- Issue created by @fgm
Starting 2024-02-01, Google and Yahoo are requesting DMARC policies which will reject invalid addresses/domains.
A problematic side-effect is that, with the recommended p=reject
attribute, such messages will now trigger bounces from the site domains, assuming the email MX domain matches the site domain. In turn, this will degrade the deliverability properties of the sites, possibly preventing sites from emitting their normal transactional email.
This should initially only be a problem for sites sending more the 5k emails/day, but this is fairly common for sites using mailing lists on the primary domain.
In the case of contact module, this filtering is triggered by the use of the Reply-To
header, which is being emitted on messages send to the configured destination, which is usually on the same domain as the site itself, triggering the deliverability degradations for the site domain.
This is done to make it easier for the user receiving the contact request to just use the Reply feature in their mail agent to reply to the request, but fails when a site is subject to volume submissions of blocked contact forms by automated agents able to work around captchas.
Set as "major" because Google and Yahoo are huge email providers and this policy just started being deployed last week, with a large blast radius potential for Drupal sites.
A good explanation of the policy issue and handling at https://dmarcian.com/yahoo-and-google-dmarc-required/
"v=DMARC1; p=reject; rua=mailto:support@somedomain.tld; ruf=mailto:support@somedomain.tld; fo=1"
support@somedomain.tld
killoco1989@mail.ru
Modify the contact module so that use of the Reply-To
header can be turned off. Possibilities include:
X-Drupal-Unsafe-Reply-Address
WORKAROUND: Until the issue is fixed, sites can alter the contact forms or hook the mailsystem to do similar changes in code.
TBD
Refine the initial design.
New configuration to be exposed.
Probably none.
Contact config entity configuration schema might change to include this header configuration.
TBD