bongo/docs/mail-authentication.md

Mail authentication

Bongo 0.7 uses separate, established libraries for each mail-authentication job:

• libspf2 checks the SMTP client and envelope identity on incoming mail.
• OpenDKIM verifies incoming signatures and signs outgoing mail.
• OpenDMARC evaluates SPF and all DKIM results against the single RFC5322 From domain.
• GNU Mailutils parses the RFC5322 From field; it is not an SPF, DKIM or DMARC engine.
• libsrs2 rewrites the envelope sender when mail is forwarded and reverses the resulting SRS recipient when a bounce returns.

Incoming checks run on unauthenticated external SMTP sessions. Authenticated submission and the restricted internal-relay listener are not rejected by DMARC. Bongo writes the local SPF, DKIM and DMARC decisions into one Authentication-Results field before handing the message to the queue. At that trust boundary, all incoming Authentication-Results fields are removed because an unauthenticated sender can forge them. Bongo then adds one fresh local result field after verification.

The relevant smtp configuration keys are:

• spf_verify, dkim_verify, and dmarc_verify enable the incoming checks.
• dmarc_enforce defers temporary lookup failures and rejects messages when a sampled p=reject policy applies. A p=quarantine result remains accepted and is recorded for later filtering; it is never treated as reject.
• dkim_sign_outgoing, dkim_key_directory, dkim_selector, and dkim_signing_domain control outgoing DKIM signatures.
• srs_forward, srs_reverse, srs_domain, and srs_secret_file control SRS forwarding and bounce reversal.

The SRS secret and DKIM private keys must not be readable by other users. SRS addresses are envelope addresses such as SRS0=...@example.org; SRS is not a message-header format.

SPF and DMARC are DNS policies rather than per-message signatures. The setup wizard should publish or validate their DNS records, while the SMTP agents only evaluate them at delivery time.