DMARC report mailing list subscriber address leaks

I don't know if many are aware of this (I discovered it by accident myself) but if you enable dmarc reports for your domain and mail server, you'll start to get reports back that include many lurker addresses on the Cypherpunks list. I can start posting them publicly if anyone's interested.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yep. On 07/24/2015 03:16 PM, Seth wrote:
- -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJVst0QAAoJEGxwq/inSG8C+m0IAJ4aTnUJ8DAWzlBnnMhoyac1 AId1LHCAwWq+UueeeOHdMc6H+qwI01+Ys8niWfU2e5MLRHQhf5lE1mwr28vcgZpy AzTemDF6XO7an1KfTD4r8YLGc9PTNPQRqfG9EOg/+YQI4IpQvBv+KOz0nqBm3mPJ sNgoCo6wsf1UVtLw9sn3Xpw0vWSKsRzHa9YL7wSU+n0GO4RO9EXDmTNmXWAcXp9Z Fjd8F9OxrW3XQEsGpt3wfOp7a58dJYPvHQFh60jDi9oXQXxw1S8VpIn50NIitL1l 9TfO9wxEXDtDGf3kBL4zFX+WMsuXI57b1y6hxfp1fTSQHYuTvt1PXdN+Pr3nlSg= =rOPD -----END PGP SIGNATURE-----

OK, as requested, here's the first report from fastmail.fm <?xml version="1.0"?> -<feedback> -<report_metadata> <report_id>7758186</report_id> <org_name>FastMail Pty Ltd</org_name> <email>dmarc@fastmail.com</email> <extra_contact_info>https://fastmail.com/</extra_contact_info> -<date_range> <begin>1437696000</begin> <end>1437782399</end> </date_range> </report_metadata> -<policy_published> <domain>sysfu.com</domain> <p>none</p> <sp>none</sp> <pct>100</pct> </policy_published> -<record> -<row> <source_ip>209.85.160.181</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>resistentialist.com</envelope_to> <envelope_from>gmail.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.212.173</source_ip> <count>2</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>jeffhammett.com</envelope_to> <envelope_from>gmail.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.160.175</source_ip> <count>2</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>resistentialist.com</envelope_to> <envelope_from>gmail.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>212.227.17.20</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>segordon.net</envelope_to> <envelope_from>gmx.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.212.177</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>kvet.ch</envelope_to> <envelope_from>hellyeah.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>1e100.net</domain> <selector>20130820</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>hellyeah.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.212.181</source_ip> <count>2</count> -<policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>jeffhammett.com</envelope_to> <envelope_from>gmail.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>195.140.195.194</source_ip> <count>3</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>fastmail.fm</envelope_to> <envelope_from>cpunks.org</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>permerror</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>195.140.195.194</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>fastmail.fm</envelope_to> <envelope_from>cpunks.org</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>permerror</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.212.181</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>kvet.ch</envelope_to> <envelope_from>hellyeah.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>1e100.net</domain> <selector>20130820</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>hellyeah.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.212.169</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>jeffhammett.com</envelope_to> <envelope_from>gmail.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.141.47.85</source_ip> <count>51</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>afflictions.org</envelope_to> <envelope_from>cpunks.org</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>212.227.15.18</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>segordon.net</envelope_to> <envelope_from>gmx.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.141.47.85</source_ip> <count>17</count> -<policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>afflictions.org</envelope_to> <envelope_from>cpunks.org</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<spf> <domain>cpunks.org</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>212.227.15.18</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>segordon.net</envelope_to> <envelope_from>gmx.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>212.227.17.21</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>segordon.net</envelope_to> <envelope_from>gmx.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>gmx.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.212.178</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>kvet.ch</envelope_to> <envelope_from>hellyeah.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>1e100.net</domain> <selector>20130820</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>pass</result> <human_result>pass</human_result> </dkim> -<spf> <domain>hellyeah.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> -<record> -<row> <source_ip>209.85.160.176</source_ip> <count>1</count> -<policy_evaluated> <disposition>none</disposition> <dkim>fail</dkim> <spf>fail</spf> </policy_evaluated> </row> -<identifiers> <envelope_to>resistentialist.com</envelope_to> <envelope_from>gmail.com</envelope_from> <header_from>sysfu.com</header_from> </identifiers> -<auth_results> -<dkim> <domain>sysfu.com</domain> <selector>main</selector> <result>fail</result> <human_result>fail (message has been altered)</human_result> </dkim> -<spf> <domain>gmail.com</domain> <scope>mfrom</scope> <result>pass</result> </spf> </auth_results> </record> </feedback>

On Fri, Jul 24, 2015 at 07:39:59PM -0700, Seth wrote:
OK, as requested, here's the first report from fastmail.fm
how many are there in total? can you post this in some less fuckd up way than this copypaste crap? are there some urls, that could be simply curled for example? thx,s -- otr fp: https://www.ctrlc.hu/~stef/otr.txt

On Sat, 25 Jul 2015 04:37:47 -0700, stef <s@ctrlc.hu> wrote:
I get a few each day. Mostly from hotmail, fastmail.fm, yahoo.com and google. Think I saw one form xs4all too but it didn't climb over ye olde greylisting wall.
can you post this in some less fuckd up way than this copypaste crap? are there some urls, that could be simply curled for example?
I heard you screamin', the copypasta was extremely lame, I'm forwarding to Shelley who volunteered to perform proper text processing/formatting after which the extracted contents will be posted to the list.

On Sat, Jul 25, 2015 at 12:25:56PM -0700, Seth wrote:
thanks :) -- otr fp: https://www.ctrlc.hu/~stef/otr.txt
participants (5)
-
coderman
-
odinn
-
Seth
-
Shelley
-
stef