search

openrightsgroup / Blocking-Middleware

The censorship monitoring project (blocked.org.uk) API, database and message-queueing system
https://www.blocked.org.uk/
GNU General Public License v3.0
25 stars 11 forks source link

Add label to redirected ISP emails #132

Closed JimKillock closed 1 year ago

JimKillock commented 3 years ago

As per @gwire's suggestion, add a label (Virgin, BT, etc) to make the redirected emails easier to understand for the user (it can be very unclear which ISP has responded in some cases).

This could be in the form of "BT via Blocked" <reply-isp-1234@blocked.org.uk>

to make in completely clear that we are redirecting the emails

dantheta commented 3 years ago

The header re-writing is being re-written :)

The previous implementation (using postfix header_checks) was only able to rewrite one header at a time, with no state or knowledge relating to the others, so it wasn't possible to retain the "friendly name" in the From: header. In the current/previous implementation, the from: header was deleted and a new one was inserted based on the to: header.

The new version reads the entire message and sets just the From: email address based on the To: email address (changing reply- to reply-isp- and vice versa). The friendly names are retained in both cases. It's a bit slower to run, but still manageable.

@gwire I'm guessing that since this all started from dmarc validation failures, the system should rewrite the return-path header as well?

dantheta commented 3 years ago

It's also looking like some of the ISPs are setting Reply-To headers, meaning we won't be able to record replies from user → ISP, although some ISPs use reply-all to send their user replies. We could strip Reply-to as well.

dantheta commented 3 years ago

The new envelope rewriter is live now. We can revert to the older version (or disable the rewriting) if it looks like it isn't working.

dantheta commented 3 years ago

Return path rewriting is enabled. It isn't possible to rewrite it to the from address just yet, but it has been set to the generic blocked ORG address for catching bounces and preventing DMARC failures.