The PennNet Mailing List service provides a self-managed mailing list application that allows the requestor to setup and maintain subscriptions to an electronic mailing list.
In order to help secure them from malicious use, ISC now requires anyone owning a PennNet Mailing List to configure their list for either message confirmation or if it's a public-facing list, moderation. In addition, list owners must have a upenn.edu email address. The service will also deactivate any lists which appear to be unused after a year.
Set Confirm for a list
In order to fight against email spoofing, where a malicious sender crafts an email pretending to be a list user, ISC now requires anyone sending an email to a mailing list to confirm that they have indeed sent an email to a list. If you have sent an email to a list, you will receive a response asking you to reply with an OK to Listserv, which will then go ahead and send along your email. If you did not send an email to the list, but someone pretending to be you did so, you will receive a request from Listserv to OK an email you did not send. If you get one of these OK requests at seeming random, do not approve the message, but instead reach out to Information Security.
Set moderation for a list
In order to protect our users against abusive emails, where a malicious sender crafts an email to a mailing list that is configured to receive email from the public, ISC now requires any list that is open to the public to have content moderators. For content moderation options, please see https://www.lsoft.com/manuals/16.0/htmlhelp/list%20owners/ModeratingEditingLists.html or contact ISC for assistance in setting up content moderation. For additional details on moderation options, see https://www.lsoft.com/resources/tips/listserv-moderation-setups.asp
Owners: use a Penn managed email address
In addition, owners of a PennNet Mailing List must use a Penn managed email address. This generally means an email address ending in upenn.edu (e.g., upenn.edu, sas.upenn.edu, isc.upenn.edu, etc.) For alternate domains managed by Penn, please contact the PennNet Mailing List service team (by sending an email to help@isc.upenn.edu) for review of such an address.
Regular monitoring and variances
ISC will be regularly monitoring all lists to ensure secure settings of list Confirmation and Moderator settings. List owners should not remove these settings. If there is an operational or business need to change these configurations, list owners may request a variance and submit this to ISC (help@isc.upenn.edu). Variances must have the reason for the change, and director or department head approval, and all should be copied on the submission.
Removing unused lists
Given student and staff turnover, there is the potential for mailing lists to lose all of their owners and yet remain active in PennNet Mailing Lists in an unmanaged state. In order to reduce the instances of ‘abandoned’ lists, ISC will remove lists that have not been used in a year. ISC will reach out and attempt to contact list owners prior to de-commissioning an unused list.
To request service, you will need to fill out a PennNet Mailing List Request. Once this form has been submitted, a staff member will contact the requestor to let them know when the new mailing list is set up for their use.
Support for PennNet Mailing Lists is provided through your computing support provider. See the Faculty/Staff Support Directory to find your provider. If you are still unsure who to contact, please contact ISC Client Care.
List Management
If this is your first time using Listserv's Web Interface, you will need to create a new Listserv password.
Listserv's Web Interface allows a list owner to administer their mailing list through an easy- to-use web interface.
The following are configuration options for your list to help protect it from unwanted mailings. Configuration options for your list can be changed using the List Configuration Wizard in Listserv's Web Interface. Detailed inline help is available on these and other list configuration options within the web interface.
Access Control
- Send= - This option controls who can send to your list. You should make this value as limited as possible, choosing either Owner, which would allow only the owner of the list to send to the list or Private, which would allow only members of the list to send to the list. You also have the option to set the Confirm flag for the sender which would mean that any time any of the allowed senders sends a message to the list, Listserv will first send a message to the sender's email address asking for confirmation before delivering messages. This is an effort to catch situations where a malicious third party has forged the sender's email address.
- Review= - This option controls who can ask Listserv for information about the list. You should make this value as limited as possible, choosing Owner(s) or even specifying that only one owner can review the list.
Subscription
- Subscription= - This option controls who can subscribe new members to the list. You should make this value as limited as possible, choosing By owner.
Security
- Confidential= - This option determines whether the list would be included in any listing of the lists available on this server. You should choose Yes to hide your list.
- Service= - This option will define an area within which members can communicate with the list. This area can be an IP address, domain or even country.
- Validate= - This option determines whether Listserv will require a password or send a confirmation email when it receives a request to act upon the list. The most secure option is Yes,Confirm. Protected commands are validated using the "OK" mechanism by default, although personal passwords are also accepted where appropriate.
