Adding ARC support

[ikedas]

Current beta: Sympa 6.2.37b.2

ToDo

• Making changes on Sympa
• Documentation
• Beta testing

Documentation (draft)

• Sympa Administration Manual: DKIM and ARC features for Sympa

References

Related posts:

• [sympa-developpers] Adding ARC supprt to Sympa

Specification:

• Authenticated Received Chain Overview by DMARC.org
• Authenticated Received Chain (ARC) Protocol, draft-ietf-dmarc-arc-protocol
• Recommended Usage of the Authenticated Received Chain (ARC), draft-ietf-dmarc-arc-usage

[jrlevine]

General flow:

• as message is received, see if there is an Authentication-Results header. If there is, do ARC validation on incoming message and edit arc= result into the A-R header or arc=none if none
• as outgoing message is signed, look for that A-R header again, use the incoming ARC result in ARC signing which can happen at the same time as DKIM signing
• add ARC headers above DKIM header(s) on the way out
  I can provide sample code if it'd be useful

[ikedas]

@jrlevine, thanks for guidance. Please do provide sample!

[jrlevine]

prearc.txt
Here's the prepass I use to add the incoming arc-chain to the Authentication-Results header. I run it on deliver as:
|bin/prearc | bin/queue

[jrlevine]

Here's a simplified version of my post-pass ARC and DKIM signer. (I used to use mj2 and it was easier to keep using this than to integrate it into Sympa.) You can see how the ARC signature is added in parallel with DKIM signature(s).
sympamail.txt

[dverdin]

I strongly agree with this proposal. ARC's design is especially well suited for mziling lists. That would be a good hope for mailing lists to go through DMARc agressive policies.
However, I feel we will need some servers reputation listings to make it work. Is there something planned by some consortium somewhere?
@jrlevine : did you hear about such a reputation list? I think this could be useful.

[jrlevine]

I strongly agree with this proposal. ARC's design is especially well suited for mziling lists. That would be a good hope for mailing lists to go through DMARc agressive policies. However, I feel we will need some servers reputation listings to make it work. Is there something planned by some consortium somewhere? @jrlevine : did you hear about such a reputation list? I think this could be useful.

The ARC crowd is thinking about reputation lists but nothing yet. HOWEVER, ARC is mostly intended for getting list mail into large providers like Gmail and Yahoo, who have their own idea about reputation. The Sympa system can and should add ARC headers without needing any local reputation info. You can look at the sample code I uploaded to see how that works. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly

[ikedas]

Draft documentation was merged: https://sympa-community.github.io/manual/customize/dkim-arc.html

I have a question: Doc says:

ARC requires Mail::DKIM version 0.60 or later which includes ARC support.

But the last release on metacpan is 0.53, and 0.51 is identical to it except some test cases added. Isn't 0.51 suffice?

[jrlevine]

On Sat, 6 Oct 2018, IKEDA Soji wrote: Draft documentation was merged: https://sympa-community.github.io/manual/customize/dkim-arc.html I have a question: Doc says: > ARC requires Mail::DKIM version 0.60 or later which includes ARC support. But the last release on [metacpan](https://metacpan.org/release/Mail-DKIM) is 0.53, and 0.51 is identical to it except some test cases added. Isn't 0.51 suffice?

You're right. I checked, anything since 0.50 is OK. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly

[ikedas]

You're right. I checked, anything since 0.50 is OK.

Thanks for confirming. Unfortunately current Sympa have to support Perl 5.8.1 at earliest while 0.50 uses // operator. I'll adopt 0.51.

[ikedas]

If there are no more problems, this issue will be closed in the next week, i.e. beta test will be finished!