Hi Matt
you can do ARC validation today with the Ironports just need to do some scripting:
a) in log subsription under global settings add the following three x-headers
ARC-Authentication-Results, ARC-Seal, ARC-Message-Signature
b) built a content filter like and PVO for the following for analysis phase
GUI_Trap_ARC: if (recv-listener == "InboundInterface") AND (header("ARC-Seal")) { log-entry("-- ARC-Seal detected --"); duplicate-quarantine("TrapARCPass"); }
it is up to you to decide what to do once you understand what ends up in your quarantine. We upload the three fields above to our SIEM for every message and can run pretty good reports on senders and ARC verdicts. I would highly recommend dropping all messages where the ARC-Authentication-Results are failing.
A typical string looks like this:
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
13.86.34.99) smtp.rcpttodomain=fmc-na.com smtp.mailfrom=yammer.com;
dmarc=pass (p=quarantine sp=quarantine pct=100) action=none
header.from=yammer.com; dkim=none (message not signed); arc=none
So you need to create now a final message filter to parse for arc status and take action based on
results.
I hope that helps until we get official ARC inbound and outbound support.
-Marc
