Authentication

• Table of Contents
• Does GreenArrow Software Support DKIM, DMARC, and SPF Authentication Mechanisms?
  • Sending Mail
  • Receiving Mail
• How Is DKIM Signing Managed?
• Does the MTA support MTA-STS?

Does GreenArrow Software Support DKIM, DMARC, and SPF Authentication Mechanisms?

Sending Mail

GreenArrow Engine currently supports DKIM signing outbound mail, and supports the ability to sign with multiple domains if desired.

Support for SPF and DMARC for outbound mail is independent of GreenArrow, as both are implemented through DNS TXT records.

GreenArrow does not require that email be SPF authenticated or DKIM signed or pass DMARC to be delivered via SMTP.

Receiving Mail

GreenArrow Engine does not currently support SPF, DKIM, or DMARC validation on inbound messages.

How Is DKIM Signing Managed?

There are a number of options available in GreenArrow Engine for managing DKIM keys:

• The DKIM Keys API.
• The dkim_key directive.
• The PowerMTA DKIM signing compatibility directives.
• The DKIM Keys UI

Per-message signing behavior can be controlled with:

• The X-GreenArrow-DKIM header. This enables behavior such as having multiple DKIM signatures on a single email, and/or choosing specific selectors.
• The X-DKIM-Options header processed by the PowerMTA DKIM signing compatibility system, enabled with the pcompat_process_x_dkim_options_header directive.

Configuration options available include:

• Specifying an entirely new default DKIM signing behavior. For example, this can be used to cause all email to be signed with an infrastructure domain name in addition to the RFC5322.From domain.
• Support for DKIM header over-signing to guard against DKIM Replay attacks.
• Support for ignoring headers when DKIM signing.
• Control over DKIM canonicalization.

Does the MTA support MTA-STS?

Not at this time, but support will be added. If you need it, please contact us.