ARC sealing (forwarded mail)

Purpose. Mail this server forwards — through an alias with a remote destination, or a mailbox forwarder — arrives somewhere else having been relayed by us. SRS (SRS — sender rewriting for forwarded mail) keeps SPF passing across that hop, but any change to the message on the way through breaks the sender’s original DKIM signature and with it DMARC alignment. ARC (RFC 8617) records how the message authenticated when it reached us and signs that record, so the destination can see the original result and who is vouching for it.

Behaviour.

Rspamd’s arc module seals inbound mail — the mail that may be forwarded. Three headers are added on arrival and travel with the message when Postfix relays it: ARC-Authentication-Results (how it authenticated here), ARC-Message-Signature (the message as we saw it) and ARC-Seal (chaining the two). A second forwarder adds its own set at i=2, and so on.
The seal is signed with the domain’s existing DKIM key — same key, same ms<yyyymm> selector (with a letter after it, ms202610b, for a second rotation in one month), same published TXT record. There is no ARC key, no ARC DNS row and no ARC rotation: an ARC verifier looks up <selector>._domainkey.<domain>, which is exactly what DNS records & live verification already generates and verifies for DKIM. ARC starts working when DKIM does, which is the moment a domain is created.
The sealing identity is the local recipient domain (use_domain = "recipient") — the domain doing the forwarding, and the one whose key we hold. The template also sets use_esld = true, so rspamd may reduce that domain to its registrable domain before looking up the key: mail for a hosted subdomain such as lists.example.com may then be sealed with example.com’s key when example.com is hosted here too, and go unsealed when it is not, because try_fallback = false. That is read from the configuration and not yet measured for ARC; DKIM signing with the same setting was measured using the subdomain’s own key (DKIM signing).
Mail the server originates (authenticated submission, webmail, locally generated) is not sealed. It carries a DKIM signature of its own; an ARC set would assert nothing more.
ARC verification is separate and was already running before sealing was configured: rspamd scores ARC_ALLOW / ARC_REJECT / ARC_NA on stock defaults for every message. Nothing in this feature changes how an incoming chain is scored.

Configuration. None. local.d/arc.conf is rendered from the server configuration like every other daemon file and there is nothing to set — no admin action, no DNS to publish, no per-domain switch. A domain with no DKIM key is simply not sealed (try_fallback = false), which cannot happen in practice because domain creation rotates a key. With an outbound relay configured, the seal’s message signature leaves out Date and Message-ID, because a forwarded message leaves through the relay too and a relay such as SES overrides both, which breaks the seal (arc=fail) at the next hop; without a relay Rspamd’s default list applies (DKIM signing).

Limits & edge cases.

Sealing only applies to mail from outside local_addrs. sign_inbound means “not from a local network”, and override.d/options.inc lists the loopback, the stack’s own Compose subnet and the configured trusted networks (Relaying & trusted networks). On a real server every internet sender is outside them, so this is invisible — but it makes ARC hard to observe by sending from the Docker host: on Linux the host reaches a published port as the bridge gateway, which is inside the Compose subnet and therefore treated as local. To check sealing on a running stack, drive rspamd directly with an address it will treat as external:
Terminal window
```
docker exec mailserver-rspamd-1 rspamc --ip 203.0.113.5 \
  --from someone@remote.example --rcpt bob@yourdomain.test symbols /tmp/probe.eml
# Symbol: ARC_SIGNED (0.00)[yourdomain.test:s=ms202608:i=1]
```
Write a message to /tmp/probe.eml inside the container first, as Per-domain and per-mailbox spam settings does.
A rotation keeps old seals verifiable for 30 days, the same overlap window that protects in-flight DKIM signatures — the retired selector’s TXT record stays published (DKIM signing).
Multi-recipient inbound mail is sealed once, under whichever local recipient domain rspamd picks.
We do not (yet) let a trusted ARC chain override a DMARC failure on mail we receive. That is a separate decision about which forwarders to trust and is not taken.
ARC does not rescue a message whose content is what receivers object to. It preserves an authentication result; it does not vouch for the mail.