck,

I just sent him a Bounce Probe then checked his Email Delivery
History.
The bounce probe and previous emails all say:
<ip address>: dial tcp4 <ip address>:25: i/o timeout

Is the IP address in the above Groups.io's outbound server, 66.175.222.12? If so it would seem that the receiving service is attempting to access Groups.io's SMTP server (port :25) and failing.

That's not a behavior normally seen with Gmail addresses. If this member is truly subscribed with a gmail.com address, and not some look-alike (or some primary domain handled by Gmail) then I'm not sure how this could happen.

I'm tempted to just delete him then re-Direct Add him in but thought
I'd check here first.

I don't think that's likely to help, unless it incidentally corrects an error in the member's subscribed email address.

Shal


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

Mark,

Okay with the help of the raw reports and the MxToolbox visualizer, I
have a new insight: SPF and DKIM are _authenticating_ correctly, but
they are not _aligned_ and thus fail DMARC.

Right.

The key purpose of DMARC is to flag "spoofed" messages - ones where the domain of the header From: field does not match the domain of the actual sending server. The intent is to be able to automatically reject those scam emails that claim to be from your bank, USPS, or UPS, or other trusted businesses from which you may expect to receive messages.

Short form:

Don't use DMARC (specifically p=reject) with an email domain from which you intend to use any email list or forwarding service.

Long form:

DMARC does not work well with public mailbox domains (yahoo.com, aol.com, etc.) because mailbox users frequently also use email lists, email groups, and other services which legitimately pass along messages from mailbox users. The decision by Yahoo Mail, and shortly thereafter AOL mail, to implement DMARC p=reject on behalf of their mailbox users was highly controversial at the time, as it broke the delivery from most of the traditional email forwarding services used by those mailbox customers.

Yahoo side-stepped the problem with regard to Yahoo Groups versus Yahoo Mail by including Yahoo Group's outbound servers in the DNS records for Yahoo Mail. But when AOL followed suit with p=reject there was a paroxysm in Yahoo Groups when suddenly messages posted by AOL users were being rejected by users of other email services, causing the /receiving/ members to be put on "bouncing" status. A similar problem happened with more traditional email lists, with many old-school list services automatically unsubscribing the /receiving/ member because they had rejected a list message. Oops. Some email list managers reacted by banning users with AOL and Yahoo mail domains, and ultimately any p=reject domain.

Those who believe that DMARC is a good thing for all email, including mailbox services, claim that email email list and forwarding services should never have been passing the poster's From address through unmodified. They make that claim despite precedent going back as far as internet email has existed.

In response to the AOL debacle Yahoo Groups changed their email handling to rewrite all From addresses so that the outbound header From would now have the yahoogroups.com domain. Thus creating the needed alignment.

Facing the same issue Groups.io rewrites the outbound From header (in a more sensible way), but only when the posting member's domain has a DMARC p=reject policy. Many services do not do that (including Gmail) so you'll see unmodified From addresses from many members (including me).
/helpcenter/faq/1/group-member-faq/q-why-are-some-people-s-email

By the way, some people conflate "spoofed" (aka "forged From") messages with spam messages, but the two ideas are distinct. The confusion comes about because forging a legit header From address is a technique that email viruses, spambots, and all manner of scammers have often used in an attempt to fool people into opening and acting on their messages.

What I don't get is why I suddenly have _thousands_ of emails going
out "from" my domain that would fail: ...
* Perhaps the biggest concern are the 1665 emails purportedly from my
domain sent yesterday from two adjacent IP addresses in Moldava.
That looks like a determined effort to spoof my domain.

That seems likely. The scammers never give up trying.

I don't know if that's related to groups.io, but the timing overlaps.
(Third attachment) Unfortunately, I do not seem to have the raw report
for these failures.

It might be.

Or it might be from any other usage of your domain which might be collected by scammer's bots. Such as having it posted as contact info on a web site.

Shal


--
Help: /helpcenter
More Help: /g/GroupManagersForum/wiki
Even More Help: Search button at the top of Messages list

An oddity here. When I viewed the failed image sent to my group it was on the webpage and later in the daily digest I receive. Same thing when I tested the file name on Shal's test group today. I posted from the website, using Add picture to add the original file but with the spaces removed. It didn't display on the web page. In Shal's group I'm in individual email mode so a copy of my message was emailed to me. I had actually forgotten I was getting individual emails from the test group. When I saw there was a copy of the message in my inbox and opened it, the image does seem properly displayed.

Apparently what does not work on a Groups.io webpage may work in the email copy of that message. Of course, it was already pointed out that the difference is code. If I'm remembering correctly, most email programs can read UFT-8. Groups.io webpage apparently can not.

Is that close? :)

tommy0421

This all came about after a member included an image in a message they sent to one of my groups. The message file name included an en dash. They were very disappointed when the image failed to display in their message when posted. But the dash was the problem. Lesson being, DO NOT use dashes when naming image files.

Just to clarify for those who may not know there are three kinds of dashes: hyphen, en dash, and em dash. The hyphen is shortest and can be used in file names.

The en and em dashes cannot. They are special typesetting characters. The en dash joins words that are not hyphenated but are used in a string as adjectives, and the em dash sets off phrases within a sentence.

In many typefaces, it is hard to tell the difference. The en is supposed to be the width of an N, and the em the width of an M but they often are not.

And depending on the settings, in some word processing programs accidently typing two hyphens may produce an em dash that you don¡¯t notice but the computer does.

Sharon
¡ª¡ª¡ª
Sharon Villines

[email protected]
To subscribe:
[email protected]

Okay with the help of the raw reports and the MxToolbox visualizer, I have a new insight:? SPF and DKIM are _authenticating_ correctly, but they are not _aligned_ and thus fail DMARC. This is consistent across the four samples I analyzed. See first attachment (the report from Google). Here's a description of alignment: https://www.dmarcanalyzer.com/what-is-alignment/.

What I don't get is why I suddenly have _thousands_ of emails going out "from" my domain that would fail:

• Three of the four reports show failures from IP addresses other than Group.io 66.175.222.12.
• In the four days between August 4 and 7, 3273 emails would have failed DMARC. (Second attachment)
• Perhaps the biggest concern are the 1665 emails purportedly from my domain sent yesterday from two adjacent IP addresses in Moldava. That looks like a determined effort to spoof my domain. I don't know if that's related to groups.io, but the timing overlaps. (Third attachment) Unfortunately, I do not seem to have the raw report for these failures.

?Shal Farley wrote: This is kind of an odd theory, and I've not tested it, but the only difference I'm seeing between what does not display right in GMF, and what does in shalstest, is the file name. In particular, the one in GMF included an en-dash character.
======================================================================

I thought I had replied to this but apparently I have not. Shal was right, it was the en-dash character. That is a dash preceded by a space and followed by a space. But the image also failed to display when posted to Shal's test group even with the spaces before and after the dash deleted but the dash still there. (Technically creating a hyphen, I think?)

This all came about after a member included an image in a message they sent to one of my groups. The message file name included an en dash. They were very disappointed when the image failed to display in their message when posted. But the dash was the problem. Lesson being, DO NOT use dashes when naming image files.

tommy0421