search

pulibrary / princeton_ansible

Ansible Roles and Playbooks for Princeton University Library
10 stars 2 forks source link

lib-ponyexpr-prod does not deliver email when the from address is not a princeton one #5204

Open sandbergja opened 1 month ago

sandbergja commented 1 month ago

Expected behavior

I expect that lib-ponyexpr-prod delivers email, whether it is "from" my princeton.edu email address or my personal email address.

Actual behavior

If you try to send an email from, say, a gmail address, the application will report success, but the email will never arrive. The /var/log/mail.log on lib-ponyexpr-prod will give an error:

status=bounced (host smtp-us.ser.proofpoint.com[34.225.17.174] said: 550 5.2.0 from address is not allowed (in reply to end of DATA command))

Steps to replicate

  1. Go to a record in the catalog
  2. Press the Ask A Question Link
  3. Fill out the form with a non-princeton.edu link
  4. Note that your question never reaches the reference queue in LibAnswers, and that there is an error in the postfix log.

@kevinreiss also replicated this on the drupal websites and pulfalight.

Impact of this bug

Serious, it means that any researchers or other users from outside Princeton can't communicate with many of the Library's communication channels.

Implementation notes, if any

From @kayiwa : "the old pony still roams. It is testable by modifying to point to the old variable and see if it works"

kayiwa commented 1 month ago

OIT manages the proofpoint config. The fix will be finding a way to document in the IT handbook, what steps need to be done in the event that a known external entity without princeton.edu is using our relay.

kayiwa commented 1 month ago

We have a SNoW Ticket here

kayiwa commented 1 month ago

How many of these forms exist and can they get a princeton.edu account

sandbergja commented 1 month ago

@kayiwa There are 3 in the catalog that intentionally will accept email from any researcher from any institution, with any email address. There are drupal ones too, but I'm assuming that OIT WDS will not be sending them through our pony express after the website migration.

kayiwa commented 1 month ago

Based on this KB. We will be setting up a 3rd party client who will have DKIM with Princeton to send none-princeton email.

acozine commented 1 week ago

The old PonyExpress still works for external researchers, but will be blocked in future.

Plan is to use the LibAnswers API to pass the researchers' email addresses to LibAnswers, so replies from LibAnswers will go to the researchers but we are not relaying email that looks like it's from external addresses.