mailserver: Enable ARC signing

[mweinelt]

Works similarly to DKIM and uses the same keys. Went for a 2048 bit RSA key for compat reasons. Larger ones are probably too large to put them into DNS.

Untested.

[jfly]

Thanks for tackling this! Code looks reasonable to me, I also have not tested it. I can deploy a version of this to my personal mailserver next week if that would be helpful.

Is ARC generally applicable for SNM users? Or is it really only useful if you're operating mailing lists and forwarding emails onto other domains? If it's generally applicable, I'd like to submit these instructions to the SNM setup guide.

[jfly]

Should we reload rspamd.service when this changes? Please include restartUnits if appropriate.

[Mic92]

Looks similar to mine: https://github.com/Mic92/dotfiles/blob/main/machines/eve/modules/rspamd/rspamd.nix

[jfly]

nit: Could we add a comment here helping people understand where the other half of this is? For example, see this DKIM comment.

[jfly]

nit: Could you elaborate on this a bit? Specifically where the public half of this comes from? See

infra/non-critical-infra/modules/mailserver/default.nix

Lines 24 to 36 in d30eea2

	# How to generate:
	#
	# ```console
	# cd non-critical-infra
	# DOMAIN=nixos.org
	# SELECTOR=mail
	# PRIVATE_KEY_PATH=secrets/$DOMAIN.$SELECTOR.key.umbriel
	# nix shell nixpkgs#opendkim --command opendkim-genkey --selector="$SELECTOR" --domain="$DOMAIN" --bits=1024
	# mv mail.private "$PRIVATE_KEY_PATH"
	# sops encrypt --in-place "$PRIVATE_KEY_PATH"
	# ```
	#
	# Next, look at `mail.txt` and update DNS accordingly.

for how I handled this for DKIM.

[jfly]

Forgot to click approve. LGTM

[mweinelt]

Is ARC generally applicable for SNM users? Or is it really only useful if you're operating mailing lists and forwarding emails onto other domains? If it's generally applicable, I'd like to submit these instructions to the SNM setup guide.

Google and iCloud require it for bulk senders. Proposed in https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/merge_requests/376.

[jfly]

Discussed at today's infra meeting: @jfly to test this on his personal mailserver and then deploy this if all looks good

[jfly]

@mweinelt, I deployed a version of this to my personal mailserver and while it didn't break anything, I couldn't find any evidence of this doing anything. Emails I sent directly as a SMTP-authenticated user, and emails I relay through it all don't show any ARC related headers when they land in my personal gmail. I also don't see anything showing up in rspamd logs.

[mweinelt]

@Mic92 also has this configured, can you give that a try?

      allow_username_mismatch = true;

We have that for DKIM in nixos-mailserver as well.

[jfly]

I will try when I'm back at a computer!

[jfly]

Adding allow_username_mismatch = true; doesn't see to have made a difference. I've been banging my head against this unproductively for too long. I'm not sure I'll have time to look at this again until next week, sorry!