mirror of
https://github.com/suitenumerique/messages.git
synced 2026-09-18 07:47:45 +02:00
New "arc" inbound_auth mode derives dkim/dmarc only from an ARC-sealed ARC-Authentication-Results whose outermost sealer is in SPAM_CONFIG["trusted_arc_sealers"] (empty = any valid seal); plaintext headers are never trusted. New SPAM_CONFIG["arc_gate"] (off|spam|drop) marks or drops inbound mail lacking a valid trusted seal, so a publicly-reachable mta-in effectively accepts only mail sealed by a trusted relay. The chain is verified with dkimpy; a verification/DNS failure never spams or drops. core/mda/arc.py holds the shared verifier. Config reference in docs/spam-config.md.