OPENARC.CONF(5)

💖 OPENARC.CONF 💖

okay bestie, welcome to the openarc.conf(5) page — that's File Formats Manual, section 5, and yes it's the whole vibe for configuring openarc. buckle up, it's a long one 🫶

---

🌸 NAME 🌸

openarc.conf — the configuration file for openarc, fr fr. it's literally where you tell openarc how to behave.

---

📍 LOCATION 📍

the one and only:

/etc/openarc.conf

that's the spot. put it there. 💅

---

✨ DESCRIPTION ✨

so openarc(8) is the icon that implements the ARC (Authenticated Received Chain) specification — it verifies authentication and handles messages as they get routed to their destinations. and this file? this is its configuration file. main character energy tbh. 👑

here's how the file itself works:

• Blank lines are ignored. literally just vibes, no info.
• Any line containing a hash ("#") character gets truncated at the hash character — that's how you leave comments in the file. so # is your bestie for notes. 🎀
• Everything else should be the name of a parameter, followed by white space, followed by the value of that parameter. one parameter per line, no sharing. 🙅

now, for parameters that are Boolean in nature, only the first byte of the value is processed. so:

• For positive values, these are accepted: T, t, Y, y, 1.
• For negative values, these are accepted: F, f, N, n, 0.

👀 if you wanna know how and when the config file contents get reloaded, go read the openarc(8) man page. that's where that tea lives.

and the default tea, unless stated otherwise: boolean values default to false, integer values default to 0, and string and dataset values default to being undefined. periodt. 💀

---

🧚 PARAMETERS 🧚

every single one, in order, no skips, no cap. this is the whole roster:

• AuthResComments (boolean) — controls whether Authentication-Results headers include any comments parsed from the previously existing headers.
• AuthResIP (boolean) — controls whether Authentication-Results headers include the remote IP. the default is true.
• AuthservID (string) — the authserv-id to use in Authentication-Results headers.
• AutoRestart (boolean) — automatically re-start on failures. ⚠️ use with caution; if the filter fails instantly after it starts, this can cause a tight fork(2) loop. not cute, be careful.
• AutoRestartCount (integer) — sets the maximum automatic restart count. after this number of automatic restarts, the filter will give up and terminate. a value of 0 implies no limit; this is the default.
• AutoRestartRate (string) — sets the maximum automatic restart rate. if the filter begins restarting faster than the rate defined here, it will give up and terminate. this is a string of the form n/t[u] where n is an integer limiting the count of restarts in the given interval and t[u] defines the time interval through which the rate is calculated; t is an integer and u defines the units thus represented ("s" or "S" for seconds, the default; "m" or "M" for minutes; "h" or "H" for hours; "d" or "D" for days). for example, a value of "10/1h" limits the restarts to 10 in one hour. there is no default, meaning restart rate is not limited.
• Background (boolean) — causes openarc(8) to fork and exit immediately, leaving the service running in the background. the default is true.
• BaseDirectory (string) — directory to switch to before beginning operation.
• Canonicalization (string) — selects the canonicalization method(s) to be used when signing messages. when verifying, the message's ARC-Message-Signature: header field specifies the canonicalization method. the recognized values are relaxed and simple as defined by the DKIM specification. the default is relaxed/simple. the value may include two different canonicalizations separated by a slash ("/") character, in which case the first will be applied to the header and the second to the body.
• ChangeRootDirectory (string) — requests that the operating system change the effective root directory of the process to the one specified here prior to beginning execution. chroot(2) requires superuser access. a warning will be generated if UserID is not also set. ⚠️
• Domain (string) — domain to use when signing messages. required for signing.
• EnableCoredumps (boolean) — on systems that have such support, make an explicit request to the kernel to dump cores when the filter crashes for some reason. some modern UNIX systems suppress core dumps during crashes for security reasons if the user ID has changed during the lifetime of the process. currently only supported on Linux. 🐧
• FinalReceiver (boolean) — add a non-standard arc.chain field to the Authentication-Results header, showing the domains present in the ARC chain.
• FixedTimestamp (string) — used for testing. this is not useful in a production environment. 🚧
• Include (string) — names a file to be opened and read as an additional configuration file. nesting is allowed to a maximum of five levels.
• InternalHosts (dataset) — identifies a set of hosts whose connections should be treated as "internal" by this filter. messages received from such sources will not be verified and are instead trusted as-is; in particular, their Authentication-Results fields are trusted to be correct and authentic, meaning they will be assumed to contain the correct chain status when generating an outgoing seal. see the description of "PeerList" for a description of the supported format. if no set is provided, "127.0.0.1" is added to the list by default.
• KeepTemporaryFiles (boolean) — preserve temporary files generated during signing or verification for debugging purposes. ⚠️ this can use up disk space very quickly on busy systems.
• KeyFile (string) — path to the private key to use when signing. required for signing.
• MaximumHeaders (integer) — disable processing for messages where the header section is larger than this value (in bytes). 0 disables this check, the default is 65536.
• MilterDebug (integer) — sets the debug level to be requested from the milter library. the default is 0.
• MinimumKeySizeRSA (integer) — disallows signatures whose keys are smaller than the specified size, regardless of whether they would otherwise be valid. if this is not set the library's default (which is currently 1024) will be used.
• Mode (string) — selects the operating mode(s) for this filter. if the string contains the character "s", the filter will seal messages passing through the filter by adding a new ARC set. if the string contains the character "v", the filter will validate existing ARC sets and record the chain validation status in an "Authentication-Results" header. the two can be combined. if neither is specified, the operating mode will be inferred on a per-connection basis based on the entries in the InternalHosts list; connections from internal hosts will be assigned to signing mode, and all others will be assigned to verify mode.
• OversignHeaders (string) — specifies a comma-separated list of header field names that should be included in all signature header lists (the "h=" tag) once more than the number of times they were actually present in the signed message. the set is empty by default. the purpose of this, and especially of listing an absent header field, is to prevent the addition of important fields between the signer and the verifier. since the verifier would include that header field when performing verification if it had been added by an intermediary, the signed message and the verified message were different and the verification would fail. ⚠️ note that listing a field name here and not listing it in the SignHeaders list is likely to generate invalid signatures.
• PeerList (dataset) — identifies a set of "peers" that identifies clients whose connections should be accepted without processing by this filter. the set should contain on each line a hostname, domain name (e.g. ".example.com"), IP address, an IPv6 address (including an IPv4 mapped address), or a CIDR-style IP specification (e.g. "192.168.1.0/24"). an entry beginning with a bang ("!") character means "not", allowing exclusion of specific hosts that are otherwise members of larger sets. host and domain names are matched first, then the IP or IPv6 address depending on the connection type. more precise entries are preferred over less precise ones, e.g. "192.168.1.1" will match before "!192.168.1.0/24". the text form of IPv6 addresses will be forced to lowercase when queried (RFC5952), so the contents of this data set should also use lowercase. the IP address portion of an entry may optionally contain square brackets; both forms (with and without) will be checked.
• PermitAuthenticationOverrides (boolean) — controls whether a previous Authentication-Result with the same authserv-id is allowed to override the computed ARC chain validation status. the default is false because this can be unsafe unless you have taken steps to ensure that the Authentication-Result headers seen by the filter are legitimate. ⚠️
• PidFile (string) — specifies the path to a file that should be created at process start containing the process ID.
• RequireSafeKeys (boolean) — controls whether the filter requires that private keys have safe file permissions. the default is true.
• ResponseDisabled (string) — {accept | discard | reject | tempfail} response to send after determining that this message is one that the filter is configured not to process. see SealHeaderChecks and PeerList. the default is accept.
• ResponseUnable (string) — {accept | discard | reject | tempfail} response to send after an internal error occurs that makes it impossible to finish processing the message. the default is tempfail.
• ResponseUnwilling (string) — {accept | discard | reject | tempfail} response to send after a message fails basic validity checks, such as MaximumHeaders. the default is reject.

