Skip to main content

ARC CV=none

jimhermann
Folks, I activated ARC signing to help mailing list delivery to Gmail. The headers for my server ARC indicate that CV=none for I=2 although the I=1 outlook.com headers passed. What do I need to do? Add outlook.com to a Trusted ARC Sealers list? Where? Do I need to

Comments

19 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  It's worth noting that cPanel's ARC support is still technically experimental and we may not have all the customization options you need readily available.

    At this time, there is no way to adjust the ARC headers on a cPanel system from the defaults shown here: https://www.cpanel.net/blog/products/introducing-experimental-arc-support/

    Can you let me know what specific failure message you're experiencing so I can do a bit more research on this?

    0
  • Vincent Vu

    Was looking for this too... cv for cpanel should be c=pass when all conditions are valid. but it is coming up as none.

    0
  • cPRex Jurassic Moderator

    Vincent Vu - can you let me know what issues that default is causing so I can bring it up with the team?

    0
  • Vincent Vu

    I'll post up a few tests I've been running, but doesnt seem like arc is validating. Dkim, dmarc, spf all passes but cv returns none.

    When the forwarder has an attachment, this completely fails, as the antivirus scans the attachment and changes the body hash which destroys the dkim.

    0
  • jimhermann

    cPRex,

    I don't receive an error message other than the cv=none in the ARC header. This result breaks the ARC process. If the chain validation (CV) tag is none, then the previous ARC authentication won't be used.

    Is the Trusted Arc Sealer list something that I can modify with the Exim Advanced Editor?

    Thanks,

    Jim

    0
  • Vincent Vu

    Hey Jim,
    I'm also having the same issue, looks like cPanel's EXIM doesn't exactly expose anything to verify the ARC.

    0
  • cPRex Jurassic Moderator

    There currently isn't a way to modify that value in cPanel.  Having the header show "none" doesn't indicate an error, so I'd need something that's actually causing a problem so I can bring that up with the development team.

    Are you seeing that ARC isn't being verified on cPanel systems?  

    0
  • Vincent Vu

    That's correct, ARC doesn't get verified on cPanel. Maybe Spamassassin's 4.0.3 might help solve some of this.

    0
  • cPRex Jurassic Moderator

    Let me reach out to the email team about this issue and I'll let you know what I find!

    0
  • Vincent Vu

    Another issue is when using smart host with ARC, the X Forward and all the other headers should not be added. That already damages the original header hashes.

    0
  • cPRex Jurassic Moderator

    I did want to let you know I have reached out to the team and I'll be sure to post an update as soon as I hear back!

    0
  • jimhermann

    I received a notice that a comment was posted by Vincent Vu about 8 hours ago, but the comment does not exist anymore. Was the suggested code addition wrong?

    Thanks.

    Jim

    0
  • Vincent Vu

    jimhermann no it was right. I've checked it on my own system.

    0
  • Vincent Vu
    • Edited

    custom_begin_check_message_pre... add it here.

    .ifdef ARCSIGNING
      warn
        verify = arc/none:pass:fail

      warn
        add_header = :at_start:${authresults {${primary_hostname}}}
    .endif


    https://github.com/Exim/exim/blob/master/doc/doc-txt/experimental-spec.txt

    Verification
    --
    An ACL condition is provided to perform the "verifier actions" detailed
    in section 6 of the above specification.  It may be called from the DATA ACL
    and succeeds if the result matches any of a given list.
    It also records the highest ARC instance number (the chain size)
    and verification result for later use in creating an Authentication-Results:
    standard header.
     
      verify = arc/<acceptable_list>   none:fail:pass
     
      add_header = :at_start:${authresults {<admd-identifier>}}
     
    Note that it would be wise to strip incoming messages of A-R headers
    that claim to be from our own <admd-identifier>.  Eg:
     
      remove_header = \N^(?i)Authentication-Results\s*::\s*example.org;\N
     
    There are four new variables:
     
      $arc_state One of pass, fail, none
      $arc_state_reason (if fail, why)
      $arc_domains colon-sep list of ARC chain domains, in chain order.
    problematic elements may have empty list elements
      $arc_oldest_pass lowest passing instance number of chain

    Would have thought this would have been sorted out by the cPanel team.
    0
  • cPRex Jurassic Moderator

    I haven't heard back from the team on how they want to handle this one just yet, but hopefully I'll have more details next week!

    0
  • jimhermann

    Vincent,

    Is the remove_header statement supposed to go before the add_header statement?

    I used this code to fix ARC for forwarded messages but not for mailing list messages.

    The DKIM check failed due to added Message Footer and Subject prefix, so I removed them.  Now the DKIM check fails with this notation: 

     (signature did not verify; headers probably modified in transit)

    I don't know which headers are being changed by mailing list or MTA.  The DKIM Signature uses:

    h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck

    I don't think these headers are changed if Subject prefix is blank

    Jim

    0
  • Vincent Vu
    • Edited

    Yes it's suppose to go before the add header. Make sure you turn off Apache SpamAssassin™: Global Subject Rewrite. You don't want that, don't let anything rewrite the subject.

    Ah I misread that, so the ARC works for forwardining but not mailing list.

    I can probably take a look into it.

    0
  • cPRex Jurassic Moderator

    I've done a bit more research on this and I've spoken with the email team and I just wanted to clarify a bit of information before we dig deeper here.

    If you send an email *from a cPanel server itself* that isn't something that will get validated by ARC.  ARC is only going to add the validation chain to messages there it is signed by an external server, and then forwarded on from cPanel to another location.

    If *that* behavior isn't happen, we'll likely need to see a ticket as I've confirmed with the email team that forwarded message are properly being signed once ARC is enabled.

    If something else is happening I'll need a bit more clarification so I can look into it a bit.

    0
  • Vincent Vu
    • Edited

    Jimmy and CPRex

    ARC only needs signing if the email originates from the server. So the current implementation is correct.

    Also Rex, when you press restore to default in Exim, it doesn't quite restore EXIM to default, it's quite buggy, it restores to a default that loses a fair few values present on the initial install (just note).

    The implementation above that I mentioned will solve the ARC when forwarding, that is definitely the only missing part to the current implementation.

    The reason why that's important is because gmaily from Google is being removed, so ARC is going to be important when forwarding.

    Why is it needed, when emails arrive on the server, it needs to be ARC verified (the missing implementation), then the server is allowed to add headers and change the email as required. It is then signed and sealed by the implementation that's marked Experimental.

    I assume Jimmy has already resolved it, as that was the correct approach to getting ARC implemented.

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post