The Owner keyword defines the person or list of persons who "own" the list. They are responsible for controlling access to the list and defining the list control keywords that are best suited to the purpose of the list. This keyword is required in every list and there is no default value.
Use PennNet Mailing List's Web Interface to transfer ownership of a mailing list.
To delete a Mailing list, please contact ISC Client Care to open a ticket. Only a list owner is authorized to delete a list.
The Confidential keyword indicates whether the list should be hidden from users or not. A confidential list will not appear on the "Lists" command output. "Confidential= No" is the default value and indicates that the list is not confidential. "Confidential=Service" indicates that the list is to be hidden from users who are not in the list's service area (see "Service=" keyword) but not from other users. "Confidential= Yes" means that the list is unconditionally confidential.
Use PennNet Mailing List's Web Interface to set the Confidential keyword.
The default setting is to block duplicate messages that are sent to a list. This is to prevent looping, and well as to intercept SPAM. You may configure your mailing list to disable the duplicate check by setting No CRC.
Another anti-spam mechanism is for the server to hold a message for 10 minutes before it processes it if the message is sent by someone who is not a member of the list. You can change the amount of time a message is quarantined by changing the configuration value for Spam-Delay.
Use PennNet Mailing List's Web Interface to set No CRC.
The General Preferences panel of the Web Interface allows users to set the value for the Login Cookie Expiration.
Use PennNet Mailing List's Web Interface to change your Login Cookie Expiration.
Newsletter preferences allow users to set a profile for using the Newletter Template wizard.i es a template wizard that allows posters to create and post newletter style email to their list through the web archives system Newsletter Preferences
To access the Newsletter Template wizard, go to the List Archives screen, the Archives Index screen, or the Archive Browsing screen for the list you want to post the newsletter to, and then click on the Newsletter Template option.
Certain functions in Listserv's Web Interface allow list owners to display report output as as a web-based table viewed On Screen. You can also get the results in a "Comma-separated values" (CSV) format that can then be saved from your web browser to a file on your computer, allowing you to import the data into any reporting software that supports CSV files. For the CSV format, you can select either CSV Format (Subset) or CSV Format (All).
Note: For reports that span multiple pages, the CSV Format (Subset) option will only include data from the current screen in the report. For example, if a list contains 100 subscribers but only 50 subscribers are shown on screen at a time, then the CSV file will only contain the 50 subscribers shown on screen. Also, if you are using any narrowing options, only the data that fits the search criteria is included in the CSV file. The CSV Format (All) option, on the other hand, will include all the data in the CSV file regardless of the number of pages or any search or narrowing options.
Subscriber Management
Many Listserv mailing lists are configured to auto-unsubscribe list members if their address is undeliverable for 4 days. The keyword setting for this behaviour is: Auto-Delete= Yes,Full-Auto
Use PennNet Mailing List's Web Interface to change the Auto-Delete setting for your mailing list
Suggested setting for Auto-Delete to prevent auto-unsubscription are No and Manual.
Use PennNet Mailing List's Web Interface to add/delete users from a mailing list. Select your target list from the pulldown menu.
Use PennNet Mailing List's Web Interface to add subscribers in bulk. Select your target list from the pulldown menu.
The input file must be a plain text file (not a word processor document or spreadsheet) and must contain one address per line, optionally followed with a space (or TAB) and the subscriber's name. The subscribers being added or deleted will not be notified.
The Subscription keyword defines whether or not new users are allowed to subscribe to the list, and if not, whether their subscription requests are to be forwarded to the list owner or not.
Use PennNet Mailing List's web interface to set the Subscription keyword.
The Review keyword defines the categories of users who are allowed to review the non-concealed Internet addresses and names of the persons subscribed to a list.
Use PennNet Mailing List's web interface to set the Review keyword.
Many times a subscriber will have their mail forwarded to another system or site. The mail bounce actually comes from that site rather than the one from which the person subscribed. The solution to this is to REView the list and look at the names and userids of the subscribers to try to find a name match to the person getting the bounced mail. Then you can delete that address from your list.
The other problem you may find is that someone has started a local list and subscribed it to your larger list. You then have subscribers getting mail from a secondary site. Bounced mail will pass from their real mailing address, but that address doesn't appear on your list of subscribers, the local list does. You can try to match site names, but often this doesn't work. You can try to keep local lists off your list (but this is really counterproductive since local distribution lists are less wasteful of resources) or make sure you have a valid address for the person responsible for the local site list. In any circumstances, it can be difficult. The first things to do, though, are to scour your list of subscribers for matches.
