Google Groups rewriting from addresses to handle DMARC policy

Now that Yahoo and AOL have both implemented "p=reject" DMARC policies, Google has modified their Google Groups discussion group service to "play nice" with posts from subscribers at domains behind a restrictive DMARC policy.

If Google took no action with regard to Google Groups, whenever an AOL or Yahoo user tried to post to a Google Group, their post would be rejected by any ISP that rejects DMARC policy, including Comcast, Gmail, Yahoo and others.

The action they've taken looks like this: IF the post was submitted by a user at a domain that uses a restrictive ("p=reject") DMARC policy, THEN rewrite the from address so that the message is from "the list" instead of the person, AND add a reply-to header containing the original poster's email address.

The good: When you hit reply, your reply will go to the original poster, regardless of whether or not the from header was rewritten. Alternately, hit reply-all to reply to both the person and the list. The Google Groups user experience is essentially unchanged.

The bad: Some folks are saying this violates RFC 5322, which they claim says that the from address should (only) be the author of the message. It's not actually that strict-- it also says the from address can be the "system responsible" for the message. It also goes on to say that the from address "should not" be any address that doesn't belong to the message author. "Should not" has a specific definition in IETF parlance-- it allows for operational considerations to override initial guidance. Meaning, they admit there might be a reason you need to do something other than what they recommend.

The ugly: See how they're including the original poster's email address inside of the friendly from when they rewrite the email headers? I'd strongly recommend against this type of thing. It doesn't seem right to include an email address in a place where it can't be machine validated, and it potentially opens up subscribers to confusion down the road.


  1. "THEN rewrite the from address so that the message is from "the list" instead of the person"

    The question here becomes: Can "the list" send mail to itself?
    As admin of a GG list, no one can mail to the list until they are sent an invitation to do so, and until they explicitly accept that invitation. Must I invite "the list" now to be able to post to itself?

  2. This new policy all but ruins the concept of the listserv, or on-line discussion groups. Those entities depend upon a "reply" going to the group, i.e. the recipient, and *not* to the sender.

  3. IN PRACTICE, Google Groups is setting From:, Reply-to:, and Sender: to the list address. The original poster's friendly name is in the friendly name part of the From: line, but you cannot find their address unless you display all headers and look for X-Original-From:. While this is a large violation of the RFC, it does work in practice to keep discussion lists going.

  4. I don't think the concept of a discussion list is ruined. It evolves; as does email; as does the internet; as does technology.


Comments policy: Al is always right. Kidding, mostly. Be polite, and you're welcome to join in, even if it's a differing viewpoint.