mirror of
https://github.com/suitenumerique/messages.git
synced 2026-08-17 21:25:41 +02:00
New "arc" inbound_auth mode derives dkim/dmarc only from an ARC-sealed ARC-Authentication-Results whose outermost sealer is in SPAM_CONFIG["trusted_arc_sealers"] (empty = any valid seal); plaintext headers are never trusted. New SPAM_CONFIG["rules"][..]["arc_verdict"] (trusted|untrusted) marks or drops inbound mail lacking a valid trusted seal, so a publicly-reachable mta-in effectively accepts only mail sealed by a trusted relay. The chain is verified with dkimpy; a verification/DNS failure never spams or drops. Config reference in docs/spam.md. --------- Co-authored-by: Riël Notermans <riel@mosa.cloud> Co-authored-by: Riël Notermans <riel@zzapps.nl>