If a user sends more than 50 consecutive invalid commands to LISTSERV, LISTSERV automatically serves that user off so that further commands from that user will be ignored. This normally happens by accident, for instance, if a user's "vacation" program keeps sending messages back to LISTSERV every time a posting from the list is received, rather than by someone actually sending 50 consecutive invalid commands manually.
While served off, the user will be unable to set personal options and will be unable to subscribe or unsubscribe to lists on that server. Note that the user may not even realize that he has been served off (when this happens by accident, LISTSERV always sends notification to the user to that effect, but not all users know what they are looking at when they receive the message).
To reenable a subscriber, go to the following URL:
https://lists.upenn.edu/cgi-bin/wa?LCMD2
Enter serve emailaddress in the command box, substituting the subscriber's full email address for emailaddress. Then select Enter Command.
Message Management
The Send keyword defines the categories of users who can mail to the list. This option can be used to place the list under the control of an editor. The default value is "Public". Other access-levels for use with Send= would include "Private", "Editor", "Owner", etc.
Use PennNet Mailing List's Web Interface to control who can send to your list.
The Reply-To keyword indicates whether the "Reply-to:" tag supplied by the sender of the mail file, if present, is to be preserved or discarded and, if discarded or omitted, what should be placed in the new "Reply-to:".
Use PennNet Mailing List's Web Interface to set the Reply-To keyword.
The Daily-Threshold keyword limits the number of postings that may be processed by the list in a calendar day (midnight to midnight, server time), and, with the addition of an optional second parameter, limits the number of postings that may be accepted from any individual user per calendar day (midnight to midnight in the server's local time zone).
Use PennNet Mailing Lists's web interface to set the Daily-Threshold keyword.
The Prime keyword allows a Listowner to specify times when Listserv will deliver Lists messages. List messages that are sent during non-specified times will be queued.
Use PennNet Mailing List's web interface to set the Prime keyword.
When a list exceeds the maximum number of posts allowed in a day (default: 100), LISTSERV "holds" any subsequent postings sent to that list. The reasoning behind this is two-fold. One, if a loop occurs in a manner that LISTSERV doesn't catch, this keeps the number of posts down that would fill up subscribers' mailboxes. The site's postmaster can be notified to try to flush the rest of the looped posts out of the queue. Two, most subscribers get overwhelmed on high traffic lists, so holding the list automatically helps them in managing their use of resources as well.
Use PennNet Mailing List's web interface to issue the following command:
Free Listname
By default, PennNet Mailing Lists remove all addresses from the TO: and CC: headers other than the list itself. For example, if a user sends a message such as:
TO: testlist@lists.upenn.edu, billgates@msn.com
CC: stevejobs@apple.com
When it is distributed to the subscribers of testlist@lists.upenn.edu, those recipients only see the following:
This behavior can be changed to retain the contents of the TO: and CC: headers, but it is configured on a subscriber level basis, meaning that each individual subscriber may change their own personal setting. As as listowner, you may change the default setting which all subscribers receive when they are are subscribed. You must then also bulk change the setting for all existing subscribers.
The change the default setting for your list, add the following keyword to your list header:
Default-Options= IETFHDR
To change the settings for your existing subscribers, send the following command to listserv@lists.upenn.edu:
QUIET SET yourlistname IETFHDR FOR *@*
Note that setting IETFHDR for a list will supercede the setting of the Reply-To Keyword. When subscribers are set to IETFHDR, the Reply-To keyword will always be reset to Reply-To=Sender for those members.
Bounced mail is one of the most time-consuming tasks a list owner can have and may be one of the more confusing issues, since mail bounces back with as many different error messages as there are mail systems. The list owner can pretty much ignore the initial message that LISTSERV sends saying that the mail has been directed to the listname-owner mailbox because of an error. The error itself will be farther down in the message past the second set of mail headings that usually appear. Generally the error content will mention one of just a few things. The wording may not be exactly the same, but the concept will be. Remember, too, that you will get an error for *every* posting that goes to that address, so you may have multiple errors for the same address, especially if you own a high traffic list. It also may take a day or so for the errors to flush out of the system once you've deleted the problem address.
Host unknown
The system to which this mail was addressed has left the Internet. The only thing you can do is delete the subscriber from the list. There is no easy way to track if the subscriber has a new mailing address on another system.
