✨(inbound) ARC relay-trust: inbound_auth "arc" + arc_gate#756
Closed
mosa-riel wants to merge 2 commits into
Closed
✨(inbound) ARC relay-trust: inbound_auth "arc" + arc_gate#756mosa-riel wants to merge 2 commits into
mosa-riel wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughARC verification and trusted-sealer matching now feed cached inbound pipeline results for configurable spam/drop gating and ARC-based authentication. Configuration documentation and tests cover verification outcomes, verdicts, DNS failures, and gate actions. ChangesARC inbound trust and authentication
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant InboundMessage
participant InboundPipeline
participant arc_result
participant check_inbound_authentication
InboundMessage->>InboundPipeline: raw inbound bytes
InboundPipeline->>arc_result: verify ARC chain and trusted sealers
arc_result-->>InboundPipeline: trusted, sealer, aar, dnsfail
InboundPipeline->>InboundPipeline: apply arc_gate action
InboundPipeline->>check_inbound_authentication: cached ARC result
check_inbound_authentication-->>InboundPipeline: authentication verdict
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/backend/core/mda/arc.py`:
- Around line 31-34: Remove the result["dnsfail"] = True assignment from the
broad-exception handler in arc_verify so parser errors remain untrusted and
follow the normal drop/spam path; retain the warning and returned result
behavior. Update src/backend/core/tests/mda/test_arc.py lines 40-45 to expect
dnsfail=False for this error case.
In `@src/backend/core/mda/inbound_auth.py`:
- Around line 237-239: Update the trusted ARC sealer normalization comprehension
in the spam configuration parsing flow to filter or otherwise validate each item
as a string before calling strip(), while preserving the existing trimming,
trailing-period removal, lowercasing, and exclusion of empty values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 226bf65e-4ead-4b1f-9f0a-16ad187c99bb
📒 Files selected for processing (7)
docs/spam-config.mdsrc/backend/core/mda/arc.pysrc/backend/core/mda/inbound_auth.pysrc/backend/core/mda/inbound_pipeline.pysrc/backend/core/tests/mda/test_arc.pysrc/backend/core/tests/mda/test_inbound_auth.pysrc/backend/messages/settings.py
New "arc" inbound_auth mode derives dkim/dmarc only from an ARC-sealed ARC-Authentication-Results whose outermost sealer is in SPAM_CONFIG["trusted_arc_sealers"] (empty = any valid seal); plaintext headers are never trusted. New SPAM_CONFIG["arc_gate"] (off|spam|drop) marks or drops inbound mail lacking a valid trusted seal, so a publicly-reachable mta-in effectively accepts only mail sealed by a trusted relay. The chain is verified with dkimpy; a verification/DNS failure never spams or drops. core/mda/arc.py holds the shared verifier. Config reference in docs/spam-config.md.
mosa-riel
force-pushed
the
feat/inbound-arc-trust
branch
from
July 20, 2026 20:10
5b602cd to
c660f0f
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/backend/core/mda/inbound_auth.py`:
- Around line 234-240: Update trusted_arc_sealers to normalize the configured
value before iterating: treat a single string as a one-item list and convert
other supported iterable configuration values to a list, while using an empty
list for non-iterable types such as integers or booleans. Preserve the existing
string filtering and domain normalization for each entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8b2609bd-f549-465b-b6f9-06edb9b5d7b1
📒 Files selected for processing (7)
docs/spam-config.mdsrc/backend/core/mda/arc.pysrc/backend/core/mda/inbound_auth.pysrc/backend/core/mda/inbound_pipeline.pysrc/backend/core/tests/mda/test_arc.pysrc/backend/core/tests/mda/test_inbound_auth.pysrc/backend/messages/settings.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Member
|
Thanks!! merged as cf0b70e |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add ARC-based sender trust for inbound mail, in
SPAM_CONFIG:inbound_auth: "arc"— verdict backend that reads dkim/dmarc only from anARC-Authentication-Resultssealed by a trusted sealer. Plaintext headers are never read.arc_gate— enforce that mail is sealed by a trusted relay:off | spam | drop.Why
With
inbound_auth: authentication-results, dkim/dmarc come from the top-levelAuthentication-Results, trusted by Received-block position. A host delivering straight to the MDA can forge that header (andFrom:) and show as verified. When inbound is relayed by a provider that ARC-seals (a filtering relay in front of a public MX), the seal is an unforgeable anchor — verify it instead of trusting a plaintext header.Config
{ "inbound_auth": "arc", "trusted_arc_sealers": ["relay.example"], // empty = any valid seal "arc_gate": "spam" // off | spam | drop }arcmode → verdict from the trusted sealer's sealed AAR; unsealed → unverified.arc_gate→ action when not trusted-sealed:spam(is_spam=True) /drop(discard).Design choices
i=) must be allowlisted. Empty list = any valid seal (weak; only safe when the MDA is IP-restricted to the relay).arcmode — falling back reopens the hole.SPAM_CONFIGbesideinbound_auth, reusing per-domain overrides. (These keys are auth/trust, not spam — a split is possible but out of scope.)Tests
core/mda/arc.pyverifier,arcverdict mode, gate step — incl. a hermetic real-crypto case (synthetic seal + stub DNS). No new dependency (dkimpy already vendored). Config reference:docs/spam-config.md.Follow-up (PR2)
arc_gate: quarantine— hold untrusted mail (recoverable, admin-visible) via a newInboundMessagestate — a first-class "untrusted" bucket instead of reusing spam/drop.dnsfail: separate transient DNS from malformed/hostile input.Summary by CodeRabbit
trusted_arc_sealersconfiguration andarc_gateactions to allow, mark as spam, or drop based on verified ARC sealing.SPAM_CONFIGdocumentation with detailed environment-variable semantics, examples, and security guidance.arc_gatepipeline behavior.