---

and bestie… there's more coming. this was just part 1. don't go anywhere. 🌈💜

• SealHeaderChecks (string) — points at a file full of header checks that decide whether a message gets sealed or not. every line in that file has to look like name:regexp. once you set this, a message only gets processed by the filter if a header field with that name actually exists and its value matches the regexp you gave. and if a value looks like it's a JSON list, bestie, the regexp gets applied to every string in that list too. so thorough 💅
• Selector (string) — the selector used when signing messages. required for signing, no selector no signature, periodt.
• SignatureAlgorithm (string) — picks which signing algorithm to use when generating signatures. run openarc -V to see the whole list of supported algorithms. default is rsa-sha256. other values are literally not useful if you're planning to interoperate with other implementers of the ARC protocol, so… stay in your lane 🎀
• SignatureTTL (integer) — how long (in seconds) generated signatures last before they expire. default is 0, which means no expiration at all. but you probably should not set this below 604800 in production deployments, ngl. 604800 seconds is a week, so yeah, give your signatures a real lifespan ✨
• SignHeaders (string) — the set of header fields that should be included when generating signatures. expected to be a comma-separated list of header field names, and matching is case-insensitive (iconic, no caps-lock drama). if your list omits any header field that the ARC specification mandates, those fields get implicitly added anyway — the spec said what it said. by default, the fields listed in the DKIM specification as "SHOULD" be signed (RFC6376, Section 5.4) will be signed by the filter.
• Socket (string) — specifies the socket the filter should establish so it can receive connections from the MTA. socketspec comes in one of two forms:
  • local:path — creates a UNIX domain socket at the specified path
  • inet:port[@host] or inet6:port[@host] — creates a TCP socket on the specified port and in the specified protocol family

if the host isn't given as either a hostname or an IP address, the socket will be listening on all interfaces. a literal IP address must be enclosed in square brackets. and this option is mandatory — either in the configuration file or on the command line. no socket, no service 🫶

• SoftwareHeader (boolean) — add an ARC-Filter header advertising the filter name and version. little flex, honestly.
• Syslog (boolean) — log interesting activity to syslog(3). receipts, but for logs 💀
• SyslogFacility (string) — use the named facility when logging via syslog(3). default is mail.
• TemporaryDirectory (string) — directory to use when creating temporary files. default is /tmp.
• TestKeys (string) — used for testing. name of a file containing static DKIM records that will be used for validation instead of live DNS lookups, one per line.

this is not useful in a production environment. it's giving "staging only, bestie" 🙈

• UMask (integer) — requests a specific permissions mask to be used for file creation. this only applies to creation of the socket when Socket specifies a UNIX domain socket, and to the PidFile (if any). see umask(2) for more info.
• UserID (string) — attempts to become the specified userid before starting operations. the value is of the form userid[:group]. the process gets assigned all of the groups and primary group ID of the named userid unless an alternate group is specified. main character energy, but for privilege dropping 👑

---

🌈 SEE ALSO 🌈

• openarc(8)
• sendmail(8)

---

and that's the whole page, bestie, you made it to the end 🎉💖 this one's from OpenARC 1.3.2, dated 2026-09-29, and it lives in section 5 as OPENARC.CONF(5). now go configure something and slay ✨🦋🎀