Change 280644 had a related patch set uploaded (by Mschon):
added SPF record to phabricator.wikimedia.org

https://gerrit.wikimedia.org/r/280644

So, the gerrit change is held up on comments about mx ?all vs mx -all. Are we confident phab emails only come from our mxes? ping @chasemp and/or @faidon? If so, mx -all is probably better.

@BBlack -- I hope this is what you are asking for, but our server using our mx's is the only valid source of a phabricator.wikimedia.org email.

We use the normal list of smart hosts:

https://phabricator.wikimedia.org/diffusion/OPUP/browse/production/modules/role/manifests/phabricator/main.pp;03892b1108ab95d1d45a579ae0164dd673eac535$50

ok, so we should amend the patch to use -all and merge that

-all, like other antispam features (DMARC etc.) works poorly with mailing lists/reforwarders. If we're sure that there aren't any Phabricator emails directed to mailing lists, go for it.

Unless some team has a team list specified for their team project contact (I highly highly doubt it), the only thing I know of is/was wikibugs-l, which isn't used anymore (see: http://blog.gmane.org/gmane.org.wikimedia.mediawiki.bugs, for some reason https://lists.wikimedia.org/mailman/listinfo/wikibugs-l doesn't have a visible archive).

Can you think of any, @Aklapper ?

http://markmail.org/search/?q=from%3Aphabricator.wikimedia.org is empty, unlike http://markmail.org/search/?q=from%3Agerrit.wikimedia.org , so the main mailing lists are unaffected. Monthly statistics https://lists.wikimedia.org/pipermail/wikitech-l/2016-April/085151.html use a @wikimedia.org address so that's probably the standard to follow in any case.

In T116806#2186995, @greg wrote:

Unless some team has a team list specified for their team project contact (I highly highly doubt it), the only thing I know of is/was wikibugs-l, which isn't used anymore (see: http://blog.gmane.org/gmane.org.wikimedia.mediawiki.bugs, for some reason https://lists.wikimedia.org/mailman/listinfo/wikibugs-l doesn't have a visible archive).

Can you think of any, @Aklapper ?

If I understand the question correctly:

• https://phabricator.wikimedia.org/p/Wikidata-bugs/ for https://lists.wikimedia.org/pipermail/wikidata-bugs/
• https://phabricator.wikimedia.org/p/pywikibot-bugs-list/ for https://lists.wikimedia.org/pipermail/pywikibot-bugs/
• https://phabricator.wikimedia.org/p/tools-nlwikibots-list/ for https://lists.wikimedia.org/pipermail/tools-nlwikibots/

I'm confused - I think the last message above indicates we *do* have phab sending emails to mailing lists, which means we should use ?all, but the latest update to https://gerrit.wikimedia.org/r/#/c/280644/ is a switch to -all?

Right. Based on (at least?) those 3 accounts -> mailing lists, I guess we should use ?all.

Sending mails to mailing lists shouldn't matter as those rewrite the envelope header. The problem lies with forwarders that don't do that, for example Toolforge: If I would use scfc@tools.wmflabs.org for my Phabricator account, it would be delivered by the Toolforge mail server without any authority of phabricator.wikimedia.org (cf. T120225). IMVHO using such dumb forwarders is a behaviour that should be discouraged and not worked around.

ping, we need reviews for https://gerrit.wikimedia.org/r/#/c/280644/ scfc's comment might mean a -1, i don't know personally, i just want to say a reply of any kind on Gerrit would be great.

IMVHO using such dumb forwarders is a behaviour that should be discouraged

How common is such a forwarding mechanism? Email aliases are common, if the exim default is to be "dumb" then let's use ?all.

Even if we can't come to a firm consensus on which of ?all or -all is the most-appropriate setting, I think both sides of that debate would agree that ?all is better than no SPF record at all. Perhaps we should amend to that and merge for now, and then debate upgrading to -all separately.

@scfc in that case, your server should not reject based on SPF for accounts that you forwared there. There are many ways to treat SPF, the most versatile when you simply annotate then filter into spam.

The proper policy is -all IMHO

Change 280644 merged by Faidon Liambotis:
Add SPF record to phabricator.wikimedia.org

https://gerrit.wikimedia.org/r/280644