User unknown
The userid to which this mail was addressed has been purged from the receiving system. The only thing you can do is delete the subscriber from the list. There is no easy way to track if the subscriber has a new mailing address on this or another system.
Host unreachable
The system to which this mail was addressed is off-line (for perhaps an indeterminate amount of time). Most systems come back up after a few days. It may be a break or a holiday. You can ignore this error unless it becomes overwhelming, then the answer is to either delete the subscriber or set them to NOMAIL (SET listname NOMAIL FOR userid@node.domain).
User's mailbox full
The subscriber has exceeded the disk quota on their machine. You can ignore this error, or, if the error messages become overwhelming, delete them from the list or set them to NOMAIL (SET listname NOMAIL FOR userid@node.domain).
"Sender:", "From:" or "Reply-To:" field pointing to the list has been found in mail body.
This is a very specific error message that occurs when a list member tries to forward a mail message to the list. When forwarding the message, the original header is included in the forwarded message. LISTSERV will not permit forwarding the original header since this may cause a looping problem depending on how your mailer handles forwarding messages. In order to send a forwarded message, your list member must delete the original mail header before sending to the list.
This is called the Repro option, and Listserv determines the Repro of each subscriber individually.
Each current subscriber will need their Repro set individually or it can be changed globally by running a Listserv Command.
The steps to change all Current list subscribers Repro:
- Under the Listserv management website, select "List Management" -> "LISTSERV Command"
- Select the list you would like to update
- Copy and Paste without quotes: "quiet SET YOUR_LISTNAME REPRO FOR *@*"
- Change YOUR_LISTNAME to the list name you have selected
- Select Enter Command
You will receive a Successful message from Listserv.
------------------------------------------------------------------------------------------------------------------------------------------------
For New users to receive the Repro setting by default, the global Repro setting for the list needs to be updated.
- Under the Listserv management website, select "Configure" under the list you would like to update
- Select the "Subscription" tab (dark blue tab)
- Change NoRepro to Repro
- Select Save
You will receive a Successful message from Listserv.
List Members
All commands (e.g. SUBscribe, UNSUBscribe, REView, GET, etc.) should be sent to LISTSERV@lists.upenn.edu. You send the commands via e-mail. Multiple commands can be sent within one e-mail, but each command must appear on a separate line.
Mail you want to be distributed to the people subscribed to the list should be sent by using the list's name as the userid. Mail to be distributed to the list "PENN-L" should be mailed to PENN-L@lists.upenn.edu
To subscribe to a list, send mail to "listserv@lists.upenn.edu" with the command:
SUBscribe listname Firstname LastnameSUBscribe linux Michael Smith
To leave a list, send mail to "listserv@lists.upenn.edu" with the command:
UNSUBscribe listname
If you have any questions about a specific list, direct them to the list owner. The list owner is always reachable by email at an address formatted like this:
owner-listname@lists.upenn.edu
While there are many reasons why you might have been removed from a list, recently we have been seeing subscribers automatically being removed from a list due to a new spam filter process which evaluates emails that are being seen multiple times through our email core.
More explanation:
You may have a unique setup, in that you have email forwarding for PENNKEY@upenn.edu pointed to your Zimbra email account PENNKEY@zimbra.upenn.edu, and then your Zimbra email account is being forwarded to an Exchange email account PENNKEY@exchange.upenn.edu for final delivery. This causes any email that comes in to PENNKEY@upenn.edu to recurse through two different email services, including the spam filter multiple times.
How do I know if I'm affected?
You will have an account on both UPenn Zimbra service and UPenn Exchange account.
Steps that you may need to take to resolve this problem:
- The subscriber PENNKEY@upenn.edu forwarding is change to use their Exchange account
- The subscriber email is updated in Listserv to point to their Exchange email account
- The Auto-Delete subscribers option is turned off in Listserv per list owner
Options B and C will only quiet the problem in Listserv, and not other email providers trying to send to you via PENNKEY@upenn.edu.
If you feel this may have happened to you, please email listserv-help@isc.upenn.edu so that we can help assist in the remediation.
As of lists.upenn.edu upgrade to Listserv 16.0-2014b on 7/1/2014, any user's password that contains a space character will no longer continue to work. Users may now login by omitting the space characters from their password.
If their password continues to fail, users may reset their password to one that does not contain a space, via the following URL:
https://lists.upenn.edu/cgi-bin/wa?GETPW1=&X=&Y=