mail from launchpad can be spoofed by spammers

[Craig]

The launchpad.net domain does not have SPF or DKIM records, which means that other mail systems can masquerade as launchpad.net very easily and send spam as if they were the real launchpad.net mail servers.

[Gary Poster (gary)]

RT 46019

[Robert Collins (lifeless)]

We're not going to add SPF records, but we will add DKIM signatures to things eventually - the RT is still open for doing that.

[LaMont Jones (lamont)]

RT#41726 is the relevant ticket, not 46019.

[Colin Watson (cjwatson)]

The new relevant internal ticket is https://portal.admin.canonical.com/C123312.

[Colin Watson (cjwatson)]

This is in progress, though the SPF policy still falls back to softfail for now:

  $ dig +short -t txt launchpad.net
  "v=spf1 ip4:185.125.188.250 ip4:185.125.188.251 ip4:91.189.90.7 ip4:91.189.95.10 ~all"

Email from Launchpad is now DKIM-signed provided that its From: address is @launchpad.net or a subdomain (needed to comply with DMARC). The bulk of Launchpad's outgoing email is bugs, code review, and answers, and that now meets those requirements, but there's a long tail of other types of email we send that will need to be audited.