openrightsgroup / Blocking-Middleware

The censorship monitoring project (blocked.org.uk) API, database and message-queueing system
https://www.blocked.org.uk/
GNU General Public License v3.0
25 stars 11 forks source link

BT emails delivery issue #116

Open JimKillock opened 3 years ago

JimKillock commented 3 years ago

BT Categorisation report that:

"We have recently noticed that when we reply back to emails from blocked.org.uk we intermittently received undeliverable messages from the mail servers. I have attached a few mails whereby we have replied back and received either a Delivery Delayed or Undeliverable."

Can you check to see what has happened?

EDIT

Change how forwarding works, so that we work as a "man in the middle" changing the From and Reply to as @blocked.org.uk for the blocked user and BT, eg:

  1. Send reports to BT as User-123@blocked.org.uk
  2. BT returns email to User-123@blocked.org.uk
  3. We forward BT email using a From: header that belongs to us eg BT-123@blocked.org.uk
  4. User replies to the same From: header, eg BT-123@blocked.org.uk and we route that back to categorisation@bt.com via blocked.org.uk, sending to BT using From: User-123@blocked.org.uk ;
  5. The BT reply to should consistent with the original review request, eg BT-123@blocked.org.uk so any threads can be preserved.
JimKillock commented 3 years ago

You will have seen the emails and chat: can you change the way we forward emails so that the email:

  1. Send reports to BT as User-123@blocked.org.uk
  2. Uses a From: header that belongs to eg BT-123@blocked.org.uk
  3. Allows the user to reply to the same From: header, eg BT-123@blocked.org.uk and route that back to categorisation@bt.com via blocked.org.uk, send to BT using User-123@blocked.org.uk ;
  4. The BT reply to should consistent with the original review request so any threads can be preserved.

It may make sense to treat all of the response emails in this way to avoid any other DMARC issues?

dantheta commented 3 years ago

We can do (1) and (2) pretty easily, we'd just need to set up a fixed reply- alias for each of the ISPs. Capturing subsequent ISP replies (3) is slightly harder, as we won't have the original ISP report alias available after their reply in (2), since that reply will have used the user's own email address. Looking up the correct alias based on the subject line and ISP should be possible.

JimKillock commented 3 years ago

I think I see what you mean!

Nevertheless with (3) the user would reply with their own email address, rather than user-123@blocked.org.uk but the reply-to, eg BT-123@blocked.org.uk would be the same as the email sent "as if" BT, so should match that way? You'd need a unique "User Alias" and a unique "BT Alias" on our end?

JimKillock commented 3 years ago

(I've edited the comment and the task to make this a bit clearer. I think my descrption wasn't quite clear.)

JimKillock commented 3 years ago

Does this make sense @dantheta ? We should be able to play 'man in the middle' and rewrite the "from" in both directions, in essence.

dantheta commented 3 years ago

Yep - I'm working on the required postfix configuration at the moment.

On Fri, 19 Feb 2021, at 12:09, JimKillock wrote:

Does this make sense @dantheta https://github.com/dantheta ? We should be able to play 'man in the middle' and rewrite the "from" in both directions, in essence.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/openrightsgroup/Blocking-Middleware/issues/116#issuecomment-782035927, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADBG7K5NDJO6JVJT7ABV63S7ZIIHANCNFSM4XYEC54Q.

dantheta commented 3 years ago

The site now adds a reply-isp-xxxxxx From: address to email coming from the ISPs. BT still include a reply-to header in their outgoing mail, so we might not be able to capture all of the user -> ISP replies (though there haven't been many of those).

It's been tested reasonably well, but if it causes any problems we can revert the change quite easily.

JimKillock commented 3 years ago

Sounds good Daniel; can we consider changing the reply-to header as well?