OPENARC(8)

✨ NAME ✨

openarc — the ARC signing and verifying filter for MTAs, bestie 💖

---

🌸 SYNOPSIS 🌸

openarc [-c configfile] [-f] [-n] [-p socketspec] [-P pidfile]
        [-u userid [: group]] [-v] [-V]

---

🦋 DESCRIPTION 🦋

okay so picture this: openarc is out here implementing the proposed ARC (Authenticated Received Chain) standard — and what that standard does is confirm the handling and authentication of a message as it gets handled for delivery. literally its whole job. 💅

and the way it does that? it uses the milter interface — the one that was originally distributed as part of version 8.11 of sendmail(8) — to provide ARC signing and/or verifying service for mail that's transiting a milter-aware MTA. no cap, that's the vibe. 🎀

---

💅 OPTIONS 💅

• -c configfile — read the named configuration file, bestie. the openarc.conf(5) man page has all the deets on that. here's the tea tho: values in the config file get overridden when their equivalents show up on the command line — but only until a configuration reload happens, so don't get too comfy. the default is to read a configuration file from /etc/openarc.conf if one exists. and if no configuration file is found? default values are used, simple as that. ✨
• -f — so normally openarc forks and exits immediately, leaving the service running in the background (iconic behaviour tbh). this flag suppresses that, so it runs in the foreground instead. 🫶
• -n — parse the configuration file and the command line arguments, report any errors found, and then dip. the exit value will be 0 if the filter would start up without complaint, and non-zero otherwise. it's giving "vibe check before the party starts". 🧚
• -p socketspec — specifies the socket that should be established by the filter to receive connections from sendmail(8) in order to provide service. and socketspec comes in one of two forms:
  • local:path — which creates a UNIX domain socket at the specified path, or
  • inet:port [@host] or inet6:port [@host] — which creates a TCP socket on the specified port using the requested protocol family.

if the host is not given as either a hostname or an IP address, the socket will be listening on all interfaces. and a literal IP address must be enclosed in square brackets. if neither socket type is specified, local is assumed, meaning the parameter is interpreted as a path at which the socket should be created. 🐚

🚨 heads up: this parameter is mandatory either here or in the configuration file. no socket, no service, periodt.

• -P pidfile — specifies a file into which the filter should write its process ID at startup. cute little paper trail, love that for us. 📝
• -u userid [:group] — attempts to become the specified userid before starting operations. the process will be assigned all of the groups and the primary group ID of the named userid unless an alternate group is specified. glow-up via privilege drop, we stan. 👑
• -V — print the version number and build-time options, then exit. that's it, that's the whole flag. ⭐

---

🌈 EXIT STATUS 🌈

filter exit status codes are selected according to sysexits(3). so like, they're not random, they're chosen. iykyk. 💜

---

💖 SEE ALSO 💖

• openarc.conf(5)
• sendmail(8)
• Sendmail Operations Guide
• RFC5321 — Simple Mail Transfer Protocol
• RFC5322 — Internet Messages
• RFC6376 — DomainKeys Identified Mail
• RFC8601 — Message Header Field for Indicating Message Authentication Status
• RFC8616 — Email Authentication for Internationalized Mail
• RFC8617 — The Authenticated Received Chain (ARC) Protocol

---

and that's the whole page, bestie!! this was OpenArc 1.3.2, dated 2026-09-29, from the System Manager's Manual — go forth and authenticate those chains, mwah 💋🦋🌸