🚀 go-pugleaf

> The proper choices of addresses for authorization checking are all
> described in RFC822. Specifically, the Sender: address is used if
> present, and failing that the From: address is used.

I figured out my error.  I was trying to be fancy and
  (1) have the mailserv_access mapping refer to a mailing list, and
  (2) use subaddresses in the mailing list.

It seems that if the authorization file contains bob+other-stuff@camb.com
then bob@camb.com doesn't match and isn't considered authorized.  I guess
this is expected behavior.

Is there a reasonable way for me to use subadresses in a mailing list and
still use that list as the basis of authorization tests?  (My first
thought was to run a daily batch job that converts the mailing list into
an authorization list, stripping the subaddressing, but I really don't
want to get into parsing rfc822 addresses.)