search

pimlie / authres_status

Roundcube plugin that checks the Authentication-Results headers (rfc5451) of your emails and displays the verification status.
Other
36 stars 20 forks source link

Support for ARC-headers #27

Closed wioxjk closed 6 years ago

wioxjk commented 6 years ago

Is there any plans for verifying ARC headers?

pimlie commented 6 years ago

I am not using ARC at the moment myself unfortunately, if you could share some passing and failing headers that would be helpfull. Thanks.

Btw, for the moment it looks like we would only need to add 'arc' to $RFC5451_authentication_methods.

wioxjk commented 6 years ago

Successful auth

ARC-Authentication-Results: i=3; hashmal.selea.se; dkim=pass (1024-bit key) header.d=webadmin8.net

Failed auth:

 arc=fail (signature failed);

I think that it is everything, I can gladly help with testing :)

pimlie commented 6 years ago

Is there really a need to check the ARC-Authentication-Results header as well? If I check the headers in issue 66 at https://github.com/trusteddomainproject/OpenARC there is also a arc=(pass|fail) statement added to the Authentication-Results header:

Authentication-Results: mx.google.com;
       dkim=pass header.i=@heteigenwijsje.nl header.s=dkim header.b=o/sOgCmP;
       arc=fail (signature failed);
       spf=pass (google.com: domain of <PRIVATE>@heteigenwijsje.nl designates 80.127.116.100 as permitted sender) smtp.mailfrom=<PRIVATE>@heteigenwijsje.nl;
       dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=heteigenwijsje.nl

Or does that maybe depend on the ARC milter/proxy used?

wioxjk commented 6 years ago

OpenARC does seems to have a arc=(pass|fail) statement, as you say. Passing only that would probably be enough. The reason why I posted all of it is because I want to provide all the information :)

pimlie commented 6 years ago

I have added de arc authentication method, could you check if this work for you before I release a new version? Thanks :)

wioxjk commented 6 years ago

Did some tests:

  1. Sending from one mailserver directly to mine, both with OpenARC deployed:
    • All green
  2. Sending to OpenARC-testing mailing list:
    • Fail, it seems like one of the servers in the chain fails to verify the chain for some reason - therefore authres should verify that the chain fails and it does.

I think that this works as it should!

pimlie commented 6 years ago

Thanks for letting me know, just pushed a new release with this change :+1: