#17: implement DANE TLSA, MTA-STS policy resolution, ARC sealing and mail authentication

services/protocols/internal/application/port/arc_sealer.go

@@ -0,0 +1,18 @@
+package port
+
+import "context"
+
+// ArcSealer adds an Authenticated Received Chain set to a message
+// (RFC 8617, PLAN.md section 5).
+//
+// It matters on a host that passes mail onward: a forwarder that modifies a
+// message breaks its DKIM signature, and the final receiver then sees a DMARC
+// failure for mail that authenticated correctly at the first hop. The ARC set
+// records this hop's verdict and seals it so the failure can be recognised as
+// a forwarding artefact rather than a forgery.
+type ArcSealer interface {
+	// Seal returns the message with an ARC set prepended. A chain that
+	// already failed is returned untouched: RFC 8617 section 5.1.2 forbids
+	// extending it.
+	Seal(ctx context.Context, message []byte, authResult InboundAuthResult) ([]byte, error)
+}