In cases where outbound mail delivery is important basic inbound mail handling should be configured for the (sub)domain and any from addresses too, this way things like bounces, messages to abuse@, callbacks, dmarc, etc can be properly handled.

Even in the case of a noreply@ address it will be better for that address to successfully deliver mail to /dev/null or :blackhole: than to have users to receive a bounce to the effect of Message not delivered Your message couldnt be delivered to noreply@twl.wmflabs.org because the remote server is misconfigured.

cc @jhathaway @MoritzMuehlenhoff

For inbound mail delivery: What are our options that avoid exposing an unmaintained mail server to the Internet? Internal mail routing config, Split DNS, etc?

@herron & @jsn.sherman what do you think about the following:

Email

• RFC5321.MailFrom: bounce@wmflabs.org, so we receive bounce messsages at the wmflabs mx server.
• RFC5322.From: noreply@twl.wmflabs.org

DMARC:

• adkim=s, strict, allowing a match on the fully qualified domain of of the RFC5322.From(twl.wmflabs.org) and the dkim domain key d=twl.wmflabs.org
• aspf, SPF will fail, since twl.wmflabs.org is not authorized to send as wmflabs.org in its RFC5321.MailFrom

Messages should still pass dmarc, since adkim should pass

Glossary

• RFC5321.MailFrom, SMTP protocol level From
• RFC5322.From, From in email body

It's looking pretty good to me on staging:

Original Message
Message ID	<170232041148.496.15449658617977877352@d8809f1bfd60>
Created at:	Mon, Dec 11, 2023 at 12:46 PM (Delivered after 0 seconds)
From:		Wikipedia Library Card Staging <staging@twl.wmflabs.org>
To:		***@gmail.com
Subject:	New comment on your Wikipedia Library application
SPF:		PASS with IP 185.15.56.18 Learn more
DKIM:		'PASS' with domain twl.wmflabs.org Learn more

Authentication-Results: mx.google.com;
       dkim=neutral (no key) header.i=@twl.wmflabs.org header.s=wmcs header.b=GVmvX11v;
       dkim=pass header.i=@twl.wmflabs.org header.s=staging header.b="P5m08mQ/";
       spf=pass (google.com: domain of bounce@wmflabs.org designates 185.15.56.18 as permitted sender) smtp.mailfrom=bounce@wmflabs.org

If this solves the return path concern, we'll get it put into production.

PR here:
https://github.com/WikipediaLibrary/TWLight/pull/1237

bounces@wmflabs.org does not seem to exist in the aliases file or route anywhere else.

taavi@mx1001 ~ $ sudo exim4 -bt bounces@wmflabs.org
bounces@wmflabs.org is undeliverable: Address bounces@wmflabs.org does not exist

What's exactly the intention with that? Any new names should preferrably use wmcloud.org instead of wmflabs.org and bounces@ seems very generic so I'd rather not add any special configuration for that for a single project.

In T352902#9397617, @taavi wrote:

bounces@wmflabs.org does not seem to exist in the aliases file or route anywhere else.
[...]

bounce@wmflabs.org was the address suggested by @jhathaway and is what I tested. Does that exist already, or it also not a thing?

No, that's not configured either.

hmm; I see that exim is configured to use root@wmcloud.org, which is what I see when I test with the mail command. Would that resolve the return path concern?

In T352902#9400607, @jsn.sherman wrote:

hmm; I see that exim is configured to use root@wmcloud.org, which is what I see when I test with the mail command. Would that resolve the return path concern?

In the absence of feedback, I'm going to go ahead with this change since I believe it is an improvement over an non-existent sender address.