OpenARC

OpenARC は、実験的な Authenticated Received Chain (ARC) メール認証システムのオープンソース実装であり、メーリングリストや転送サービスのような中間メールサーバーが、メールの元の認証結果に署名できるように設計されています。

ARC は、Microsoft、Google、Fastmail、Proton Mail を含む、ほとんどの一般的なメールプロバイダーによってサポートされています。

The idea

DMARC allows a sender's domain to indicate that a message is protected by SPF and/or DKIM. DMARC also indicates what a receiving server should do if a check of the message's SPF and/or DKIM does not pass (the receiving server can reject the message, for example).

However, when an email is sent through a mailing list or mail forwarder, DKIM or SPF checks might fail due to those intermediary servers making changes to the message. To prevent this failing of legitimate messages, ARC was created.

ARC re-signs the message with ARC headers. These headers allow us to see who modified the message, and what the state of authentication was before the modifications by an intermediary server.

After changes to the message by an intermediary server, SPF and/or DKIM checks might fail (see above). However, if there is a valid ARC chain, then a receiving server can still pass the message, if it trusts the intermediary server(s), as the ARC chain will allow the receiving mail server to extract the (old) SPF and DKIM results, which will pass the check.

See RFC 8617 for more information.

Installation

Install the openarc^AUR package.

Configuration

The main configuration file for the signing service is /etc/openarc/openarc.conf.

• Create an empty configuration file /etc/openarc/openarc.conf, or copy/move the sample configuration file /usr/share/doc/openarc/openarc.conf.sample to /etc/openarc/openarc.conf and change or add the following options (See openarc.conf(5) for details):

/etc/openarc/openarc.conf

PidFile /run/openarc/openarc.pid
UserID  openarc:openarc
Socket  local:/run/openarc/openarc.sock

Mode                    sv
Canonicalization        relaxed/simple
Domain                  example.com
Selector                myselector
KeyFile                 /etc/openarc/keys/myselector.private

• Socket address is the one specified in /etc/postfix/main.cf. This is what /etc/postfix/main.cf should contain:

/etc/postfix/main.cf

smtpd_milters = unix:/run/opendkim/opendkim.sock
    unix:/run/openarc/openarc.sock
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

• To generate a secret signing key, specify the domain used to send mails and a selector which is used to refer to the key. The selector may be any value. See the RFC for details, but alpha-numeric strings should be OK:

# opendkim-genkey -D /etc/openarc/keys -r -s myselector -d example.com
# chown -R openarc /etc/openarc/keys

• If you want logging to syslog, enable it as follows:

/etc/openarc/openarc.conf

...
Syslog  yes
...

• To tell OpenARC which headers to sign, configure them for example as follows:

/etc/openarc/openarc.conf

...
SignHeaders to,subject,message-id,date,from,mime-version,dkim-signature,arc-authentication-results
...

• The PeerList contains a list of IP addresses, CIDR blocks, hostnames, or domain names, whose mail should be neither signed, nor verified by this filter. This can be used to exclude your local mail for example. This file needs to be created if it does not yet exist.

/etc/openarc/openarc.conf

...
PeerList /etc/openarc/PeerList
...

• Other configuration options are available. Make sure to read the documentation.
• Enable/start the openarc.service.

Postfix integration

To integrate ARC using unix sockets, add the postfix user to the openarc group and edit the OpenARC and Postfix configuration files as follows:

/etc/openarc/openarc.conf

UserID  openarc:openarc
Socket  local:/run/openarc/openarc.sock

/etc/postfix/main.cf

smtpd_milters = unix:/run/opendkim/opendkim.sock
    unix:/run/openarc/openarc.sock
non_smtpd_milters = $smtpd_milters
milter_default_action = accept

Security

ノート: This section is copied from the OpenDKIM#Security

The default configuration for the OpenARC daemon is less than ideal from a security point of view (all those are minor security issues):

• The OpenARC daemon does not need to run as root at all (the configuration suggested earlier will have OpenARC drop root privileges by itself, but systemd can do this too and much earlier).
• If your mail daemon is on the same host as the OpenARC daemon, there is no need for localhost tcp sockets, and unix sockets may be used instead, allowing classic user/group access controls.
• OpenARC is using the /tmp folder by default whereas it could use its own folder with additional access restrictions.

The following configuration files will fix most of those issues (assuming you are using Postfix) and drop some unnecessary options in the systemd service unit. First, create a missing directory:

# mkdir /var/lib/openarc

Then:

/etc/openarc/openarc.conf

BaseDirectory           /var/lib/openarc
Domain                  example.com
KeyFile                 /etc/openarc/keys/myselector.private
Selector                myselector
Socket                  local:/run/openarc/openarc.sock
Syslog                  Yes
TemporaryDirectory      /run/openarc

/etc/systemd/system/openarc.service

[Unit]
Description=OpenARC daemon
After=network.target remote-fs.target nss-lookup.target

[Service]
Type=forking
User=openarc
Group=openarc
ExecStart=/usr/bin/openarc -c /etc/openarc/openarc.conf
RuntimeDirectory=openarc
RuntimeDirectoryMode=0700

[Install]
WantedBy=multi-user.target

Edit /etc/postfix/main.cf accordingly to make Postfix listen to this unix socket:

/etc/postfix/main.cf

smtpd_milters = unix:/run/opendkim/opendkim.sock
    unix:/run/openarc/openarc.sock
non_smtpd_milters = $smtpd_milters

See also

• ARC Specification for Email
• ARC email authentication - Google Workspace Admin Help
• "What is Authenticated Received Chain (ARC) and why does it matter?" by Proton Mail
• What is ARC - by Fastmail
• What is ARC - b y Postmarkapp