mirror of
https://github.com/mailscope/kumomta.git
synced 2026-08-19 19:08:17 +00:00
Wez Furlong
51 lines
1.9 KiB
Markdown
51 lines
1.9 KiB
Markdown
# arc_verify
|
|
|
|
```lua
|
|
local result = message:arc_verify(OPT_RESOLVER_NAME)
|
|
```
|
|
|
|
{{since('2025.12.02-67ee9e96')}}
|
|
|
|
This method will verify the [Authenticated Received
|
|
Chain](https://datatracker.ietf.org/doc/html/rfc8617) in the message, returning
|
|
an [AuthenticationResult](../authenticationresult.md) object indicating the
|
|
status of the verification.
|
|
|
|
The `result` field in the returned authentication result can have one
|
|
of the following values, as specified by RFC8617:
|
|
|
|
* `none` - no ARC sets were present in the message
|
|
* `pass` - all ARC sets validated, the chain of custody is intact
|
|
* `fail` - something prevented validating the chain of custody. The `reason`
|
|
field will offer a (potentially partial) explanation.
|
|
|
|
There are a number of checks associated with validating the ARC chain of
|
|
custody, some of which will compound and cause subsequent checks to fail.
|
|
Interally the ARC validator tracks all of these but will only expose the first
|
|
such failure in the `reason` field of the `AuthenticationResult` object for the
|
|
sake of brevity.
|
|
|
|
The `OPT_RESOLVER_NAME` parameter is an optional string parameter that
|
|
specifies the name of a alternate resolver defined via
|
|
[kumo.dns.define_resolver](../kumo.dns/define_resolver.md). You can omit this
|
|
parameter and the default resolver will be used.
|
|
|
|
## Example: obtaining the status
|
|
|
|
```lua
|
|
kumo.on('smtp_server_data', function(msg, conn_meta)
|
|
local arc = msg:arc_verify()
|
|
kumo.log_info('ARC result', kumo.serde.json_encode_pretty(arc))
|
|
if arc.result == 'fail' then
|
|
-- Please note that this is technically a "BAD" example, as
|
|
-- RFC8617 says: a message with an Authenticated Received Chain
|
|
-- with a Chain Validation Status of "fail" MUST be treated the
|
|
-- same as a message with no Authenticated Received Chain
|
|
kumo.reject(
|
|
550,
|
|
'5.7.29 ARC Validation failure: ' .. tostring(arc.reason)
|
|
)
|
|
end
|
|
end)
|
|
```
|