25. pepsi-stage-arc

ARC verification, signing and sealing — the entry stage on the inbound path.

25.1. Role

pepsi-stage-arc implements ARC (RFC 8617). It verifies any existing inbound ARC chain and, when an ARC_DOMAIN and its keys are configured, seals the message as our ADMD so the boundary authentication verdict survives Pepsi’s forwarding hop. Because it applies only to mail we receive and forward, it must never touch our own submissions (state.local_origin) — those are signed as the author domain by pepsi-stage-dkim-sign instead, and the stage skips any such message. On a host that both receives and submits, place it on the inbound branch only, after the state.local_origin split (ahead of SRS); on a receive-only host it is the [stage-init] stage. Reference: pepsi-stage-arc(1).

25.2. Features

  • ARC verification of any inbound chain; the verdict is recorded under state.auth.arc.

  • ARC sealing: prepends a fresh ARC set — ARC-Authentication-Results (AAR), ARC-Message-Signature (AMS) and ARC-Seal (AS) — as the ARC_DOMAIN identity, signed with the single ARC_ALGORITHM (rsa or ed25519; ARC permits one signature per hop).

  • Faithful AAR: re-runs SPF/DKIM/DMARC/ARC verification so the AAR mirrors the receiver’s full assessment and the chain-validation (cv=) value is correct (it cannot be reconstructed from stored header text).

  • Prepend-only: the seal is added at the top, so existing lower signatures and the ingress Received: header are undisturbed; only the headers column is rewritten, never the body.

  • Fail-open: if the origin context, [pepsi] config or keys are missing, or sealing errors, the message is advanced unsealed with a warning (the verdict is still recorded when computable).

25.3. Configuration

[stage-<name>]: PROGRAM = pepsi-stage-arc, NEXT_STAGE (required), and DNS settings DNS_SERVERS / DNS_TIMEOUT. The signing identity, keys and algorithm come from the shared [pepsi] section (ARC_DOMAIN, ARC_ALGORITHM, KEY_DIR, DKIM_SELECTOR). See pepsi-stage-arc(1).

25.4. State

  • Inputs: state.local_origin — when true the message is advanced untouched (no ARC on mail we originate); otherwise state.origin — the authserv_id (required to reproduce the AAR identity; without it the stage advances unsealed), and remote_ip / helo for the re-run verification context.

  • Outputs: overwrites state.auth.arc with the re-evaluated chain verdict (the rest of state, including state.auth siblings and state.dsn, is preserved).

25.5. See also

pepsi-ingress, pepsi-stage-dkim-sign, Supported Features, pepsi-stage-arc(1).