Received-SPF versus Authentication-Results

[dwbotsch]

So my DKIM results are in the "authentication-results" header (added by amavisd).
SPF results are currently in a Received-SPF header.

Does OpenARC look at both of those (and does it look at Received-SPF at all?) or does it only look at the (possibly multiple) Authentication-Results headers?

thanks!
-daveb

[flowerysong]

The milter will parse all Authentication-Results headers with the same authserv-id that it is configured to use, discarding older results for the same authentication type if encountered (except for DKIM, which all accumulate.)

Parsing of Received-SPF has not been implemented, AFAICS.

[dwbotsch]

Anyway to deal with multiple authserver ids... eg milter 1 adds authentication-results with authserver id 1 milter 2 with authserv id 2 then openarc rolls all those up into its arc-authentication-results. thanks

…

On Tue, Dec 09, 2025 at 03:30:54PM -0800, flowerysong wrote: flowerysong left a comment (flowerysong/OpenARC#36) The milter will parse all `Authentication-Results` headers with the same `authserv-id` that it is configured to use, discarding older results for the same authentication type if encountered (except for DKIM, which all accumulate.) Parsing of `Received-SPF` has not been implemented, AFAICS. -- Reply to this email directly or view it on GitHub: #36 (comment) You are receiving this because you authored the thread. Message ID: ***@***.***>

-- ******************************** David William Botsch Programmer/Analyst @CornellCNF ***@***.*** ********************************

[juresaht2]

I would also be interested in the answer regarding to how to use this in a cluster setup.

[flowerysong]

As noted in RFC 8601:

For simplicity and scalability, the authentication service identifier
SHOULD be a common token used throughout the ADMD. Common practice
is to use the DNS domain name used by or within that ADMD, sometimes
called the "organizational domain", but this is not strictly
necessary.

While it would be possible for OpenARC's milter to support the use of multiple service IDs within a single ADMD, no one has implemented that and it's not something I personally will be prioritizing.