arc

README

arc

ARC — Authenticated Received Chain (RFC 8617) — verification for Go.

ARC lets a message's authentication assessment survive intermediaries (mailing lists, forwarders) that legitimately break DKIM and SPF. Each participating hop adds an ARC set — ARC-Authentication-Results, ARC-Message-Signature, ARC-Seal — and a downstream verifier can cryptographically confirm the whole chain.

arc.Verify validates, over the raw message bytes:

1. chain structure — sets numbered contiguously 1..N, each complete; and
2. cryptography (RFC 8617 §5.2) — the most recent ARC-Message-Signature verifies over the message, and every ARC-Seal verifies over the ARC header chain up to its instance.

An ARC-Message-Signature is structurally a DKIM-Signature and an ARC-Seal is a DKIM-style signature over the ARC headers, so this package builds on the canonicalization and signature primitives exported by github.com/rest-mail/go-dkim — ARC verification is therefore byte-for-byte consistent with DKIM verification over the same message.

Install

go get github.com/rest-mail/go-arc

Verify

arc.Verify returns a chain-validation status ("pass", "fail", or "none") plus a human-readable reason. Pass nil for the resolver to use system DNS, or inject a dkim.TXTResolver (its signature matches net.Resolver.LookupTXT) in tests.

package main

import (
	"context"
	"fmt"

	"github.com/rest-mail/go-arc"
)

func main() {
	raw := []byte( /* a raw message carrying ARC-* header sets */ )

	cv, reason := arc.Verify(context.Background(), raw, nil)
	fmt.Printf("arc=%s (%s)\n", cv, reason)
	// cv is "pass", "fail", or "none"; feed it into an
	// Authentication-Results header as arc=<cv>.
}

License

MIT © 2026 rest-mail

Documentation

Overview

Package arc verifies Authenticated Received Chain (ARC) headers per RFC 8617.

ARC lets a message's authentication assessment survive intermediaries (mailing lists, forwarders) that legitimately break DKIM/SPF. Each hop adds an ARC set — ARC-Authentication-Results, ARC-Message-Signature, ARC-Seal — and this package cryptographically validates the resulting chain.

An ARC-Message-Signature is structurally a DKIM-Signature and an ARC-Seal is a DKIM-style signature over the ARC header chain, so this package reuses the canonicalization and signature primitives exported by github.com/rest-mail/go-dkim, guaranteeing ARC verification is byte-for-byte consistent with DKIM verification over the same message.

Index

• func Verify(ctx context.Context, rawMessage []byte, resolver dkim.TXTResolver) (string, string)

Functions

func Verify

func Verify(ctx context.Context, rawMessage []byte, resolver dkim.TXTResolver) (string, string)

Verify cryptographically verifies the ARC chain (RFC 8617 §5.2) in a raw message: the most recent ARC-Message-Signature must verify over the message (a DKIM-style signature), and every ARC-Seal must verify over the ARC header chain up to its instance. It returns a chain-validation status — "pass", "fail", or "none" — plus a human-readable reason. A nil resolver uses the system DNS resolver.

Header/body canonicalization is shared with dkim.Verify (via the primitives exported by github.com/rest-mail/go-dkim), so ARC verification is consistent with DKIM verification and with any RFC 8617 verifier operating on the same bytes.